CVE-2021-40366 Details
Description
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf | CVE | Vendor Advisory |
| https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-319 | Cleartext Transmission of Sensitive Information | [email protected] |
| CWE-311 | Missing Encryption of Sensitive Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| siemens climatix pol909 firmware | < 11.34 < 11.42 |
CPE
Remediation
| |
| siemens climatix pol909 | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Aug 9, 2022 | Reanalysis | [email protected] |
| Apr 24, 2022 | Modified Analysis | [email protected] |
| Mar 8, 2022 | CVE Modified | [email protected] |
| Nov 12, 2021 | Initial Analysis | [email protected] |