Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-33139

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.

Published

2022-06-21T13:15:08.537

Last Modified

2024-11-21T07:07:35.323

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-603
  • Type: Secondary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application siemens cerberus_dms * Yes
Application siemens desigo_cc * Yes
Application siemens desigo_cc_compact * Yes
Application siemens wincc_open_architecture 3.16 Yes
Application siemens wincc_open_architecture 3.17 Yes
Application siemens wincc_open_architecture 3.18 Yes
References