Riskcovery

CVE-2022-33139

State
Published
Severity
Not scored
Published
Jun 21, 2022
Updated
Aug 3, 2024
Reserved
Jun 13, 2022

Read the record on cve.org

Description

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-603 Use of Client-Side Authentication

Affected Products

ProductVersions
Cerberus DMSSiemens
  • All versionsAffected
Desigo CCSiemens
  • All versionsAffected
Desigo CC CompactSiemens
  • All versionsAffected
SIMATIC WinCC OA V3.16Siemens
  • All versions in default configurationAffected
SIMATIC WinCC OA V3.17Siemens
  • All versions in non-default configurationAffected
SIMATIC WinCC OA V3.18Siemens
  • All versions in non-default configurationAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.