ICSA-22-349-06

icsaUScisa_csaf_ot

Siemens SIMATIC WinCC OA Ultralight Client

view advisory published 2022-12-13

SIMATIC WinCC OA contains an argument injection vulnerability that could allow an authenticated remote attacker to inject arbitrary parameters, when starting the Ultralight Client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2022-44731USmedium5.4—
A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions…
02

references

External citations — patches, advisories, analysis.

03

remediations (8)

  • MitigationSIMATIC WinCC OA V3.15

    Configure user permissions and access management according to the WinCC OA Security Guideline: https://www.winccoa.com/documentation/WinCCOA/3.18/en_US/UserAdmin/security.html

  • MitigationSIMATIC WinCC OA V3.16

    Configure user permissions and access management according to the WinCC OA Security Guideline: https://www.winccoa.com/documentation/WinCCOA/3.18/en_US/UserAdmin/security.html

  • MitigationSIMATIC WinCC OA V3.17

    Configure user permissions and access management according to the WinCC OA Security Guideline: https://www.winccoa.com/documentation/WinCCOA/3.18/en_US/UserAdmin/security.html

  • MitigationSIMATIC WinCC OA V3.18

    Configure user permissions and access management according to the WinCC OA Security Guideline: https://www.winccoa.com/documentation/WinCCOA/3.18/en_US/UserAdmin/security.html

  • FixedSIMATIC WinCC OA V3.15

    Update to V3.15 P038 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • FixedSIMATIC WinCC OA V3.16

    Update to V3.16 P035 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • FixedSIMATIC WinCC OA V3.17

    Update to V3.17 P024 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • FixedSIMATIC WinCC OA V3.18

    Update to V3.18 P014 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan