CVE-2021-45033

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-45033
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). An undocumented debug port uses hard-coded default credentials. If this port is enabled by a privileged user, an attacker aware of the credentials could access an administrative debug shell on the affected device.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:siemens:cp-8000_master_module_with_i\/o_-25\/\+70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp-8000_master_module_with_i\/o_-25\/\+70:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:cp-8000_master_module_with_i\/o_-40\/\+70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp-8000_master_module_with_i\/o_-40\/\+70:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:siemens:cp-8021_master_module_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp-8021_master_module:*:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:siemens:cp-8022_master_module_with_gprs_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp-8022_master_module_with_gprs:*:*:*:*:*:*:*:*
History

19 Jan 2022, 13:32

Type Values Removed Values Added
References (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf - (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf - Patch, Vendor Advisory
CPE cpe:2.3:h:siemens:cp-8000_master_module_with_i\/o_-40\/\+70:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:cp-8000_master_module_with_i\/o_-40\/\+70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:cp-8000_master_module_with_i\/o_-25\/\+70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:cp-8022_master_module_with_gprs_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp-8022_master_module_with_gprs:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp-8000_master_module_with_i\/o_-25\/\+70:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:cp-8021_master_module_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:cp-8021_master_module:*:*:*:*:*:*:*:*
CWE CWE-798
CVSS v2 : unknown
v3 : unknown 		v2 : 8.5
v3 : 8.8

11 Jan 2022, 12:45

Type Values Removed Values Added
New CVE
Information

Published : 2022-01-11 12:15

Updated : 2024-02-04 22:08

NVD link : CVE-2021-45033

Mitre link : CVE-2021-45033

CVE.ORG link : CVE-2021-45033

JSON object : View

Products Affected

siemens

  • cp-8000_master_module_with_i\/o_-40\/\+70_firmware
  • cp-8000_master_module_with_i\/o_-25\/\+70
  • cp-8021_master_module
  • cp-8000_master_module_with_i\/o_-40\/\+70
  • cp-8021_master_module_firmware
  • cp-8000_master_module_with_i\/o_-25\/\+70_firmware
  • cp-8022_master_module_with_gprs_firmware
  • cp-8022_master_module_with_gprs
CWE
CWE-798

Use of Hard-coded Credentials