CVE-2021-31891

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-14 · updated 2026-06-17
Weakness: CWE-78

Description

A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.

Affected products

Siemens Desigo CC: all versions
Siemens GMA-Manager: all versions
Siemens Operation Scheduler: all versions
Siemens Siveillance Control: all versions
Siemens Siveillance Control Pro: all versions

References

Get alerted when CVE-2021-31891 or the next vulnerability affects your stack