High severity7.4NVD Advisory· Published Nov 9, 2021· Updated Jun 17, 2026
CVE-2021-40366
CVE-2021-40366
Description
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.
Affected products
6cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_and_bacnet_module:*:*:*+ 1 more
- cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_and_bacnet_module:*:*:*range: <11.42
- cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_module:*:*:*range: <11.34
< V11.42+ 2 more
- (no CPE)range: < V11.42
- (no CPE)range: All versions < V11.42
- (no CPE)range: All versions < V11.34
- Range: < V11.42, < V11.34
Patches
Vulnerability mechanics
References
1- cert-portal.siemens.com/productcert/pdf/ssa-703715.pdfnvdVendor Advisory
News mentions
0No linked articles in our index yet.