CVE:CVE-2021-31892
CNNVD:CNNVD-202107-936
Siemens SINUMERIK是德国西门子（Siemens）公司的一套控制系统。适用于所有生产领域。
Siemens SINUMERIK存在信任管理问题漏洞，该漏洞源于第三方依赖项中的错误，用于设置与服务器的 TLS 连接的 ssl 标志被错误设置覆盖。以下产品及版本受到影响：SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions)。
solution:Upgrade siemens sinumerik_analyse_mycondition_firmware to a higher version than -; Upgrade siemens sinumerik_analyze_myperformance_firmware to a higher version than -; Upgrade siemens sinumerik_integrate_client_firmware to a higher version than 2.00.18,3.00.18,4.00.18,and avoid the version [2.00.12,2.00.18),[3.00.12,3.00.18),[4.00.15,4.00.18); Upgrade siemens sinumerik_integrate_for_production_firmware to a higher version than 4.1,5.1,and avoid the version (,4.1],5.1; Upgrade siemens sinumerik_manage_mymachines_firmware to a higher version than -; Upgrade siemens sinumerik_manage_myprograms_firmware to a higher version than -; Upgrade siemens sinumerik_manage_myresources_firmware to a higher version than -; Upgrade siemens sinumerik_manage_mytools_firmware to a higher version than -; Upgrade siemens sinumerik_operate_firmware to a higher version than 4.8,4.8,4.8:sp1,4.8:sp2,4.8:sp3,4.8:sp4,4.8:sp5,4.8:sp6,4.8:sp7,4.93,4.93:hotfix_1,4.93:hotfix_2,4.93:hotfix_3,4.93:hotfix_4,4.93:hotfix_5,4.93:hotfix_6,4.94,4.94:hotfix_1,4.94:hotfix_2,4.94:hotfix_3,4.94:hotfix_4,and avoid the version (,4.8),4.8,4.8:sp1,4.8:sp2,4.8:sp3,4.8:sp4,4.8:sp5,4.8:sp6,4.8:sp7,4.93,4.93:hotfix_1,4.93:hotfix_2,4.93:hotfix_3,4.93:hotfix_4,4.93:hotfix_5,4.93:hotfix_6,4.94,4.94:hotfix_1,4.94:hotfix_2,4.94:hotfix_3,4.94:hotfix_4; Upgrade siemens sinumerik_optimize_myprogramming_firmware to a higher version than -