CVE-2021-42029: 
Siemens SIMATIC STEP 7 vulnerability analysis and mitigation

A vulnerability (CVE-2021-42029) was identified in SIMATIC STEP 7 (TIA Portal) affecting versions V15 (All versions), V16 (All versions < V16 Update 5), and V17 (All versions < V17 Update 2). The vulnerability was discovered and disclosed in October 2021, allowing attackers to achieve privilege escalation on the web server of certain devices due to improper access control in the engineering system software (MITRE CVE).

The vulnerability stems from improper access control in the engineering system software of SIMATIC STEP 7 (TIA Portal). To exploit this vulnerability, an attacker needs to have direct access to the impacted web server. The vulnerability has been assigned CWE-284 (Improper Access Control) classification (NVD CNA Status).

If successfully exploited, this vulnerability allows attackers to achieve privilege escalation on the web server of affected devices, potentially gaining unauthorized access to system resources and functionalities (MITRE CVE).

Siemens has released updates to address this vulnerability. Users should upgrade to SIMATIC STEP 7 (TIA Portal) V16 Update 5 or V17 Update 2 or later versions. These updates contain fixes for the improper access control vulnerability (MITRE CVE).