CVE-2021-42022: Siemens SIMATIC Easie Pcs 7 Skill

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. The affected file download function is disabled by default.

Affected products

• Siemens SIMATIC Easie Pcs 7 Skill: up to and including 20.07; version 21.00 only

Published 2021-12-14. Last modified 2026-06-17.