CVE-2021-41769

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-11 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD89 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MU85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7KE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SA86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ81 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SK82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SK85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SL86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SS85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7ST85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SX85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UM85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7UT85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VK87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050) (All versions < V8.83). An improper input validation vulnerability in the web server could allow an unauthenticated user to access device information.

Affected products

Siemens 6Md85 Firmware: before 8.83 — fixed in 8.83
Siemens 6Md86 Firmware: before 8.83 — fixed in 8.83
Siemens 6Md89 Firmware: before 8.83 — fixed in 8.83
Siemens 6Mu85 Firmware: before 8.83 — fixed in 8.83
Siemens 7Ke85 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sa82 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sa86 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sa87 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sd82 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sd86 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sd87 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sj81 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sj82 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sj85 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sj86 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sk82 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sk85 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sl82 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sl86 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sl87 Firmware: before 8.83 — fixed in 8.83
Siemens 7Ss85 Firmware: before 8.83 — fixed in 8.83
Siemens 7St85 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sx800 Firmware: before 8.83 — fixed in 8.83
Siemens 7Sx85 Firmware: before 8.83 — fixed in 8.83
Siemens 7Um85 Firmware: before 8.83 — fixed in 8.83
Siemens 7Ut82 Firmware: before 8.83 — fixed in 8.83
Siemens 7Ut85 Firmware: before 8.83 — fixed in 8.83
Siemens 7Ut86 Firmware: before 8.83 — fixed in 8.83
Siemens 7Ut87 Firmware: before 8.83 — fixed in 8.83
Siemens 7Ve85 Firmware: before 8.83 — fixed in 8.83

How to fix

Upgrade to a fixed version: Siemens 6Md85 Firmware 8.83; Siemens 6Md86 Firmware 8.83; Siemens 6Md89 Firmware 8.83; Siemens 6Mu85 Firmware 8.83; Siemens 7Ke85 Firmware 8.83; Siemens 7Sa82 Firmware 8.83; Siemens 7Sa86 Firmware 8.83; Siemens 7Sa87 Firmware 8.83; Siemens 7Sd82 Firmware 8.83; Siemens 7Sd86 Firmware 8.83; Siemens 7Sd87 Firmware 8.83; Siemens 7Sj81 Firmware 8.83. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-41769 or the next vulnerability affects your stack