CVE-2021-45034

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-11 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links.

Affected products

Siemens Cp-8000 Master Module With I/O -25/+70 Firmware: before 16.20 — fixed in 16.20
Siemens Cp-8000 Master Module With I/O -40/+70 Firmware: before 16.20 — fixed in 16.20
Siemens Cp-8021 Master Module Firmware: before 16.20 — fixed in 16.20
Siemens Cp-8022 Master Module With Gprs Firmware: before 16.20 — fixed in 16.20

How to fix

Upgrade to a fixed version: Siemens Cp-8000 Master Module With I/O -25/+70 Firmware 16.20; Siemens Cp-8000 Master Module With I/O -40/+70 Firmware 16.20; Siemens Cp-8021 Master Module Firmware 16.20; Siemens Cp-8022 Master Module With Gprs Firmware 16.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-45034 or the next vulnerability affects your stack