dbcve.org
Simatic BatchApplication · Siemens

CVE-2021-40359

HIGH · 7.7 CVSS v3.1 Published 2021-11-09
Fix available
A fix is available. Upgrade to 9.1 or later.
See remediation →
83/100
Remediation priority · High
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V8.2 (All versions), SIMATIC BATCH V9.0 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 6), SIMATIC NET PC Software V17 (All versions < V17 SP1), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is a path traversal (directory traversal) vulnerability in multiple Siemens SIMATIC industrial software products. When downloading files, the affected systems fail to properly sanitize special elements in file paths (e.g., '../' sequences), allowing attackers to escape the intended download directory and read arbitrary files on the server, potentially exposing sensitive system files or configuration data.

MitigationApply vendor-supplied patches/updates from Siemens for the specific affected product versions (V16 Update 6+, V17 SP1+, V9.0 Upd4+, V9.1 SP1+, V15 SP1 Upd7+, V16 Upd5+, V17 Upd2+, V7.4 SP1 Upd19+, V7.5 SP2 Upd5+, V9.0 SP3 UC04+, V9.1 SP1+) to remediate the path traversal vulnerability.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Simatic BatchApplication
Affected:= 8.2= 9.0= 9.1
Simatic Net PcApplication
Affected:= 14= 15= 16= 17
Simatic Route ControlApplication
Affected:= 8.2= 9.0= 9.1
Simatic WinccApplication
Affected:<= 7.4= 7.5= 15= 16= 17
Simaticpcs 7Application
Affected:<= 8.2>= 9.0, < 9.1= 9.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the installed SIMATIC product
    Check the system for installed Siemens SIMATIC software by examining installed programs or checking for product-specific directories and services. Common installation paths include C:\Program Files\Siemens\ or C:\Program Files (x86)\Siemens\. Look for Simatic Batch, Simatic Net Pc, Simatic Route Control, Simatic Wincc, or Simatic PCS 7 directories.
    Affected if Any of the affected products (Simatic Batch, Simatic Net Pc, Simatic Route Control, Simatic Wincc, or Simatic PCS 7) are installed
  2. Determine the installed product version
    Locate the version information in the product's About dialog, in registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\ or within the installation directory's version info files. Check the specific version number against the affected versions list.
    Affected if The installed version matches: Simatic Batch 8.2, 9.0, or 9.1; Simatic Net Pc 14, 15, 16, or 17; Simatic Route Control 8.2, 9.0, or 9.1; Simatic Wincc versions <=7.4, 7.5, 15, 16, or 17; Simatic PCS 7 versions <=8.2, >=9.0 and <9.1, or 9.1
  3. Verify if web-based file download functionality is enabled
    Check if the SIMATIC web server or HTTP service is running and if file download features are exposed. This typically involves checking IIS or the SIMATIC-specific web service configuration. Look for web portals or download interfaces associated with the installed SIMATIC product.
    Affected if The web server or HTTP-based download service is active and accessible
  4. Inspect access controls on download directories
    Review the configuration of the download functionality, specifically the allowed directories and any path validation settings. Check if the web application's configuration allows path traversal in download parameters.
    Affected if The download feature permits directory traversal sequences (../) or lacks proper path sanitization

A system is affected if it runs any of the listed SIMATIC products (Batch, Net Pc, Route Control, Wincc, or PCS 7) with version numbers matching the affected ranges AND has the web-based file download functionality enabled.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 9.1 or later
Fixed in 9.1
Interim mitigation

Apply vendor-supplied patches/updates from Siemens for the specific affected product versions (V16 Update 6+, V17 SP1+, V9.0 Upd4+, V9.1 SP1+, V15 SP1 Upd7+, V16 Upd5+, V17 Upd2+, V7.4 SP1 Upd19+, V7.5 SP2 Upd5+, V9.0 SP3 UC04+, V9.1 SP1+) to remediate the path traversal vulnerability.

Recommended fix High confidence

Product-specific: WinCC V7.4->V7.4 SP1 U19; WinCC V7.5->V7.5 SP2 U5; WinCC V15->V15 SP1 U7; WinCC V16->V16 U5; WinCC V17->V17 U2; NET PC V16->V16 U6; NET PC V17->V17 SP1; PCS 7 V9.0->V9.0 SP3 UC04; PCS 7 V9.1->V9.1 SP1

  1. 1. Identify the exact installed version of the affected Siemens SIMATIC product using the system's version information panel or Siemens AppLauncher.
  2. 2. For SIMATIC WinCC V7.4: Upgrade to V7.4 SP1 Update 19 or later.
  3. 3. For SIMATIC WinCC V7.5: Upgrade to V7.5 SP2 Update 5 or later.
  4. 4. For SIMATIC WinCC V15 and earlier: Upgrade to V15 SP1 Update 7 or later.
  5. 5. For SIMATIC WinCC V16: Upgrade to V16 Update 5 or later.
  6. 6. For SIMATIC WinCC V17: Upgrade to V17 Update 2 or later.
  7. 7. For SIMATIC NET PC Software V14: Contact Siemens for patch availability or consider upgrading to a supported version (V15+).
  8. 8. For SIMATIC NET PC Software V15: Contact Siemens for patch availability or upgrade to V16 Update 6+ / V17 SP1+.
Caveat Upgrades within same major version typically maintain compatibility; major version jumps (e.g., V8.2 to V9.x) may require testing and possible configuration adjustments - review Siemens release notes

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Simatic Batch Scoped from the published advisory
  • Consultation8.0 h
  • Implementation16.0 h
  • Testing12.0 h
  • Review / QA6.0 h
42.0 hours of engineering $7,360
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $11,776.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2021-40359 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2021-40359 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data