Medium 5.5Published Mar 22, 2021

CVE-2021-20227A flaw was found in SQLite's SELECT query functionality (src/select.c).

Updated under an hour ago (Oct 28, 2026, 9:10 AM ET)

Does this affect you?

It affects Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP and 9 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

Exploited in the last 30 days

A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: redhat
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
sqlite sqlite sqlite:sqlite	from 3.33.0 before 3.34.1	NVD
oracle communications_network_charging_and_control oracle:communications_network_charging_and_control	from 12.0.1.0 through 12.0.4.0.0; 6.0.1	NVD
oracle enterprise_manager_for_oracle_database oracle:enterprise_manager_for_oracle_database	13.4.0.0	NVD
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools	before 9.2.6.0	NVD
oracle mysql_workbench oracle:mysql_workbench	through 8.0.26	NVD
oracle outside_in_technology oracle:outside_in_technology	8.5.5	NVD
oracle zfs_storage_appliance_kit oracle:zfs_storage_appliance_kit	8.8	NVD

References

References

https://bugzilla.redhat.com/show_bug.cgi?id=1924886	issue-tracking, third-party-advisory
https://www.sqlite.org/releaselog/3_34_1.html	release-notes, vendor-advisory
https://security.gentoo.org/glsa/202103-04	vendor-advisory, third-party-advisory
https://www.oracle.com/security-alerts/cpuApr2021.html	patch, third-party-advisory
https://security.netapp.com/advisory/ntap-20210423-0010/	third-party-advisory
https://www.oracle.com//security-alerts/cpujul2021.html	patch, third-party-advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	patch, third-party-advisory
https://security.gentoo.org/glsa/202210-40	vendor-advisory, third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.