CVE-2021-41543
08.03.2022, 12:15
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling of log files in the web application of affected devices contains an information disclosure vulnerability which could allow logged in users to access sensitive files.Enginsight
| Vendor | Product | Version |
|---|---|---|
| siemens | climatix_pol909_firmware | 𝑥 < 11.36 |
| siemens | climatix_pol909_firmware | 𝑥 < 11.44 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-532 - Insertion of Sensitive Information into Log FileInformation written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.