CVE-2021-27383

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" (incl. SIPLUS variants) versions prior to V15.1 Update 6 SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" (incl. SIPLUS variants) versions prior to V16 Update 4 SIMATIC HMI Comfort Panels V15 4" - 22" (incl. SIPLUS variants) versions prior to V15.1 Update 6 SIMATIC HMI Comfort Panels V16 4" - 22" (incl. SIPLUS variants) versions prior to V16 Update 4 SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V15.1 Update 6 SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V16 Update 4 SIMATIC WinCC Runtime Advanced V15 versions prior to V15.1 Update 6 SIMATIC WinCC Runtime Advanced V16 versions prior to V16 Update 4 SINAMICS GH150 versions prior to not specified SINAMICS GL150 (with option X30) versions prior to not specified SINAMICS GM150 (with option X30) versions prior to not specified SINAMICS SH150 versions prior to not specified SINAMICS SL150 versions prior to not specified SINAMICS SM120 versions prior to not specified SINAMICS SM150 versions prior to not specified SINAMICS SM150i versions prior to not specified

Description A heap allocation leak vulnerability has been identified in the server Tight encoder of SmartVNC, which could result in a Denial-of-Service condition. This issue affects various SIMATIC HMI and WinCC products, as well as SINAMICS devices.

Recommendations For SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" (incl. SIPLUS variants), update to version V15.1 Update 6 or later. For SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" (incl. SIPLUS variants), update to version V16 Update 4 or later. For SIMATIC HMI Comfort Panels V15 4" - 22" (incl. SIPLUS variants), update to version V15.1 Update 6 or later. For SIMATIC HMI Comfort Panels V16 4" - 22" (incl. SIPLUS variants), update to version V16 Update 4 or later. For SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F, update to version V15.1 Update 6 or later. For SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F, update to version V16 Update 4 or later. For SIMATIC WinCC Runtime Advanced V15, update to version V15.1 Update 6 or later. For SIMATIC WinCC Runtime Advanced V16, update to version V16 Update 4 or later. For SINAMICS devices, at the moment, there is no information about a newer version that contains a fix for this vulnerability.