CVE-2022-33138

State: Published
Severity: Not scored
Published: Jul 12, 2022
Updated: Aug 3, 2024
Reserved: Jun 13, 2022

Description

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). Affected devices do not perform authentication for several web API endpoints. This could allow an unauthenticated remote attacker to read and download data from the device.

Scores

The record has no CVSS score.

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
SIMATIC MV540 HSiemens	All versions < V3.3Affected
SIMATIC MV540 SSiemens	All versions < V3.3Affected
SIMATIC MV550 HSiemens	All versions < V3.3Affected
SIMATIC MV550 SSiemens	All versions < V3.3Affected
SIMATIC MV560 USiemens	All versions < V3.3Affected
SIMATIC MV560 XSiemens	All versions < V3.3Affected

References

https://cert-portal.siemens.com/productcert/pdf/ssa-348662.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.