CVE-2021-44524: siemens sipass_integrated Exposure of Resource to Wrong Sphere
Vulnerability summary
CVE-2021-44524 is a critical (CVSS 9.8) Exposure of Resource to Wrong Sphere vulnerability in siemens sipass_integrated. EPSS estimates a 1.63% chance of exploitation in the next 30 days, higher than 75.8% of scored vulnerabilities.
Timeline
- 14-12-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote attacker to trigger several actions on behalf of valid user accounts.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.63%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
+0.05 pp
From 1.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Siemens7 products
- sipass_integrated2.76 | 2.76:sp1 | 2.80 | 2.85
- sipass integrated v2.76All versions (No fix recorded)
- sipass integrated v2.80All versions (No fix recorded)
- sipass integrated v2.85All versions (No fix recorded)
- siveillance_identity≥ 1.6, ≤ 1.6.284.0 | 1.5
1 vendor · 7 products