dbcve.org
Simatic Pcs 7Application · Siemens

CVE-2021-40364

MEDIUM · 5.5 CVSS v3.1 Published 2021-11-09
Fix available
A fix is available. Upgrade to 9.1 or later.
See remediation →
57/100
Remediation priority · Elevated
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

Multiple versions of SIMATIC PCS 7 and SIMATIC WinCC store sensitive information in log files. An attacker who gains access to these log files (through file system access, compromised accounts, or other means) can expose the sensitive data or leverage it to facilitate further attacks against the system.

MitigationApply vendor patches for the affected versions (V9.0 SP3 UC04, V9.1 SP1, V15 SP1 Update 7, V16 Update 5, V17 Update 2, V7.4 SP1 Update 19, V7.5 SP2 Update 5). Additionally, restrict file system access to log directories and implement log file rotation/sanitization to limit exposure of sensitive data.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Simatic Pcs 7Application
Affected:<= 8.2>= 9.0, < 9.1= 9.1
Simatic WinccApplication
Affected:<= 7.4= 7.5= 15= 16= 17

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed SIMATIC product
    Check the system for SIMATIC PCS 7 or SIMATIC WinCC installation. Look in Windows Program Files for Siemens directory or check Windows Services for SIMATIC-related services.
    Affected if Either SIMATIC PCS 7 or SIMATIC WinCC is installed on the system.
  2. Determine installed version
    Check the installed version through Windows Programs and Features, or locate the version information in the Siemens\SIMATIC directory structure. For WinCC, check the WinCC bin folder or the project file properties.
    Affected if The version falls within these ranges: PCS 7 <= 8.2, >= 9.0 to < 9.1, or 9.1; WinCC <= 7.4, 7.5, 15, 16, or 17.
  3. Locate log directories
    Find SIMATIC log directories. Common paths include: C:\Program Files\Siemens\WinCC\Archive, C:\Program Files\Siemens\WinCC\Log, C:\Program Files\Siemens\PCS 7\ES\Log, or within the project-specific log folders.
    Affected if Log directories exist on the system.
  4. Inspect log files for sensitive data
    Open and search log files in the identified directories for patterns indicating sensitive information: keywords like 'password', 'passwd', 'pwd', 'credential', 'secret', 'key', or 'token' appearing in plain text, or look for connection strings with embedded credentials.
    Affected if Log files contain plaintext passwords, credentials, keys, or other sensitive data that should not be exposed.

The system is affected if SIMATIC PCS 7 or WinCC is installed with a version matching the affected ranges AND log files contain plaintext sensitive information such as passwords or credentials.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 9.1 or later
Fixed in 9.1
Interim mitigation

Apply vendor patches for the affected versions (V9.0 SP3 UC04, V9.1 SP1, V15 SP1 Update 7, V16 Update 5, V17 Update 2, V7.4 SP1 Update 19, V7.5 SP2 Update 5). Additionally, restrict file system access to log directories and implement log file rotation/sanitization to limit exposure of sensitive data.

Recommended fix High confidence

SIMATIC PCS 7: V9.0 SP3 UC04 / V9.1 SP1 or later; WinCC: V7.4 SP1 Update 19 / V7.5 SP2 Update 5 / V15 SP1 Update 7 / V16 Update 5 / V17 Update 2 or later

  1. 1. Identify the exact version of SIMATIC PCS 7 or WinCC installed by checking the product's 'About' or 'Information' dialog.
  2. 2. Based on the product and version, determine the minimum required patch level from the fixed versions list.
  3. 3. For SIMATIC PCS 7 V8.2: Upgrade to a supported version (V9.0 SP3 UC04 or later, or V9.1 SP1 or later).
  4. 4. For SIMATIC PCS 7 V9.0: Apply patch V9.0 SP3 UC04 or later.
  5. 5. For SIMATIC PCS 7 V9.1: Apply patch V9.1 SP1 or later.
  6. 6. For WinCC V7.4: Apply patch V7.4 SP1 Update 19 or later.
  7. 7. For WinCC V7.5: Apply patch V7.5 SP2 Update 5 or later.
  8. 8. For WinCC V15: Apply patch V15 SP1 Update 7 or later.
Caveat Patch updates typically have minimal breaking changes but test in a non-production environment first; some legacy configurations may need review after updating

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Simatic Pcs 7 Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA2.0 h
20.0 hours of engineering $3,500
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2021-40364 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2021-40364 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data