PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-45031 Mepsan CVE debrief

A high-severity authentication weakness in MEPSAN Stawiz USC++ before version 3.0 allows remote attackers to generate passwords for high-privileged accounts. The vulnerability, rated CVSS 7.7, stems from a flaw in the login function that enables unauthorized credential generation. The issue was publicly disclosed on March 30, 2022, with the NVD record last modified on May 18, 2026. Turkish cybersecurity authorities (USOM) issued advisory TR-22-0269 documenting this vulnerability. Affected organizations should upgrade to USC++ version 3.0 or later to remediate this authentication bypass risk.

Vendor
Mepsan
Product
USC+
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2022-03-30
Original CVE updated
2026-05-18
Advisory published
2022-03-30
Advisory updated
2026-05-18

Who should care

Organizations operating MEPSAN Stawiz USC++ fuel station management or industrial control systems, particularly those in regions covered by USOM advisories. System administrators responsible for USC++ deployments and security teams monitoring OT/ICS environments should prioritize this patch.

Technical summary

The vulnerability exists in the login function of MEPSAN Stawiz USC++ versions prior to 3.0. The weakness allows attackers to generate passwords for accounts with elevated privileges, effectively bypassing intended access controls. The CVSS 3.1 score of 7.7 reflects high confidentiality and availability impact with low integrity impact, accessible via network with high attack complexity. The CPE configuration indicates all versions before 3.0 are vulnerable with no lower bound specified. CWE-305 (Authentication Bypass by Primary Weakness) and NVD-CWE-noinfo are associated weakness classifications.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade MEPSAN Stawiz USC++ to version 3.0 or later to eliminate the authentication weakness
  • Review administrative account access logs for unauthorized password generation or account creation activity prior to patching
  • Implement network segmentation to limit exposure of USC++ management interfaces to trusted administrative hosts only
  • Monitor for anomalous authentication patterns or privilege escalation attempts on affected systems
  • Contact MEPSAN support for detailed remediation guidance if upgrade cannot be immediately applied

Evidence notes

CVE description confirms login function weakness enabling high-privileged account password generation. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H supports network attack vector with high confidentiality and availability impact. CPE criteria confirms affected versions are all releases prior to 3.0. USOM advisory TR-22-0269 provides third-party confirmation.

Official resources

2022-03-30