Critical severity10.0NVD Advisory· Published Sep 14, 2021· Updated Jun 17, 2026
CVE-2021-31891
CVE-2021-31891
Description
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
Affected products
14cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*
- (no CPE)range: All versions with OIS Extension Module
- (no CPE)range: All versions with OIS Extension Module
cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*
- (no CPE)range: All versions with OIS running on Debian 9 or earlier
- (no CPE)range: All versions with OIS running on Debian 9 or earlier
cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*
- (no CPE)range: All versions with OIS running on Debian 9 or earlier
- (no CPE)range: All versions with OIS running on Debian 9 or earlier
cpe:2.3:a:siemens:siveillance_control:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:siemens:siveillance_control:*:*:*:*:*:*:*:*
- (no CPE)range: All versions with OIS running on Debian 9 or earlier
- (no CPE)range: All versions with OIS running on Debian 9 or earlier
- (no CPE)range: All versions
- cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
1- cert-portal.siemens.com/productcert/pdf/ssa-535380.pdfnvdPatchVendor Advisory
News mentions
0No linked articles in our index yet.