Vulnerability Details : CVE-2021-37181
A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.
Vulnerability category: Execute code
Products affected by CVE-2021-37181
- cpe:2.3:a:siemens:cerberus_dms:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:cerberus_dms:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:cerberus_dms:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:cerberus_dms:5.0:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc:5.0:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_compact:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_compact:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_compact:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:desigo_cc_compact:5.0:-:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-37181
0.44%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 75 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-37181
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
10.0
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
3.9
|
6.0
|
NIST |
CWE ids for CVE-2021-37181
-
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.Assigned by: productcert@siemens.com (Primary)
References for CVE-2021-37181
-
https://cert-portal.siemens.com/productcert/pdf/ssa-453715.pdf
Patch;Vendor Advisory
Jump to