High ICSA-22-013-05 5 CVEs

Siemens COMOS Web (Update A)

Published Jan 11, 2022 · Updated May 6, 2025 · Revision 4

Vendor: Siemens Product: COMOS V10.2 Product: COMOS V10.3 Product: COMOS V10.4

Summary

Multiple vulnerabilities were identified in the web components of COMOS that could allow an attacker to conduct code injections, store data in undesired locations, execute arbitrary SQL statements, and run cross-site request forgery attacks.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 5

High 8.8

CVE-2021-37198

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All ver…

Siemens COMOS V10.3 COMOS V10.2 COMOS V10.4 ICS / OT

Jan 11, 2022
Unscored —

CVE-2021-37194

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All ver…

Siemens COMOS V10.3 COMOS V10.2 COMOS V10.4 ICS / OT

Feb 9, 2022
Unscored —

CVE-2021-37195

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All ver…

Siemens COMOS V10.3 COMOS V10.2 COMOS V10.4 ICS / OT

Jan 11, 2022
Unscored —

CVE-2021-37196

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All ver…

Siemens COMOS V10.3 COMOS V10.2 COMOS V10.4 ICS / OT

Jan 11, 2022
Unscored —

CVE-2021-37197

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All ver…

Siemens COMOS V10.3 COMOS V10.2 COMOS V10.4 ICS / OT

Jan 11, 2022

Revision history

2025-05-06 #4
Revision - Fixing typos
2022-04-12 #3
Updated remediation for COMOS V10.3
2022-02-08 #2
Added CVE-2021-37194 and Updated Affected Products
2022-01-11 #1
Publication Date

References

SSA-995338: Multiple Vulnerabilities in COMOS Web - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-995338.txt
SSA-995338: Multiple Vulnerabilities in COMOS Web - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
ICS Advisory ICSA-22-013-05 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-013-05
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B