Improper access control in Siemens Climatix POL909
Priority LOW 30CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284 and CWE-532.
Summary
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling of log files in the web application of affected devices contains an information disclosure vulnerability which could allow logged in users to access sensitive files.
Why it matters now
EPSS 0.00747 55th percentileScored 2026-11-07
Fix Fixed Climatix POL909 (AWB module) (Siemens): V11.44Climatix POL909 (AWM module) (Siemens): V11.36
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Climatix POL909 (AWB module) | before V11.44 | V11.44 | Patch available | CNA |
| Siemens | Climatix POL909 (AWM module) | before V11.36 | V11.36 | Patch available | CNA |
- Climatix POL909 (AWB module) VendorSiemens Affected before V11.44 Fixed in V11.44 Patch available CNA
- Climatix POL909 (AWM module) VendorSiemens Affected before V11.36 Fixed in V11.36 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_module:*:*:* | before 11.36 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_and_bacnet_module:*:*:* | before 11.44 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:climatix_pol909:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_module:*:*:* Versions before 11.36 Vulnerable ·Siemens
- cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_and_bacnet_module:*:*:* Versions before 11.44 Vulnerable ·Siemens
- cpe:2.3:h:siemens:climatix_pol909:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA Climatix POL909 (AWB module) (Siemens) Fixed in V11.44
- Fix · CNA Climatix POL909 (AWM module) (Siemens) Fixed in V11.36
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41543
- 2026-10-03 Alias added: GHSA-wx2h-56xm-3293
References
More Siemens Climatix Pol909 Firmware vulnerabilities
- TI-2021-17435 Cleartext transmission of sensitive information in Siemens Climatix POL909 CVSS 3.1HIGH 7.4
- TI-2021-18281 Cross-site scripting in Siemens Climatix POL909 CVSS 3.1MEDIUM 6.1
- TI-2021-18280 Cross-site scripting in Siemens Climatix POL909 CVSS 3.1MEDIUM 6.1
- TI-2020-06098 Cross-site scripting in Siemens Climatix POL908 CVSS 3.1MEDIUM 6.1
- TI-2020-06097 Cross-site scripting in Siemens Climatix POL908 CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-41543 · CVE Program
- CVE-2021-41543 · NVD
- FIRST EPSS
- GHSA-wx2h-56xm-3293 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences