CVE-2022-33139

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Use of Client-Side Authentication pada siemens cerberus dms, siemens desigo cc +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.

Rincian

Terbit di NVD

21 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-603: Use of Client-Side Authentication
CWE-287: Improper Authentication

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-111512.pdf advisory vendor
• https://cert-portal.siemens.com/productcert/pdf/ssa-836027.pdf advisory vendor