CVE-2021-42029

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-12 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC STEP 7 (TIA Portal) V17 (All versions < V17 Update 2). An attacker could achieve privilege escalation on the web server of certain devices due to improper access control vulnerability in the engineering system software. The attacker needs to have direct access to the impacted web server.

Affected products

Siemens SIMATIC STEP 7 (TIA Portal): from 15 before 16; 16, 16-update1, 16-update2, 16-update3, 16-update4, 17 (+1) — fixed in 16

How to fix

Upgrade to a fixed version: Siemens SIMATIC STEP 7 (TIA Portal) 16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-42029 or the next vulnerability affects your stack