Siemens Desigo CC and Cerberus DMS
Desigo CC and Cerberus DMS are based on SIMATIC WinCC OA and implement client-side only authentication for specific parts of their client-server communication. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated, as documented for SIMATIC WinCC OA in SSA-111512 [1]. Siemens recommends specific mitigations, documented in [2], for products where fixes are not, or not yet available. Additional details regarding these mitigations can be found in the chapter Additional Information. [1] https://cert-portal.siemens.com/productcert/html/ssa-111512.html [2] https://support.industry.siemens.com/cs/ww/en/view/109813389/
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-33139US | critical9.8 | — | ||
A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default conf… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-836027: Client-side Authentication in Desigo CC and Cerberus DMS - CSAF Versionself
- SSA-836027: Client-side Authentication in Desigo CC and Cerberus DMS - PDF Versionself
- SSA-836027: Client-side Authentication in Desigo CC and Cerberus DMS - TXT Versionself
- ICS Advisory ICSA-22-286-16 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-286-16 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (6)
- MitigationCerberus DMS
See https://support.industry.siemens.com/cs/ww/en/view/109813389/ for a list of specific mitigations
- MitigationDesigo CC
See https://support.industry.siemens.com/cs/ww/en/view/109813389/ for a list of specific mitigations
- MitigationDesigo CC Compact
See https://support.industry.siemens.com/cs/ww/en/view/109813389/ for a list of specific mitigations
- Kein Fix verfügbarCerberus DMS
Currently no fix is available
- Kein Fix verfügbarDesigo CC
Currently no fix is available
- Kein Fix verfügbarDesigo CC Compact
Currently no fix is available
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan