A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7…

published 2021-11-09 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27542

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system.

Patch / fix

fixed in 1

siemens simatic_pcs_7 9.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-315-03 updated 2023-04-11 cvss 5.5

Siemens SIMATIC WinCC (Update E)

Siemens SIMATIC PCS 7 V8.2
affected: fixed in V8.2, mitigation support.industry.siemens.com
Siemens SIMATIC PCS 7 V9.0 <V9.0_SP3_UC04
affected: fixed in V9.0, mitigation support.industry.siemens.com
Siemens SIMATIC PCS 7 V9.1 <V9.1_SP1
affected: fixed in V9.1, mitigation support.industry.siemens.com
Siemens SIMATIC WinCC V7.4 <V7.4_SP1_Update_19
affected: fixed in V7.4, mitigation support.industry.siemens.com
Siemens SIMATIC WinCC V7.5 <V7.5_SP2_Update_5
affected: fixed in V7.5, mitigation support.industry.siemens.com
Siemens SIMATIC WinCC V15 and earlier <V15_SP1_Update_7
affected: fixed in V15, mitigation support.industry.siemens.com
Siemens SIMATIC WinCC V16 <V16_Update_5
affected: fixed in V16, mitigation support.industry.siemens.com
Siemens SIMATIC WinCC V17 <V17_Update_2
affected: fixed in V17, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

Siemens SIMATIC PCS 7 V8.2
Siemens SIMATIC PCS 7 V9.0
Siemens SIMATIC PCS 7 V9.1
Siemens SIMATIC WinCC V15 and earlier
Siemens SIMATIC WinCC V16
Siemens SIMATIC WinCC V17
Siemens SIMATIC WinCC V7.4
Siemens SIMATIC WinCC V7.5

Classification

Weakness

CWE-532 Insertion of Sensitive Information into Log File

References

cert-portal.siemens.com /productcert/pdf/ssa-840188.pdf
vendor-advisory

Sources

CVE List CVE-2021-40364
NVD CVE-2021-40364

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary