CVE-2021-31894

Name: CVE-2021-31894
Creator: NVD / NIST
Published: 2021-07-13T11:15:09.603+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.23%

Last modified Jun 17, 2026

CVE-2021-31894 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. EPSS estimates a 0.23% chance of exploitation in the next 30 days.

Description

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Probability

0.23%

13.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-732

Affected Software

Vendor	Product	Versions
Siemens	Simatic Pcs 7 Firmware	<= 8.2
Siemens	Simatic Pcs 7 Firmware	9.0
Siemens	Simatic Pdm Firmware	All versions
Siemens	Simatic Step 7 Firmware	>= 5.0, < 5.7
Siemens	Sinamics Starter Firmware	< 5.4
Siemens	Sinamics Starter Firmware	5.4

References

https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdfPatch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdfPatch, Vendor Advisory

Timeline

Published: Jul 13, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-31894?

How severe is CVE-2021-31894?

CVE-2021-31894 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.23% probability of exploitation in the next 30 days.

How do I fix CVE-2021-31894?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-31894?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST