CVE-2021-42022

Name of the Vulnerable Software and Affected Versions SIMATIC eaSie PCS 7 Skill Package versions prior to V21.00 SP3

Description A vulnerability has been identified where the affected systems do not properly neutralize special elements within the pathname when downloading files. This could allow an attacker to cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. The affected file download function is disabled by default.

Recommendations For versions prior to V21.00 SP3, update to version V21.00 SP3 or later to resolve the issue. As a temporary workaround, consider keeping the affected file download function disabled until a patch is applied.