« Volver al listado

CVE-2021-27389

Estado: ModificadaCrítica (9.8)—

A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequate protection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Siemens — Opcenter QualitySiemens — QMS Automotive

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27389",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "Opcenter Quality",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V12.2"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "QMS Automotive",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V12.30"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-22T21:15:10.333",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-788287.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-788287.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequate protection."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Opcenter Quality (Todas las versiones anteriores a V12.2), QMS Automotive (Todas las versiones anteriores a V12.30).&#xa0;Una clave de señal privada es enviada con el producto sin la protección adecuada"
    }
  ],
  "lastModified": "2026-06-17T03:44:46.117",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:opcenter_quality:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8374434A-5309-4C0D-A768-386CFD1E7523",
              "versionEndExcluding": "12.2"
            },
            {
              "criteria": "cpe:2.3:a:siemens:qms_automotive:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1103918-45CF-4B0A-B386-8E0B7D0A273E",
              "versionEndExcluding": "12.30"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}