{"id":"CVE-2021-40366","aliases":["EUVD-2021-27544","GHSA-49hc-75c3-5637"],"status":"published","title":"A vulnerability has been identified in Climatix POL909 (AWM module) (All versions \u003c V11.34). The...","description":"A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.42), Climatix POL909 (AWM module) (All versions \u003c V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00421,"percentile":0.36906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-311","CWE-319"],"published":"2021-11-09T11:32:07Z","modified":"2026-06-17T04:06:48Z","products":[{"vendor":"siemens","product":"climatix pol909 (awb module)"},{"vendor":"siemens","product":"climatix pol909 (awm module)"},{"vendor":"siemens","product":"climatix_pol909_firmware"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40366"},{"url":"https://github.com/advisories/GHSA-49hc-75c3-5637"}],"sources":{"cve":[{"id":"CVE-2021-40366","description":"A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.42), Climatix POL909 (AWM module) (All versions \u003c V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.","status":"published","published":"2021-11-09T11:32:07Z","modified":"2024-08-04T02:44:09.177Z","cwes":["CWE-311"],"updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2021-27544","description":"A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.42), Climatix POL909 (AWM module) (All versions \u003c V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.","status":"published","published":"2021-11-09T11:32:07Z","modified":"2024-08-04T02:44:09Z","updated_at":"2026-11-03T03:24:20.862157Z"}],"ghsa":[{"id":"GHSA-49hc-75c3-5637","title":"A vulnerability has been identified in Climatix POL909 (AWM module) (All versions \u003c V11.34). The...","description":"A vulnerability has been identified in Climatix POL909 (AWM module) (All versions \u003c V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.","status":"published","published":"2022-05-24T19:20:09Z","modified":"2023-01-29T05:00:50Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-311","CWE-319"],"updated_at":"2026-11-02T14:44:40.694561Z"}],"nvd":[{"id":"CVE-2021-40366","description":"A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.42), Climatix POL909 (AWM module) (All versions \u003c V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.","status":"published","published":"2021-11-09T12:15:10.123Z","modified":"2026-06-17T04:06:48.547Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-311","CWE-319"],"updated_at":"2026-11-02T14:07:00.984108Z"}]}}