TopVuln

Details

CVSS v3

10.0

CVSS v2

9.3

NVD published

2021-12-10 10:15:09

CISA date

2021-12-10

EPSS

94.4% probability · 100.0th percentile — 2026-03-20

Affected versions

cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:6bk1602-0aa22-0tp0:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:6bk1602-0aa42-0tp0:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:* cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:* cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:* cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:* cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:* cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:* cpe:2.3:a:siemens:capital:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:capital:2019.1:-:*:*:*:*:*:* cpe:2.3:a:siemens:capital:2019.1:sp1912:*:*:*:*:*:* cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:desigo_cc_advanced_reports:3.0:*:*:*:*:*:*:* cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:* cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:* cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:* cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:* cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:* cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:* cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:* cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:* cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:* cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:* cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:* cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:* cpe:2.3:a:siemens:energyip_prepay:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*

Summary

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Remediation

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Exploit info

No exploit-tagged NVD references in our cache; see the CISA KEV link below.