CVE-2021-31894

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

• CWE-732

• https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdfPatch, Vendor Advisory

Published

Jul 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31889A vulnerability has been identified in Capital Embedded AR C…9.1
• CVE-2021-3189The slashify package 1.0.0 for Node.js allows open-redirect …6.1
• CVE-2021-31890A vulnerability has been identified in Capital Embedded AR C…9.1
• CVE-2021-31891A vulnerability has been identified in Desigo CC (All versio…10
• CVE-2021-31892A vulnerability has been identified in SINUMERIK Analyse MyC…7.4
• CVE-2021-31893A vulnerability has been identified in SIMATIC PCS 7 V8.2 an…7.8
• CVE-2021-31895A vulnerability has been identified in RUGGEDCOM i800 (All v…8.1
• CVE-2021-31897In JetBrains WebStorm before 2021.1, code execution without …9.8
• CVE-2021-31898In JetBrains WebStorm before 2021.1, HTTP requests were used…7.5
• CVE-2021-31899In JetBrains Code With Me bundled to the compatible IDEs bef…8.8
• CVE-2021-3190The async-git package before 1.13.2 for Node.js allows OS Co…9.8
• CVE-2021-31900In JetBrains Code With Me bundled to the compatible IDE vers…5.3