# CVE-2021-41769: Other in SIPROTEC 5 6MD85 devices (CPU variant CP300)

> Improper input validation in Siemens SIPROTEC 5 devices allows attackers to cause a denial of service condition.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 11 Jan 2022
- **Updated:** 4 Aug 2024
- **Also known as:** GHSA-wfwh-8prq-7pvv

## What is CVE-2021-41769?

CVE-2021-41769 is a high-severity vulnerability in Siemens SIPROTEC 5 6MD85 devices (CPU variant CP300), published on 11 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD89 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MU85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7KE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SA86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ81 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SK82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SK85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SL86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SS85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7ST85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SX85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UM85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7UT85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VK87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050) (All versions < V8.83). An improper input validation vulnerability in the web server could allow an unauthenticated user to access device information.

Weakness: CWE-20 (Improper Input Validation)

## Which versions are affected by CVE-2021-41769?

It affects 31 products.


Products: Siemens 6md85 Firmware, Siemens 6md86 Firmware, Siemens 6md89 Firmware, Siemens 6mu85 Firmware, Siemens 7ke85 Firmware, Siemens 7sa82 Firmware, Siemens 7sa86 Firmware, Siemens 7sa87 Firmware, Siemens 7sd82 Firmware, Siemens 7sd86 Firmware, Siemens 7sd87 Firmware, Siemens 7sj81 Firmware, Siemens 7sj82 Firmware, Siemens 7sj85 Firmware, Siemens 7sj86 Firmware, Siemens 7sk82 Firmware, Siemens 7sk85 Firmware, Siemens 7sl82 Firmware, Siemens 7sl86 Firmware, Siemens 7sl87 Firmware and 11 more.

## How do I fix CVE-2021-41769?

No fix has been published for CVE-2021-41769 yet. Limit exposure of the affected software until one is available.

## Is CVE-2021-41769 being exploited?

There is no known exploitation of CVE-2021-41769 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2021-41769 and fix it if it is affected.

What it is: CVE-2021-41769 is a high-severity vulnerability in Siemens SIPROTEC 5 6MD85 devices (CPU variant CP300), published on 11 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2021-41769 in the wild and no public exploit code.

Affected product: Siemens SIPROTEC 5 6MD85 devices (CPU variant CP300). No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2021-41769/ (Markdown: https://insights.sbomify.com/CVE-2021-41769/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2021-41769
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-41769
- OSV: https://osv.dev/vulnerability/CVE-2021-41769

---
From sbomify Insights: https://insights.sbomify.com/CVE-2021-41769/
Summaries are generated and may contain mistakes; the official description above is the record.