CVE-2021-31892
Description
A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.
How to fix
- siemens sinumerik_integrate_client_firmware2.00.18, 3.00.18, 4.00.18 or later
- siemens sinumerik_operate_firmware4.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens sinumerik_analyse_mycondition_firmware | No range specified | — |
| siemens sinumerik_analyze_myperformance_firmware | No range specified | — |
| siemens sinumerik_integrate_client_firmware | 2.00.12 ≤ v < 2.00.18, 3.00.12 ≤ v < 3.00.18, 4.00.15 ≤ v < 4.00.18 | 2.00.18, 3.00.18, 4.00.18 |
| siemens sinumerik_integrate_for_production_firmware | v ≤ 4.1, 5.1 | — |
| siemens sinumerik_manage_mymachines_firmware | No range specified | — |
| siemens sinumerik_manage_myprograms_firmware | No range specified | — |
| siemens sinumerik_manage_myresources_firmware | No range specified | — |
| siemens sinumerik_manage_mytools_firmware | No range specified | — |
| siemens sinumerik_operate_firmware | v < 4.8, 4.8, 4.93, 4.94 | 4.8 |
| siemens sinumerik_optimize_myprogramming_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.