File Path Traversal Vulnerability in Siemens SIMATIC eaSie PCS 7 Skill Package

CVE-2021-42022

Summary

A file path traversal vulnerability exists in all versions of the SIMATIC eaSie PCS 7 Skill Package prior to V21.00 SP3. This issue arises due to insufficient validation of file path elements during the file download process. An attacker can exploit this vulnerability to manipulate the pathname, potentially allowing access to files located outside a designated directory on the server. Although the affected file download function is disabled by default, the risk remains for systems where this function is enabled.

References