CVE-2021-40358

CVE-2021-40358 is a critical-severity vulnerability in Siemens Simatic Pcs 7 with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.

Key facts

• Severity: Critical (CVSS 3.x base score 9.9)
• CVSS v2: 7.5
• EPSS exploit prediction: 1% (67th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-22
• Affected product: Siemens Simatic Pcs 7
• Published: 2021-11-09
• Last modified: 2026-06-17

Description

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). Legitimate file operations on the web server of the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read, write or delete unexpected critical files.

Frequently asked questions

What is CVE-2021-40358?

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). Legitimate file operations on the web server of the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read, write or delete unexpected critical files.

How severe is CVE-2021-40358?

CVE-2021-40358 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-40358 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-40358?

CVE-2021-40358 primarily affects Siemens Simatic Pcs 7. In total, 48 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-40358?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2021-40358 published?

CVE-2021-40358 was published on 2021-11-09 and last updated on 2026-06-17.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf

Affected products (48)

• cpe:2.3:a:siemens:simatic_pcs_7:8.2:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_pcs_7:9.0:-:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_pcs_7:9.1:-:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:-:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update1:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update10:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update11:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update12:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update13:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update14:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update15:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update16:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update17:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update18:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update2:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update3:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update4:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update5:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update6:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update7:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update8:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update9:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.4:update_1:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:-:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:sp1:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update1:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update2:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:sp2:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update1:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update2:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update3:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update4:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:15:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:15.1:-:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:15.1:update_1:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:15.1:update_2:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:15.1:update_3:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc:15.1:update_4:*:*:*:*:*:*

More vulnerabilities in Siemens Simatic Pcs 7

• CVE-2023-25910 — Critical (CVSS 10.0): A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7…
• CVE-2014-8551 — Critical (CVSS 10.0): The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7…
• CVE-2019-10922 — Critical (CVSS 9.8): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All…
• CVE-2021-40360 — High (CVSS 8.8): A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC…
• CVE-2019-10918 — High (CVSS 8.8): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions…
• CVE-2019-10916 — High (CVSS 8.8): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions…

All CVEs affecting Siemens Simatic Pcs 7 →

Other CWE-22 (Path Traversal) vulnerabilities

• CVE-2026-76606 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.3 - ???.
• CVE-2026-18051 — Critical (CVSS 10.0): The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache…
• CVE-2026-74764 — Critical (CVSS 10.0): Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a…
• CVE-2026-16940 — Critical (CVSS 10.0): The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing…
• CVE-2026-67429 — Critical (CVSS 10.0): Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related…
• CVE-2026-59555 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

Browse all CWE-22 (Path Traversal) vulnerabilities →