CVE-2022-33139 — CRITICAL (9.8)

Vulnerability Description

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Siemens	Cerberus Dms	All versions
Siemens	Desigo Cc	All versions
Siemens	Desigo Cc Compact	All versions
Siemens	Wincc Open Architecture	3.16

Related Weaknesses (CWE)

CWE-287 CWE-603

References

https://cert-portal.siemens.com/productcert/pdf/ssa-111512.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-836027.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-111512.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-836027.pdfVendor Advisory

FAQ

What is CVE-2022-33139?

CVE-2022-33139 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC ...

How severe is CVE-2022-33139?

CVE-2022-33139 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-33139?

Check the references section above for vendor advisories and patch information. Affected products include: Siemens Cerberus Dms, Siemens Desigo Cc, Siemens Desigo Cc Compact, Siemens Wincc Open Architecture.