CVE-2021-31891
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with...
Affects 6 products across 2 vendors.
Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability exists in multiple Siemens products, including Desigo CC, GMA-Manager, Operation Scheduler, Siveillance Control, and Siveillance Control Pro, when using the OIS Extension Module on Debian 9 or earlier. This vulnerability allows an unauthenticated remote attacker to execute arbitrary code with root privileges via a specially crafted HTTP GET request, leading to potential full system compromise.
BSID: BS-2021-GLOBAL-074790-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-31891?
What is the CVSS score for CVE-2021-31891?
Is CVE-2021-31891 actively exploited?
How do I remediate CVE-2021-31891?
What systems are affected by CVE-2021-31891?
What NERC-CIP standard applies to CVE-2021-31891?
What IEC 62443 requirement maps to CVE-2021-31891?
| CVE ID | CVE-2021-31891 |
|---|---|
| BSID | BS-2021-GLOBAL-074790-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2021-09-14 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
Source: NIST NVD / MITRE CVE Database
The vulnerability is triggered by an unauthenticated remote attacker sending a specially crafted HTTP GET request to the affected application. The application fails to properly neutralize special elements in the request, leading to command injection. This can result in the execution of arbitrary code with root privileges, allowing the attacker to gain full control over the system.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Siemens | Desigo Cc | All versions |
| Siemens | Siveillance Control Pro | All versions |
| Siemens | Gma-Manager | All versions |
| Siemens | Operation Scheduler | All versions |
| Siemens | Siveillance Control | All versions |
Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Debian Debian Linux
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict input validation and sanitization for all HTTP requests, especially those targeting the OIS Extension Module. Consider deploying a web application firewall (WAF) to filter out malicious requests.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This vulnerability violates CIP-007-R2 as it allows unauthorized access to the system, potentially leading to the compromise of critical control systems.
This vulnerability maps to SR 7.6 because it involves the failure to properly validate and sanitize input, which can lead to command injection and system compromise.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | e32dec49942cd1771eb745b0a8829a14bfb707c0d98634c47782b069afbe6ea3ccb733c0060d77ea88f61651b984c94ec373da6631114bd3f34adba6a69e75d0 |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →