User Account Password Hash Exposure in SIMATIC Products from Siemens

CVE-2021-40360

What is CVE-2021-40360?

A security flaw has been detected in various versions of Siemens SIMATIC products, where the password hash of a local user account can be exposed via a public API. An attacker, with authentication privileges, can exploit this vulnerability to perform a brute force attack on the password hash, potentially gaining unauthorized access to the affected systems. This vulnerability could lead to significant risks in environments relying on these industrial control systems.

References