CVE-2021-31891

A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:siveillance_control:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*

Information

Published : 2021-09-14 04:15

Updated : 2021-09-28 09:48


NVD link : CVE-2021-31891

Mitre link : CVE-2021-31891


JSON object : View

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Products Affected

siemens

  • siveillance_control
  • desigo_cc
  • gma-manager
  • operation_scheduler
  • siveillance_control_pro

debian

  • debian_linux