Security readout for executives and security teams
Plain-English summary
Selected Siemens CP-8000 and CP-802x master modules can expose web pages without authentication when the web server module is enabled. The main business risk is information leakage about industrial network topology and connected systems, which can help an attacker plan later activity.
Executive priority
Treat as a moderate OT exposure issue. Prioritize assets in production control networks or reachable through remote access, because leaked topology and connected-system details can reduce attacker effort in later stages.
Technical view
CVE-2021-46304 is an improper access control issue affecting all listed versions of Siemens CP-8000 and CP-802x master modules. The enabled web server module allows unauthenticated access to pages that may disclose debug-level information, including internal network topology or connected systems. CVSS 3.1 is 5.3, confidentiality-only impact.
Likely exposure
Exposure is most relevant where affected modules have the web server module enabled and are reachable from engineering, corporate, remote-access, or other untrusted networks. The bundle does not state internet exposure prevalence.
Exploitation context
The source bundle does not report active exploitation, and CISA KEV status is false. Exploitation requires network reachability and no credentials, but the documented impact is information disclosure, not direct integrity or availability loss.
Researcher notes
Evidence supports unauthenticated information disclosure only. The bundle names affected products and CVSS but does not include proof of exploit, patch details, or Siemens workaround text. Avoid assuming all deployments are exposed; validate web server enablement and network reachability.
Mitigation direction
- Review Siemens SSA-185638 for supported remediation or compensating controls.
- Inventory CP-8000 and CP-802x modules and record version and web server status.
- Restrict management access to trusted engineering networks only.
- Remove unnecessary exposure from routable, remote-access, or untrusted networks.
- Monitor for unexpected access to device web interfaces.
Validation and detection
- Confirm whether listed Siemens modules exist in the environment.
- Verify whether the web server module is enabled on each asset.
- Confirm reachable paths from corporate, VPN, vendor, and internet-facing networks.
- Review logs or network telemetry for unauthenticated web access attempts.
- Document residual risk where vendor remediation is unavailable or deferred.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-46304 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://cert-portal.siemens.com/productcert/pdf/ssa-185638.pdfCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.