Improper certificate validation in Siemens SINUMERIK Analyse MyCondition
Priority LOW 33CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.
Why it matters now
EPSS 0.00486 42nd percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SINUMERIK Analyse MyCondition | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Analyze MyPerformance | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Analyze MyPerformance /OEE-Monitor | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Analyze MyPerformance /OEE-Tuning | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Integrate Client 02 | All versions >= V02.00.12 < 02.00.18 | — | No fix listed | CNA |
| Siemens | SINUMERIK Integrate Client 03 | All versions >= V03.00.12 < 03.00.18 | — | No fix listed | CNA |
| Siemens | SINUMERIK Integrate Client 04 | V04.00.02 and all versions >= V04.00.15 < 04.00.18 | — | No fix listed | CNA |
| Siemens | SINUMERIK Integrate for Production 4.1 | All versions < V4.1 SP10 HF3 | — | No fix listed | CNA |
| Siemens | SINUMERIK Integrate for Production 5.1 | V5.1 | — | No fix listed | CNA |
| Siemens | SINUMERIK Manage MyMachines | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Manage MyMachines /Remote | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Manage MyMachines /Spindel Monitor | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Manage MyPrograms | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Manage MyResources /Programs | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Manage MyResources /Tools | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Manage MyTools | All versions | — | No fix listed | CNA |
| Siemens | SINUMERIK Operate V4.8 | All versions < V4.8 SP8 | — | No fix listed | CNA |
| Siemens | SINUMERIK Operate V4.93 | All versions < V4.93 HF7 | — | No fix listed | CNA |
| Siemens | SINUMERIK Operate V4.94 | All versions < V4.94 HF5 | — | No fix listed | CNA |
| Siemens | SINUMERIK Optimize MyProgramming /NX-Cam Editor | All versions | — | No fix listed | CNA |
- SINUMERIK Analyse MyCondition VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Analyze MyPerformance VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Analyze MyPerformance /OEE-Monitor VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Analyze MyPerformance /OEE-Tuning VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Integrate Client 02 VendorSiemens Affected All versions >= V02.00.12 < 02.00.18 Fixed in — No fix listed CNA
- SINUMERIK Integrate Client 03 VendorSiemens Affected All versions >= V03.00.12 < 03.00.18 Fixed in — No fix listed CNA
- SINUMERIK Integrate Client 04 VendorSiemens Affected V04.00.02 and all versions >= V04.00.15 < 04.00.18 Fixed in — No fix listed CNA
- SINUMERIK Integrate for Production 4.1 VendorSiemens Affected All versions < V4.1 SP10 HF3 Fixed in — No fix listed CNA
- SINUMERIK Integrate for Production 5.1 VendorSiemens Affected V5.1 Fixed in — No fix listed CNA
- SINUMERIK Manage MyMachines VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Manage MyMachines /Remote VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Manage MyMachines /Spindel Monitor VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Manage MyPrograms VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Manage MyResources /Programs VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Manage MyResources /Tools VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Manage MyTools VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SINUMERIK Operate V4.8 VendorSiemens Affected All versions < V4.8 SP8 Fixed in — No fix listed CNA
- SINUMERIK Operate V4.93 VendorSiemens Affected All versions < V4.93 HF7 Fixed in — No fix listed CNA
- SINUMERIK Operate V4.94 VendorSiemens Affected All versions < V4.94 HF5 Fixed in — No fix listed CNA
- SINUMERIK Optimize MyProgramming /NX-Cam Editor VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 41
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:sinumerik_analyse_mycondition_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_analyse_mycondition:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_analyze_myperformance_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_analyze_myperformance:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_integrate_client_firmware:*:*:*:*:*:*:*:* | 2.00.12 to before 2.00.18; 3.00.12 to before 3.00.18; 4.00.15 to before 4.00.18 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_integrate_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_integrate_for_production_firmware:*:*:*:*:*:*:*:* | up to 4.1 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_integrate_for_production_firmware:5.1:*:*:*:*:*:*:* | 5.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_integrate_for_production:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_manage_mymachines_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
- cpe:2.3:o:siemens:sinumerik_analyse_mycondition_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_analyse_mycondition:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_analyze_myperformance_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_analyze_myperformance:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_integrate_client_firmware:*:*:*:*:*:*:*:* Versions 2.00.12 to before 2.00.18; 3.00.12 to before 3.00.18; 4.00.15 to before 4.00.18 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_integrate_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_integrate_for_production_firmware:*:*:*:*:*:*:*:* Versions up to 4.1 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_integrate_for_production_firmware:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_integrate_for_production:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_manage_mymachines_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
Show 31 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:siemens:sinumerik_manage_mymachines:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_manage_myprograms_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_manage_myprograms:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_manage_myresources_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_manage_myresources:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_manage_mytools_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_manage_mytools:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:*:*:*:*:*:*:*:* | before 4.8 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:-:*:*:*:*:*:* | 4.8 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp1:*:*:*:*:*:* | 4.8 sp1 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp2:*:*:*:*:*:* | 4.8 sp2 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp3:*:*:*:*:*:* | 4.8 sp3 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp4:*:*:*:*:*:* | 4.8 sp4 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp5:*:*:*:*:*:* | 4.8 sp5 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp6:*:*:*:*:*:* | 4.8 sp6 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp7:*:*:*:*:*:* | 4.8 sp7 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:-:*:*:*:*:*:* | 4.93 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_1:*:*:*:*:*:* | 4.93 hotfix_1 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_2:*:*:*:*:*:* | 4.93 hotfix_2 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_3:*:*:*:*:*:* | 4.93 hotfix_3 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_4:*:*:*:*:*:* | 4.93 hotfix_4 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_5:*:*:*:*:*:* | 4.93 hotfix_5 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_6:*:*:*:*:*:* | 4.93 hotfix_6 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:-:*:*:*:*:*:* | 4.94 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:hotfix_1:*:*:*:*:*:* | 4.94 hotfix_1 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:hotfix_2:*:*:*:*:*:* | 4.94 hotfix_2 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:hotfix_3:*:*:*:*:*:* | 4.94 hotfix_3 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:hotfix_4:*:*:*:*:*:* | 4.94 hotfix_4 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_operate:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:sinumerik_optimize_myprogramming_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:sinumerik_optimize_myprogramming:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:h:siemens:sinumerik_manage_mymachines:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_manage_myprograms_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_manage_myprograms:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_manage_myresources_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_manage_myresources:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_manage_mytools_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_manage_mytools:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:*:*:*:*:*:*:*:* Versions before 4.8 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:-:*:*:*:*:*:* Versions 4.8 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp1:*:*:*:*:*:* Versions 4.8 sp1 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp2:*:*:*:*:*:* Versions 4.8 sp2 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp3:*:*:*:*:*:* Versions 4.8 sp3 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp4:*:*:*:*:*:* Versions 4.8 sp4 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp5:*:*:*:*:*:* Versions 4.8 sp5 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp6:*:*:*:*:*:* Versions 4.8 sp6 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.8:sp7:*:*:*:*:*:* Versions 4.8 sp7 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:-:*:*:*:*:*:* Versions 4.93 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_1:*:*:*:*:*:* Versions 4.93 hotfix_1 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_2:*:*:*:*:*:* Versions 4.93 hotfix_2 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_3:*:*:*:*:*:* Versions 4.93 hotfix_3 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_4:*:*:*:*:*:* Versions 4.93 hotfix_4 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_5:*:*:*:*:*:* Versions 4.93 hotfix_5 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.93:hotfix_6:*:*:*:*:*:* Versions 4.93 hotfix_6 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:-:*:*:*:*:*:* Versions 4.94 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:hotfix_1:*:*:*:*:*:* Versions 4.94 hotfix_1 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:hotfix_2:*:*:*:*:*:* Versions 4.94 hotfix_2 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:hotfix_3:*:*:*:*:*:* Versions 4.94 hotfix_3 Vulnerable ·Siemens
- cpe:2.3:o:siemens:sinumerik_operate_firmware:4.94:hotfix_4:*:*:*:*:*:* Versions 4.94 hotfix_4 Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_operate:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:sinumerik_optimize_myprogramming_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:sinumerik_optimize_myprogramming:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-31892
- 2026-10-03 Alias added: GHSA-wr99-8g6h-68jx
References
Sources
- CVE-2021-31892 · CVE Program
- CVE-2021-31892 · NVD
- FIRST EPSS
- GHSA-wr99-8g6h-68jx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences