Skip to content
Fencer Intel
high 7.4

CVE-2021-31892 json

A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUME…

published 5y ago modified 4mo ago also EUVD-2021-18767

cvss
7.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.

Patch / fix

  • siemens sinumerik_integrate_client_firmware 2.00.18, 3.00.18, 4.00.18
  • siemens sinumerik_operate_firmware 4.8

Is CVE-2021-31892 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-194-04 updated cvss 7.4

Siemens SINUMERIK Integrate Operate Client

  • Siemens SINUMERIK Analyse MyCondition Siemens SINUMERIK Analyze MyPerformance Siemens SINUMERIK Analyze MyPerformance /OEE-Monitor Siemens SINUMERIK Analyze MyPerformance /OEE-Tuning
    affected: vendor fix
  • Siemens SINUMERIK Integrate Client 02 >=V02.00.12_<02.00.18
    affected: fixed in V02.00.18
  • Siemens SINUMERIK Integrate Client 03 >=V03.00.12_<03.00.18
    affected: fixed in V03.00.18
  • Siemens SINUMERIK Integrate Client 04 >=V04.00.02_and_V04.00.15_<04.00.18
    affected: fixed in V04.00.18
  • Siemens SINUMERIK Integrate for Production 4.1 <V4.1_SP10_HF3 Siemens SINUMERIK Integrate for Production 5.1 V5.1 Siemens SINUMERIK Manage MyMachines Siemens SINUMERIK Manage MyMachines /Remote Siemens SINUMERIK Manage MyMachines /Spindel Monitor Siemens SINUMERIK Manage MyPrograms
    +3 more products
    Siemens SINUMERIK Manage MyResources /Programs Siemens SINUMERIK Manage MyResources /Tools Siemens SINUMERIK Manage MyTools
    affected: vendor fix
  • Siemens SINUMERIK Operate V4.8 <V4.8_SP8
    affected: fixed in V4.8
  • Siemens SINUMERIK Operate V4.93 <V4.93_HF7
    affected: fixed in V4.93
  • Siemens SINUMERIK Operate V4.94 <V4.94_HF5
    affected: fixed in V4.94
show 1 more
  • Siemens SINUMERIK Optimize MyProgramming /NX-Cam Editor
    affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

  • Siemens SINUMERIK Analyse MyCondition
  • Siemens SINUMERIK Analyze MyPerformance
  • Siemens SINUMERIK Analyze MyPerformance /OEE-Monitor
  • Siemens SINUMERIK Analyze MyPerformance /OEE-Tuning
  • Siemens SINUMERIK Integrate Client 02
  • Siemens SINUMERIK Integrate Client 03
  • Siemens SINUMERIK Integrate Client 04
  • Siemens SINUMERIK Integrate for Production 4.1
  • Siemens SINUMERIK Integrate for Production 5.1
  • Siemens SINUMERIK Manage MyMachines
  • Siemens SINUMERIK Manage MyMachines /Remote
  • Siemens SINUMERIK Manage MyMachines /Spindel Monitor
  • Siemens SINUMERIK Manage MyPrograms
  • Siemens SINUMERIK Manage MyResources /Programs
  • Siemens SINUMERIK Manage MyResources /Tools
  • Siemens SINUMERIK Manage MyTools
  • Siemens SINUMERIK Operate V4.8
  • Siemens SINUMERIK Operate V4.93
  • Siemens SINUMERIK Operate V4.94
  • Siemens SINUMERIK Optimize MyProgramming /NX-Cam Editor

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.