Read the docs
TI-2021-08888 Aliases CVE-2021-27395GHSA-9j28-jmqh-8rph

Missing authentication in Siemens SIMATIC Process Historian 2013 and earlier

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.

Why it matters now

EPSS 0.00801 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC Process Historian 2013 and earlierAll versions—No fix listedCNA
SiemensSIMATIC Process Historian 2014All versions < SP3 Update 6—No fix listedCNA
SiemensSIMATIC Process Historian 2019All versions—No fix listedCNA
SiemensSIMATIC Process Historian 2020All versions—No fix listedCNA
  • SIMATIC Process Historian 2013 and earlier VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC Process Historian 2014 VendorSiemens Affected All versions < SP3 Update 6 Fixed in — No fix listed CNA
  • SIMATIC Process Historian 2019 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC Process Historian 2020 VendorSiemens Affected All versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_process_historian_2013:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp1:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp2:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3_update4:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:a:siemens:simatic_process_historian_2019:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:simatic_process_historian_2020:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
  • cpe:2.3:a:siemens:simatic_process_historian_2013:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp1:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3_update4:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_process_historian_2019:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_process_historian_2020:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27395
  2. 2026-10-03 Alias added: GHSA-9j28-jmqh-8rph

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences