Read the docs
TI-2021-17433 Aliases CVE-2021-40364GHSA-h2gh-jqx7-wcj7

Sensitive information in log files in Siemens SIMATIC PCS 7 V8.2

Priority LOW 24CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system.

Why it matters now

EPSS 0.0024 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC PCS 7 V8.2All versions—No fix listedCNA
SiemensSIMATIC PCS 7 V9.0All versions < V9.0 SP3 UC04—No fix listedCNA
SiemensSIMATIC PCS 7 V9.1All versions < V9.1 SP1—No fix listedCNA
SiemensSIMATIC WinCC V15 and earlierAll versions < V15 SP1 Update 7—No fix listedCNA
SiemensSIMATIC WinCC V16All versions < V16 Update 5—No fix listedCNA
SiemensSIMATIC WinCC V17All versions < V17 Update 2—No fix listedCNA
SiemensSIMATIC WinCC V7.4All versions < V7.4 SP1 Update 19—No fix listedCNA
SiemensSIMATIC WinCC V7.5All versions < V7.5 SP2 Update 5—No fix listedCNA
  • SIMATIC PCS 7 V8.2 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V9.0 VendorSiemens Affected All versions < V9.0 SP3 UC04 Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V9.1 VendorSiemens Affected All versions < V9.1 SP1 Fixed in — No fix listed CNA
  • SIMATIC WinCC V15 and earlier VendorSiemens Affected All versions < V15 SP1 Update 7 Fixed in — No fix listed CNA
  • SIMATIC WinCC V16 VendorSiemens Affected All versions < V16 Update 5 Fixed in — No fix listed CNA
  • SIMATIC WinCC V17 VendorSiemens Affected All versions < V17 Update 2 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.4 VendorSiemens Affected All versions < V7.4 SP1 Update 19 Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected All versions < V7.5 SP2 Update 5 Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*up to 8.2; 9.0 to before 9.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:9.1:-:*:*:*:*:*:*9.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*up to 7.4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:-:*:*:*:*:*:*7.5VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:sp1:*:*:*:*:*:*7.5 sp1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update1:*:*:*:*:*:*7.5 sp1_update1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update2:*:*:*:*:*:*7.5 sp1_update2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:sp2:*:*:*:*:*:*7.5 sp2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update1:*:*:*:*:*:*7.5 sp2_update1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update2:*:*:*:*:*:*7.5 sp2_update2VulnerableSiemens
  • cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:* Versions up to 8.2; 9.0 to before 9.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:9.1:-:*:*:*:*:*:* Versions 9.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:* Versions up to 7.4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:-:*:*:*:*:*:* Versions 7.5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp1:*:*:*:*:*:* Versions 7.5 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update1:*:*:*:*:*:* Versions 7.5 sp1_update1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update2:*:*:*:*:*:* Versions 7.5 sp1_update2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp2:*:*:*:*:*:* Versions 7.5 sp2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update1:*:*:*:*:*:* Versions 7.5 sp2_update1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update2:*:*:*:*:*:* Versions 7.5 sp2_update2 Vulnerable ·Siemens
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update3:*:*:*:*:*:*7.5 sp2_update3VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update4:*:*:*:*:*:*7.5 sp2_update4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:15:*:*:*:*:*:*:*15VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:16:-:*:*:*:*:*:*16VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:16:update1:*:*:*:*:*:*16 update1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:16:update2:*:*:*:*:*:*16 update2VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:16:update3:*:*:*:*:*:*16 update3VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:16:update4:*:*:*:*:*:*16 update4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:17:-:*:*:*:*:*:*17VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:17:update1:*:*:*:*:*:*17 update1VulnerableSiemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update3:*:*:*:*:*:* Versions 7.5 sp2_update3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update4:*:*:*:*:*:* Versions 7.5 sp2_update4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:15:*:*:*:*:*:*:* Versions 15 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:16:-:*:*:*:*:*:* Versions 16 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:16:update1:*:*:*:*:*:* Versions 16 update1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:16:update2:*:*:*:*:*:* Versions 16 update2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:16:update3:*:*:*:*:*:* Versions 16 update3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:16:update4:*:*:*:*:*:* Versions 16 update4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:17:-:*:*:*:*:*:* Versions 17 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:17:update1:*:*:*:*:*:* Versions 17 update1 Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40364
  2. 2026-10-03 Alias added: GHSA-h2gh-jqx7-wcj7

References

Advisory 1

  • TI-2014-07026 The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3… CVSS 2.0HIGH 10.0
  • TI-2019-08143 Missing authentication in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1CRITICAL 9.8
  • TI-2023-11164 Code injection in Siemens SIMATIC PCS 7 CVSS 3.1CRITICAL 10.0
  • TI-2021-17429 Path traversal in Siemens SIMATIC PCS 7 V8.2 CVSS 3.1CRITICAL 9.9
  • TI-2019-08139 A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions)… CVSS 3.1HIGH 8.8
  • TI-2019-08137 SQL injection in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1HIGH 8.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences