What is the CVSS score of CVE-2021-41057?

CVE-2021-41057 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Codemeter Runtime CVE-2021-41057

HIGH

Improper Link Resolution Before File Access (CWE-59)

2021-11-14 cve@mitre.org

Information Disclosure Codemeter Runtime Pss Cape Pss E Pss Odms Sicam 230 Simatic Information Server Simatic Pcs Neo Simatic Process Historian Simatic Wincc Oa Simit

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 14, 2021 - 21:15 nvd

HIGH 7.1

DescriptionNVD

In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.

AnalysisAI

In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-59. In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. Affected products include: Wibu Codemeter Runtime, Siemens Pss Cape, Siemens Pss E, Siemens Pss Odms, Siemens Sicam 230. Version information: before 7.30.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.