Siemens in OPC Foundation Local Discovery Server
A vulnerability was identified in OPC Foundation Local Discovery Server which also affects Siemens products that could allow an attacker to escalate privileges under certain circumstances. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-44725US | high7.8 | — | ||
OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is l… | ||||
references
External citations — patches, advisories, analysis.
- SSA-691715: Vulnerability in OPC Foundation Local Discovery Server Affecting Siemens Products - CSAF Versionself
- SSA-691715: Vulnerability in OPC Foundation Local Discovery Server Affecting Siemens Products - HTML Versionself
- ICS Advisory ICSA-23-103-03 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-103-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (24)
- MitigationOpenPCS 7 V9.1
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC NET PC Software V14
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC NET PC Software V15
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC NET PC Software V16
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC NET PC Software V17
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC NET PC Software V18
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC Process Historian 2020 OPC UA Server
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC Process Historian 2022 OPC UA Server
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC WinCC
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC WinCC Runtime Professional
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationSIMATIC WinCC Unified PC Runtime V18
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- MitigationTeleControl Server Basic V3
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
- No fix plannedOpenPCS 7 V9.1
Currently no fix is planned
- No fix plannedSIMATIC NET PC Software V14
Currently no fix is planned
- No fix plannedSIMATIC NET PC Software V15
Currently no fix is planned
- No fix plannedSIMATIC Process Historian 2020 OPC UA Server
Currently no fix is planned
- FixedSIMATIC NET PC Software V16
Update to V16 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974091/ - FixedSIMATIC NET PC Software V17
Update to V17 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808270/ - FixedSIMATIC NET PC Software V18
Update to V18 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826242/ - FixedSIMATIC Process Historian 2022 OPC UA Server
In the context of SIMATIC PCS neo, update to SIMATIC PCS neo V4.1 or later version
- FixedSIMATIC WinCC
Update to V8.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816599/ - FixedSIMATIC WinCC Runtime Professional
Update to V18 Update 2 or later version
- FixedSIMATIC WinCC Unified PC Runtime V18
Update to V18.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807123/ - FixedTeleControl Server Basic V3
Update to V3.1.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109955177/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan