{"answers":{"affected":"It affects 31 products.","exploited":"There is no known exploitation of CVE-2021-41769 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2021-41769 yet. Limit exposure of the affected software until one is available.","what":"CVE-2021-41769 is a high-severity vulnerability in Siemens SIPROTEC 5 6MD85 devices (CPU variant CP300), published on 11 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-41769 and fix it if it is affected.\n\nWhat it is: CVE-2021-41769 is a high-severity vulnerability in Siemens SIPROTEC 5 6MD85 devices (CPU variant CP300), published on 11 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-41769 in the wild and no public exploit code.\n\nAffected product: Siemens SIPROTEC 5 6MD85 devices (CPU variant CP300). No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-41769/ (Markdown: https://insights.sbomify.com/CVE-2021-41769/index.md)","id":"CVE-2021-41769","markdown":"https://insights.sbomify.com/CVE-2021-41769/index.md","name":"CVE-2021-41769","record":{"aliases":["GHSA-wfwh-8prq-7pvv"],"analysis":{"component_type":"ics_ot","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Siemens SIPROTEC 5","requires_auth":"none","summary":"Improper input validation in Siemens SIPROTEC 5 devices allows attackers to cause a denial of service condition.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"siemens","cpe":[{"product":"6md85_firmware","vendor":"siemens"},{"product":"6md86_firmware","vendor":"siemens"},{"product":"6md89_firmware","vendor":"siemens"},{"product":"6mu85_firmware","vendor":"siemens"},{"product":"7ke85_firmware","vendor":"siemens"},{"product":"7sa82_firmware","vendor":"siemens"},{"product":"7sa86_firmware","vendor":"siemens"},{"product":"7sa87_firmware","vendor":"siemens"},{"product":"7sd82_firmware","vendor":"siemens"},{"product":"7sd86_firmware","vendor":"siemens"},{"product":"7sd87_firmware","vendor":"siemens"},{"product":"7sj81_firmware","vendor":"siemens"},{"product":"7sj82_firmware","vendor":"siemens"},{"product":"7sj85_firmware","vendor":"siemens"},{"product":"7sj86_firmware","vendor":"siemens"},{"product":"7sk82_firmware","vendor":"siemens"},{"product":"7sk85_firmware","vendor":"siemens"},{"product":"7sl82_firmware","vendor":"siemens"},{"product":"7sl86_firmware","vendor":"siemens"},{"product":"7sl87_firmware","vendor":"siemens"},{"product":"7ss85_firmware","vendor":"siemens"},{"product":"7st85_firmware","vendor":"siemens"},{"product":"7sx800_firmware","vendor":"siemens"},{"product":"7sx85_firmware","vendor":"siemens"},{"product":"7um85_firmware","vendor":"siemens"},{"product":"7ut82_firmware","vendor":"siemens"},{"product":"7ut85_firmware","vendor":"siemens"},{"product":"7ut86_firmware","vendor":"siemens"},{"product":"7ut87_firmware","vendor":"siemens"},{"product":"7ve85_firmware","vendor":"siemens"},{"product":"7vk87_firmware","vendor":"siemens"}],"cvss":{"score":7.5,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 6MD89 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 6MU85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7KE85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SA82 devices (CPU variant CP100) (All versions \u003c V8.83), SIPROTEC 5 7SA86 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SA87 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SD82 devices (CPU variant CP100) (All versions \u003c V8.83), SIPROTEC 5 7SD86 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SD87 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SJ81 devices (CPU variant CP100) (All versions \u003c V8.83), SIPROTEC 5 7SJ82 devices (CPU variant CP100) (All versions \u003c V8.83), SIPROTEC 5 7SJ85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SJ86 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SK82 devices (CPU variant CP100) (All versions \u003c V8.83), SIPROTEC 5 7SK85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SL82 devices (CPU variant CP100) (All versions \u003c V8.83), SIPROTEC 5 7SL86 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SL87 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SS85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7ST85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7SX85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7UM85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7UT82 devices (CPU variant CP100) (All versions \u003c V8.83), SIPROTEC 5 7UT85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7UT86 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7UT87 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7VE85 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 7VK87 devices (CPU variant CP300) (All versions \u003c V8.83), SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050) (All versions \u003c V8.83). An improper input validation vulnerability in the web server could allow an unauthenticated user to access device information.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Other in SIPROTEC 5 6MD85 devices (CPU variant CP300)","id":"CVE-2021-41769","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"other","year":"2021"},"n_packages":0,"n_references":1,"next":{"headline":"XML external entity in n/a","id":"CVE-2021-41770"},"packages":[],"prev":{"headline":"Private tunnel identifier may be included in the non-private details of active connections","id":"CVE-2021-41767"},"products":["SIPROTEC 5 6MD85 devices (CPU variant CP300)","SIPROTEC 5 6MD86 devices (CPU variant CP300)","SIPROTEC 5 6MD89 devices (CPU variant CP300)","SIPROTEC 5 6MU85 devices (CPU variant CP300)","SIPROTEC 5 7KE85 devices (CPU variant CP300)","SIPROTEC 5 7SA82 devices (CPU variant CP100)","SIPROTEC 5 7SA86 devices (CPU variant CP300)","SIPROTEC 5 7SA87 devices (CPU variant CP300)","SIPROTEC 5 7SD82 devices (CPU variant CP100)","SIPROTEC 5 7SD86 devices (CPU variant CP300)","SIPROTEC 5 7SD87 devices (CPU variant CP300)","SIPROTEC 5 7SJ81 devices (CPU variant CP100)","SIPROTEC 5 7SJ82 devices (CPU variant CP100)","SIPROTEC 5 7SJ85 devices (CPU variant CP300)","SIPROTEC 5 7SJ86 devices (CPU variant CP300)","SIPROTEC 5 7SK82 devices (CPU variant CP100)","SIPROTEC 5 7SK85 devices (CPU variant CP300)","SIPROTEC 5 7SL82 devices (CPU variant CP100)","SIPROTEC 5 7SL86 devices (CPU variant CP300)","SIPROTEC 5 7SL87 devices (CPU variant CP300)","SIPROTEC 5 7SS85 devices (CPU variant CP300)","SIPROTEC 5 7ST85 devices (CPU variant CP300)","SIPROTEC 5 7SX85 devices (CPU variant CP300)","SIPROTEC 5 7UM85 devices (CPU variant CP300)","SIPROTEC 5 7UT82 devices (CPU variant CP100)","SIPROTEC 5 7UT85 devices (CPU variant CP300)","SIPROTEC 5 7UT86 devices (CPU variant CP300)","SIPROTEC 5 7UT87 devices (CPU variant CP300)","SIPROTEC 5 7VE85 devices (CPU variant CP300)","SIPROTEC 5 7VK87 devices (CPU variant CP300)","SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050)"],"published":"2022-01-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["Siemens"]},"summary":"Improper input validation in Siemens SIPROTEC 5 devices allows attackers to cause a denial of service condition.","url":"https://insights.sbomify.com/CVE-2021-41769/"}