Details of VAR-202111-0784

ID

VAR-202111-0784

CVE

CVE-2021-41057

TITLE

CodeMeter Post link vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202111-772

DESCRIPTION

In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions

Trust: 0.99

sources: NVD: CVE-2021-41057 // VULHUB: VHN-402322

AFFECTED PRODUCTS

vendor:	siemens	model:	pss e	scope:	lt	version:	35.3.2	Trust: 1.0
vendor:	siemens	model:	sicam 230	scope:	lt	version:	8.0	Trust: 1.0
vendor:	siemens	model:	simatic pcs neo	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic process historian	scope:	lte	version:	2019	Trust: 1.0
vendor:	siemens	model:	pss e	scope:	gte	version:	34.0.0	Trust: 1.0
vendor:	siemens	model:	pss odms	scope:	lt	version:	12.2.6.1	Trust: 1.0
vendor:	siemens	model:	simit	scope:	lte	version:	10.0	Trust: 1.0
vendor:	siemens	model:	simatic information server	scope:	lt	version:	2019	Trust: 1.0
vendor:	wibu	model:	codemeter runtime	scope:	lt	version:	7.30a	Trust: 1.0
vendor:	siemens	model:	pss e	scope:	lt	version:	34.9.1	Trust: 1.0
vendor:	siemens	model:	simatic information server	scope:	eq	version:	2019	Trust: 1.0
vendor:	siemens	model:	pss cape	scope:	eq	version:	14	Trust: 1.0
vendor:	siemens	model:	pss e	scope:	gte	version:	35.0.0	Trust: 1.0
vendor:	siemens	model:	simatic wincc oa	scope:	lte	version:	3.18	Trust: 1.0

sources: NVD: CVE-2021-41057

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-41057
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202111-772
value:	HIGH
Trust: 0.6
VULHUB:	VHN-402322
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2021-41057
severity:	LOW
baseScore:	3.6
vectorString:	AV:L/AC:L/AU:N/C:N/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-402322
severity:	LOW
baseScore:	3.6
vectorString:	AV:L/AC:L/AU:N/C:N/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-41057
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.2
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-402322 // CNNVD: CNNVD-202111-772 // NVD: CVE-2021-41057

PROBLEMTYPE DATA

problemtype:

CWE-59

Trust: 1.1

sources: VULHUB: VHN-402322 // NVD: CVE-2021-41057

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202111-772

TYPE

post link

Trust: 0.6

sources: CNNVD: CNNVD-202111-772

PATCH

title:

CodeMeter Post-link vulnerability fixes

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=170234

Trust: 0.6

sources: CNNVD: CNNVD-202111-772

EXTERNAL IDS

db:	NVD	id:	CVE-2021-41057	Trust: 1.7
db:	SIEMENS	id:	SSA-580693	Trust: 1.7
db:	AUSCERT	id:	ESB-2021.4286	Trust: 0.6
db:	CS-HELP	id:	SB2022010503	Trust: 0.6
db:	ICS CERT	id:	ICSA-21-350-03	Trust: 0.6
db:	CNNVD	id:	CNNVD-202111-772	Trust: 0.6
db:	VULHUB	id:	VHN-402322	Trust: 0.1

sources: VULHUB: VHN-402322 // CNNVD: CNNVD-202111-772 // NVD: CVE-2021-41057

REFERENCES

url:	https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/advisory_wibu-210910-01.pdf	Trust: 1.7
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-580693.pdf	Trust: 1.7
url:	https://www.wibu.com/us/support/security-advisories.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-41057	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.4286	Trust: 0.6
url:	https://vigilance.fr/vulnerability/simatic-denial-of-service-via-wibu-systems-codemeter-runtime-36834	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-350-03	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2022010503	Trust: 0.6

sources: VULHUB: VHN-402322 // CNNVD: CNNVD-202111-772 // NVD: CVE-2021-41057

CREDITS

Jokūbas Arsoba reported this vulnerability to Wibu-Systems.

Trust: 0.6

sources: CNNVD: CNNVD-202111-772

SOURCES

db:	VULHUB	id:	VHN-402322
db:	CNNVD	id:	CNNVD-202111-772
db:	NVD	id:	CVE-2021-41057

LAST UPDATE DATE

2024-08-14T14:37:49.702000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-402322	date:	2021-11-17T00:00:00
db:	CNNVD	id:	CNNVD-202111-772	date:	2022-01-06T00:00:00
db:	NVD	id:	CVE-2021-41057	date:	2021-11-17T18:49:11.867

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-402322	date:	2021-11-14T00:00:00
db:	CNNVD	id:	CNNVD-202111-772	date:	2021-11-09T00:00:00
db:	NVD	id:	CVE-2021-41057	date:	2021-11-14T21:15:07.797