CVEvulnerability

CVE-2021-31892

7.4 HIGH Published 2021-07-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-07-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-295

Description

A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.

Affected configurations

• siemens sinumerik analyse mycondition firmware • siemens sinumerik analyze myperformance firmware • siemens sinumerik integrate client firmware (>= 2.00.12 < 2.00.18) • siemens sinumerik integrate client firmware (>= 3.00.12 < 3.00.18) • siemens sinumerik integrate client firmware (>= 4.00.15 < 4.00.18) • siemens sinumerik integrate for production firmware (<= 4.1) • siemens sinumerik integrate for production firmware 5.1 • siemens sinumerik manage mymachines firmware • siemens sinumerik manage myprograms firmware • siemens sinumerik manage myresources firmware • siemens sinumerik manage mytools firmware • siemens sinumerik operate firmware (< 4.8) • siemens sinumerik operate firmware 4.8 • siemens sinumerik operate firmware 4.93 • siemens sinumerik operate firmware 4.94 • siemens sinumerik optimize myprogramming firmware

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References