CVE-2021-40363
CVE-2021-40363 is a high-severity vulnerability in Siemens Simatic Pcs 7 with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-538.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- CVSS v2: 2.1
- EPSS exploit prediction: 0% (6th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-538
- Affected product: Siemens Simatic Pcs 7
- Published:
- Last modified:
Description
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the credentials of a local system account in a potentially publicly accessible project file using an outdated cipher algorithm. An attacker may use this to brute force the credentials and take over the system.
Frequently asked questions
- What is CVE-2021-40363?
- A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the credentials of a local system account in a potentially publicly accessible project file using an outdated cipher algorithm. An attacker may use this to brute force the credentials and take over the system.
- How severe is CVE-2021-40363?
- CVE-2021-40363 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2021-40363 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-40363?
- CVE-2021-40363 primarily affects Siemens Simatic Pcs 7. In total, 54 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2021-40363?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2021-40363 published?
- CVE-2021-40363 was published on 2022-02-09 and last updated on 2026-06-17.
References
Affected products (54)
- cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_pcs_7:9.0:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_pcs_7:9.1:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update10:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update11:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update12:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update13:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update14:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update15:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update16:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update17:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update18:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update2:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update3:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update4:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update5:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update6:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update7:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update8:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update9:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:update_1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update2:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp2:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update2:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update3:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update4:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update5:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:13:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:13:sp1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:13:sp2:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:14.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:15:*:*:*:*:*:*:*
More vulnerabilities in Siemens Simatic Pcs 7
- CVE-2023-25910 — Critical (CVSS 10.0): A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7…
- CVE-2014-8551 — Critical (CVSS 10.0): The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7…
- CVE-2021-40358 — Critical (CVSS 9.9): A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3…
- CVE-2019-10922 — Critical (CVSS 9.8): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All…
- CVE-2021-40360 — High (CVSS 8.8): A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC…
- CVE-2019-10918 — High (CVSS 8.8): A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions…
All CVEs affecting Siemens Simatic Pcs 7 →
Other CWE-538 vulnerabilities
- CVE-2016-20024 — Critical (CVSS 9.8): ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to…
- CVE-2025-12059 — Critical (CVSS 9.8): Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry…
- CVE-2023-46723 — High (CVSS 8.9): lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable…
- CVE-2026-49298 — High (CVSS 8.8): A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the…
- CVE-2026-21672 — High (CVSS 8.8): A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
- CVE-2023-7062 — High (CVSS 8.8): The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to,…