Skip to content
Fencer Vulns
high 7.7

CVE-2021-40359 json

A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versio…

published 2021-11-09 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27537

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V8.2 (All versions), SIMATIC BATCH V9.0 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 6), SIMATIC NET PC Software V17 (All versions < V17 SP1), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files.

Patch / fix

  • siemens simaticpcs_7 9.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-315-03 updated cvss 7.7

Siemens SIMATIC WinCC (Update E)

  • Siemens OpenPCS 7 V8.2
    affected: mitigation, no fix planned
  • Siemens OpenPCS 7 V9.0 <V9.0_Upd4
    affected: fixed in V9.0 support.industry.siemens.com
  • Siemens OpenPCS 7 V9.1
    affected: vendor fix
  • Siemens SIMATIC BATCH V8.2 Siemens SIMATIC BATCH V9.0
    affected: mitigation, no fix planned
  • Siemens SIMATIC BATCH V9.1
    affected: vendor fix
  • Siemens SIMATIC NET PC Software V14 Siemens SIMATIC NET PC Software V15
    affected: no fix planned
  • Siemens SIMATIC NET PC Software V16 <V16_Update_6
    affected: fixed in V16 support.industry.siemens.com
  • Siemens SIMATIC NET PC Software V17 <V17_SP1
    affected: fixed in V17 support.industry.siemens.com
show 10 more

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Siemens OpenPCS 7 V8.2
  • Siemens OpenPCS 7 V9.0
  • Siemens OpenPCS 7 V9.1
  • Siemens SIMATIC BATCH V8.2
  • Siemens SIMATIC BATCH V9.0
  • Siemens SIMATIC BATCH V9.1
  • Siemens SIMATIC NET PC Software V14
  • Siemens SIMATIC NET PC Software V15
  • Siemens SIMATIC NET PC Software V16
  • Siemens SIMATIC NET PC Software V17
  • Siemens SIMATIC PCS 7 V8.2
  • Siemens SIMATIC PCS 7 V9.0
  • Siemens SIMATIC PCS 7 V9.1
  • Siemens SIMATIC Route Control V8.2
  • Siemens SIMATIC Route Control V9.0
  • Siemens SIMATIC Route Control V9.1
  • Siemens SIMATIC WinCC V15 and earlier
  • Siemens SIMATIC WinCC V16
  • Siemens SIMATIC WinCC V17
  • Siemens SIMATIC WinCC V7.4
  • Siemens SIMATIC WinCC V7.5

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.