SSA-111512: Client-side Authentication in SIMATIC WinCC OA
SIMATIC WinCC OA implements client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated. Siemens recommends to enable server-side authentication (SSA) or Kerberos authentication for all WinCC OA projects, as documented in the WinCC OA Security Guideline. In SIMATIC WinCC OA server-side authentication is available since V3.15 (and offered as the default configuration since V3.17). Additional information can be found at: https://cert-portal.siemens.com/productcert/news.html?id=21.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-33139US | critical9.8 | — | ||
A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default conf… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (3)
- BehobenSIMATIC WinCC OA V3.16
Enable server-side authentication (SSA) or Kerberos authentication for your WinCC OA project
https://www.winccoa.com/downloads/detail/security-guideline-wincc-oa-v316-1.html - BehobenSIMATIC WinCC OA V3.17
Ensure that server-side authentication (SSA) is enabled for your WinCC OA project (which is the default configuration); alternatively enable Kerberos authentication
https://www.winccoa.com/downloads/detail/security-guideline-wincc-oa-v317.html - BehobenSIMATIC WinCC OA V3.18
Ensure that server-side authentication (SSA) is enabled for your WinCC OA project (which is the default configuration); alternatively enable Kerberos authentication
https://www.winccoa.com/downloads/detail/security-guideline-wincc-oa-v318.html
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan