CVE-2021-31892: Siemens Sinumerik Analyse Mycondition Firmware

High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.

Affected products

  • Siemens Sinumerik Analyse Mycondition Firmware: affected versions not specified
  • Siemens Sinumerik Analyze Myperformance Firmware: affected versions not specified
  • Siemens Sinumerik Integrate Client Firmware: from 2.00.12, before 2.00.18 (fixed in 2.00.18); from 3.00.12, before 3.00.18 (fixed in 3.00.18); from 4.00.15, before 4.00.18 (fixed in 4.00.18)
  • Siemens Sinumerik Integrate For Production Firmware: up to and including 4.1; version 5.1 only
  • Siemens Sinumerik Manage Mymachines Firmware: affected versions not specified
  • Siemens Sinumerik Manage Myprograms Firmware: affected versions not specified
  • Siemens Sinumerik Manage Myresources Firmware: affected versions not specified
  • Siemens Sinumerik Manage Mytools Firmware: affected versions not specified
  • Siemens Sinumerik Operate Firmware: before 4.8 (fixed in 4.8); version 4.8 only; version 4.93 only; version 4.94 only
  • Siemens Sinumerik Optimize Myprogramming Firmware: affected versions not specified

Published 2021-07-13. Last modified 2026-06-17.