Heap Allocation Leak in SIMATIC HMI and SINAMICS Products by Siemens
CVE-2021-27383

7.5HIGH

Key Information:

Vendor: Siemens
Status: Simatic Hmi Comfort Outdoor Panels V15 7\" & 15\" (incl. Siplus Variants); Simatic Hmi Comfort Outdoor Panels V16 7\" & 15\" (incl. Siplus Variants); Simatic Hmi Comfort Panels V15 4\" - 22\" (incl. Siplus Variants); Simatic Hmi Comfort Panels V16 4\" - 22\" (incl. Siplus Variants)
Vendor: CVE Published:; 12 May 2021

Summary

A heap allocation leak vulnerability exists in the SmartVNC server Tight encoder within various SIMATIC HMI and SINAMICS products. This flaw could potentially allow an attacker to exploit the affected devices, leading to a Denial-of-Service condition. Specifically, versions of the SIMATIC HMI Comfort Outdoor Panels, Comfort Panels, KTP Mobile Panels, and WinCC Runtime Advanced, as well as multiple SINAMICS products, are susceptible if they are below the specified version updates. It is crucial for users to apply the necessary updates to mitigate this risk.