SSA-547714

csafDEsiemens_psirt

SSA-547714: Argument Injection Vulnerability in SIMATIC WinCC OA Ultralight Client

Advisory ansehen veröffentlicht 2022-12-13

SIMATIC WinCC OA contains an argument injection vulnerability that could allow an authenticated remote attacker to inject arbitrary parameters, when starting the Ultralight Client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2022-44731USmedium5.4—
A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (8)

  • MitigationSIMATIC WinCC OA V3.15

    Configure user permissions and access management according to the WinCC OA Security Guideline: https://www.winccoa.com/documentation/WinCCOA/3.18/en_US/UserAdmin/security.html

  • MitigationSIMATIC WinCC OA V3.16

    Configure user permissions and access management according to the WinCC OA Security Guideline: https://www.winccoa.com/documentation/WinCCOA/3.18/en_US/UserAdmin/security.html

  • MitigationSIMATIC WinCC OA V3.17

    Configure user permissions and access management according to the WinCC OA Security Guideline: https://www.winccoa.com/documentation/WinCCOA/3.18/en_US/UserAdmin/security.html

  • MitigationSIMATIC WinCC OA V3.18

    Configure user permissions and access management according to the WinCC OA Security Guideline: https://www.winccoa.com/documentation/WinCCOA/3.18/en_US/UserAdmin/security.html

  • BehobenSIMATIC WinCC OA V3.15

    Update to V3.15 P038 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • BehobenSIMATIC WinCC OA V3.16

    Update to V3.16 P035 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • BehobenSIMATIC WinCC OA V3.17

    Update to V3.17 P024 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • BehobenSIMATIC WinCC OA V3.18

    Update to V3.18 P014 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan