CVE-2022-44725

highPriorität · verfolgen · 31EPSS 0.002 · 8. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.18% (8th) EPSS

CVSS 7.8 · high

Is it mine?

53 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS (running as a high-privilege user).

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenTeleControl Server Basic V3siemens_psirt
Update to V3.1.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109955177/
BehobenSIMATIC NET PC Software V16siemens_psirt
Update to V16 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974091/
BehobenSIMATIC NET PC Software V17siemens_psirt
Update to V17 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820674/
BehobenSIMATIC NET PC Software V18siemens_psirt
Update to V18 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826242/
BehobenSIMATIC Process Historian 2022 OPC UA Serversiemens_psirt
In the context of SIMATIC PCS neo, update to SIMATIC PCS neo V4.1 or later version
BehobenSIMATIC WinCCsiemens_psirt
Update to V8.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816599/
BehobenSIMATIC WinCC Runtime Professionalsiemens_psirt
Update to V18 Update 2 or later version
BehobenSIMATIC WinCC Unified PC Runtime V18siemens_psirt
Update to V18.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807123/
BehobenSIMATIC NET PC Software V16cisa_csaf_ot
Update to V16 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974091/
BehobenSIMATIC NET PC Software V17cisa_csaf_ot
Update to V17 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808270/
BehobenSIMATIC NET PC Software V18cisa_csaf_ot
Update to V18 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826242/
BehobenSIMATIC Process Historian 2022 OPC UA Servercisa_csaf_ot
In the context of SIMATIC PCS neo, update to SIMATIC PCS neo V4.1 or later version
BehobenSIMATIC WinCCcisa_csaf_ot
Update to V8.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816599/
BehobenSIMATIC WinCC Runtime Professionalcisa_csaf_ot
Update to V18 Update 2 or later version
BehobenSIMATIC WinCC Unified PC Runtime V18cisa_csaf_ot
Update to V18.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807123/
BehobenTeleControl Server Basic V3cisa_csaf_ot
Update to V3.1.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109955177/
BehobenSIMATIC NET PC Software V17cisa_csaf_ot
Update to V17 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820674/
MitigationOpenPCS 7 V9.1siemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V14siemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V15siemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V16siemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V17siemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V18siemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC Process Historian 2020 OPC UA Serversiemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC Process Historian 2022 OPC UA Serversiemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC WinCCsiemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC WinCC Runtime Professionalsiemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC WinCC Unified PC Runtime V18siemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationTeleControl Server Basic V3siemens_psirt
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationOpenPCS 7 V9.1cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC NET PC Software V14cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC NET PC Software V15cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC NET PC Software V16cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC NET PC Software V17cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC NET PC Software V18cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC Process Historian 2020 OPC UA Servercisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC Process Historian 2022 OPC UA Servercisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC WinCCcisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC WinCC Runtime Professionalcisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationSIMATIC WinCC Unified PC Runtime V18cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationTeleControl Server Basic V3cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible
MitigationOpenPCS 7 V9.1cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V14cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V15cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V16cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V17cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC NET PC Software V18cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC Process Historian 2020 OPC UA Servercisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC Process Historian 2022 OPC UA Servercisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC WinCCcisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC WinCC Runtime Professionalcisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationSIMATIC WinCC Unified PC Runtime V18cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
MitigationTeleControl Server Basic V3cisa_csaf_ot
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
Kein Fix geplantOpenPCS 7 V9.1siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC NET PC Software V14siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC NET PC Software V15siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC Process Historian 2020 OPC UA Serversiemens_psirt
Currently no fix is planned
Kein Fix geplantOpenPCS 7 V9.1cisa_csaf_ot
Currently no fix is planned
Kein Fix geplantSIMATIC NET PC Software V14cisa_csaf_ot
Currently no fix is planned
Kein Fix geplantSIMATIC NET PC Software V15cisa_csaf_ot
Currently no fix is planned
Kein Fix geplantSIMATIC Process Historian 2020 OPC UA Servercisa_csaf_ot
Currently no fix is planned

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-732USprimärCWE-20USCWE-20USCWE-732US

betroffene Produkte (53)

Betroffene Produkte und Versionsbereiche.

OpenPCS 7 V9.1alle Versionencisa_csaf_otUS
SIMATIC NET PC Software V14alle Versionencisa_csaf_otUS
SIMATIC NET PC Software V15alle Versionencisa_csaf_otUS
SIMATIC NET PC Software V16alle Versionencisa_csaf_otUS
SIMATIC NET PC Software V17alle Versionencisa_csaf_otUS
SIMATIC NET PC Software V18alle Versionencisa_csaf_otUS
SIMATIC Process Historian 2020 OPC UA Serveralle Versionencisa_csaf_otUS
SIMATIC Process Historian 2022 OPC UA Serveralle Versionencisa_csaf_otUS
SIMATIC WinCCalle Versionencisa_csaf_otUS
SIMATIC WinCC Runtime Professionalalle Versionencisa_csaf_otUS
SIMATIC WinCC Unified PC Runtime V18alle Versionencisa_csaf_otUS
TeleControl Server Basic V3alle Versionencisa_csaf_otUS
Siemens OpenPCS 7 V9.1≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC NET PC Software V14≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC NET PC Software V15≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC NET PC Software V16< V16_Update_8cisa_csaf_otUS
Siemens SIMATIC NET PC Software V17< V17_SP1cisa_csaf_otUS
Siemens SIMATIC NET PC Software V17< V17_SP1_Update_1cisa_csaf_otUS
Siemens SIMATIC NET PC Software V18< V18_Update_1cisa_csaf_otUS
Siemens SIMATIC Process Historian 2020 OPC UA Server≤ vers:all/*cisa_csaf_otUS

20 von 53 angezeigt

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-556635SSA-556635: Multiple Vulnerabilities in Telecontrol Server Basic before V3.1.2.02024-04-09csaf · siemens_psirtDE
Siemens has released a new version for Telecontrol Server Basic that fixes multiple vulnerabilities.
SSA-691715SSA-691715: Vulnerability in OPC Foundation Local Discovery Server Affecting Siemens Products2023-04-11csaf · siemens_psirtDE
A vulnerability was identified in OPC Foundation Local Discovery Server which also affects Siemens products that could allow an attacker to escalate privileges under certain circumstances. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
ICSA-23-103-03Siemens in OPC Foundation Local Discovery Server2023-04-11icsa · cisa_csaf_otUS
A vulnerability was identified in OPC Foundation Local Discovery Server which also affects Siemens products that could allow an attacker to escalate privileges under certain circumstances. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
ICSA-24-102-08Siemens OPC Foundation Local Discovery Server Affecting Siemens Products2023-04-11icsa · cisa_csaf_otUS
A vulnerability was identified in OPC Foundation Local Discovery Server which also affects Siemens products that could allow an attacker to escalate privileges under certain circumstances. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

veröffentlicht 2022-11-17geändert 2026-06-17

verwandt (1,935)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-22960US	high7.8OT kritisch	35.5% (98th)	KEV	2022-04-13
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor…
CVE-2021-23874US	high7.8OT kritisch	1.03% (63rd)	KEV	2021-02-10
Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP…
CVE-2019-15752US	high7.8OT kritisch	48.6% (99th)	KEV	2019-08-28
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\ve…
CVE-2018-13374US	medium4.3OT kritisch	38.1% (99th)	KEV	2019-01-22
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials co…
CVE-2021-25646US	high8.8	99.1% (100th)	Exploit	2021-01-29
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments,…

+1930 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan