ICSA-22-286-16

icsaUScisa_csaf_ot

Siemens Desigo CC and Cerberus DMS

view advisory published 2022-10-11

Desigo CC and Cerberus DMS are based on SIMATIC WinCC OA and implement client-side only authentication for specific parts of their client-server communication. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated, as documented for SIMATIC WinCC OA in SSA-111512 [1]. Siemens recommends specific mitigations, documented in [2], for products where fixes are not, or not yet available. Additional details regarding these mitigations can be found in the chapter Additional Information. [1] https://cert-portal.siemens.com/productcert/html/ssa-111512.html [2] https://support.industry.siemens.com/cs/ww/en/view/109813389/

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2022-33139UScritical9.8—
A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default conf…
02

references

External citations — patches, advisories, analysis.

03

remediations (6)

  • MitigationCerberus DMS

    See https://support.industry.siemens.com/cs/ww/en/view/109813389/ for a list of specific mitigations

  • MitigationDesigo CC

    See https://support.industry.siemens.com/cs/ww/en/view/109813389/ for a list of specific mitigations

  • MitigationDesigo CC Compact

    See https://support.industry.siemens.com/cs/ww/en/view/109813389/ for a list of specific mitigations

  • No fix availableCerberus DMS

    Currently no fix is available

  • No fix availableDesigo CC

    Currently no fix is available

  • No fix availableDesigo CC Compact

    Currently no fix is available

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan