CVE-2021-40358

CVE-2021-40358 is a critical path traversal vulnerability affecting multiple versions of Siemens SIMATIC PCS 7 and WinCC. An authenticated attacker can exploit this flaw by manipulating pathnames in legitimate web server operations, allowing them to read, write, or delete critical files outside of intended directories. With a CVSS score of 9.9, this vulnerability has a high impact on confidentiality, integrity, and availability, but requires low privileges and network access for exploitation. Despite its severity, there is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.