CVE-2022-33139
First published: Tue Jun 21 2022(Updated: )
A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.
Credit: productcert@siemens.com productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Wincc Open Architecture | =3.16 | |
| Siemens Wincc Open Architecture | =3.17 | |
| Siemens Wincc Open Architecture | =3.18 | |
| Siemens Cerberus Dms | ||
| Siemens Desigo Cc | ||
| Siemens Desigo Cc Compact |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-33139?
The severity of CVE-2022-33139 is critical with a severity score of 9.8.
What software is affected by CVE-2022-33139?
Cerberus DMS, Desigo CC, Desigo CC Compact, SIMATIC WinCC OA V3.16, SIMATIC WinCC OA V3.17, and SIMATIC WinCC OA V3.18 are affected by CVE-2022-33139.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-33139?
The Common Weakness Enumeration (CWE) ID for CVE-2022-33139 is CWE-603 and CWE-287.
Is there a fix available for CVE-2022-33139?
Yes, Siemens has released security advisories with patches to address CVE-2022-33139. Please refer to the provided references for more information.
Where can I find more information about CVE-2022-33139?
You can find more information about CVE-2022-33139 in the provided references: [link1], [link2].
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/siemens
- canonical/siemens wincc open architecture
- version/siemens wincc open architecture/3.16
- version/siemens wincc open architecture/3.17
- version/siemens wincc open architecture/3.18
- canonical/siemens cerberus dms
- canonical/siemens desigo cc
- canonical/siemens desigo cc compact