CVE-2022-24287

mediumpriority · track · 18OT risk · elevatedEPSS 0.002 · 15 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (15th) EPSS

CVSS 4.6 · medium

Is it mine?

42 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Upd4), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 21), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 8). A missing printer configuration on the host could allow an authenticated attacker to escape the WinCC Kiosk Mode.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSIMATIC PCS 7 V9.0siemens_psirt
Update SIMATIC WinCC to V7.4 SP 1 Update 21 or later version
FixedSIMATIC PCS 7 V9.1siemens_psirt
Update to V9.1 SP1 UC01 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805072/
FixedSIMATIC WinCC Runtime Professional V17siemens_psirt
Update to V17 Upd4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800913/
FixedSIMATIC WinCC V7.4siemens_psirt
Update to V7.4 SP1 Update 21 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/
FixedSIMATIC WinCC V7.5siemens_psirt
Update to V7.5 SP2 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
FixedSIMATIC PCS 7 V9.0cisa_csaf_ot
Update SIMATIC WinCC to V7.4 SP 1 Update 21 or later version
FixedSIMATIC PCS 7 V9.1cisa_csaf_ot
Update to V9.1 SP1 UC01 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805072/
FixedSIMATIC WinCC Runtime Professional V17cisa_csaf_ot
Update to V17 Upd4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800913/
FixedSIMATIC WinCC V7.4cisa_csaf_ot
Update to V7.4 SP1 Update 21 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/
FixedSIMATIC WinCC V7.5cisa_csaf_ot
Update to V7.5 SP2 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
MitigationSIMATIC PCS 7 V8.2siemens_psirt
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC PCS 7 V9.0siemens_psirt
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC PCS 7 V9.1siemens_psirt
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC Runtime Professional V16 and earliersiemens_psirt
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC Runtime Professional V17siemens_psirt
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC V7.3siemens_psirt
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC V7.4siemens_psirt
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC V7.5siemens_psirt
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC PCS 7 V8.2cisa_csaf_ot
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC PCS 7 V9.0cisa_csaf_ot
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC PCS 7 V9.1cisa_csaf_ot
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC Runtime Professional V16 and earliercisa_csaf_ot
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC Runtime Professional V17cisa_csaf_ot
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC V7.3cisa_csaf_ot
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC V7.4cisa_csaf_ot
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
MitigationSIMATIC WinCC V7.5cisa_csaf_ot
At least one default printer (but not a file based printer, as e.g. PDF/XPS printer) should be installed on the affected system
No fix plannedSIMATIC PCS 7 V8.2siemens_psirt
Currently no fix is planned
No fix plannedSIMATIC WinCC Runtime Professional V16 and earliersiemens_psirt
Currently no fix is planned
No fix plannedSIMATIC WinCC V7.3siemens_psirt
Currently no fix is planned
No fix plannedSIMATIC PCS 7 V8.2cisa_csaf_ot
Currently no fix is planned
No fix plannedSIMATIC WinCC Runtime Professional V16 and earliercisa_csaf_ot
Currently no fix is planned
No fix plannedSIMATIC WinCC V7.3cisa_csaf_ot
Currently no fix is planned

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.9–7.8

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 6.4

v2.03.9lowAV:L/AC:L/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · productcert@siemens.com DEexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 1.8 · impact 5.9

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1188USCWE-1188USCWE-1188USCWE-1188US

affected products (42)

Products and version ranges known to be affected.

SIMATIC PCS 7 V8.2all versionscisa_csaf_otUS
SIMATIC PCS 7 V9.0all versionscisa_csaf_otUS
SIMATIC PCS 7 V9.1all versionscisa_csaf_otUS
SIMATIC WinCC Runtime Professional V16 and earlierall versionscisa_csaf_otUS
SIMATIC WinCC Runtime Professional V17all versionscisa_csaf_otUS
SIMATIC WinCC V7.3all versionscisa_csaf_otUS
SIMATIC WinCC V7.4all versionscisa_csaf_otUS
SIMATIC WinCC V7.5all versionscisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.0< V9.0_SP3_UC06cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.1< V9.1_SP1_UC01cisa_csaf_otUS
Siemens SIMATIC WinCC Runtime Professional V16 and earlier≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC WinCC Runtime Professional V17< V17_Upd4cisa_csaf_otUS
Siemens SIMATIC WinCC V7.3≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC WinCC V7.4< V7.4_SP1_Update_21cisa_csaf_otUS
Siemens SIMATIC WinCC V7.5< V7.5_SP2_Update_8cisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2≤ All versionsenisa_euvdEU
Siemens SIMATIC PCS 7 V9.0All versions → V9.0 SP3 UC06enisa_euvdEU
Siemens SIMATIC PCS 7 V9.1All versions → V9.1 SP1 UC01enisa_euvdEU
Siemens SIMATIC WinCC Runtime Professional V16 and earlier≤ All versionsenisa_euvdEU

showing 20 of 42

advisories (2)

Vendor and ecosystem advisories describing this.

SSA-363107SSA-363107: An Improper Initialization Vulnerability Affects SIMATIC WinCC Kiosk Mode2022-05-10csaf · siemens_psirtDE
A vulnerability was found in SIMATIC WinCC that could allow authenticated attackers to escape the Kiosk Mode. Siemens has released updates for the affected products and recommends to update to the latest versions.
ICSA-22-132-06Siemens SIMATIC WinCC2022-05-10icsa · cisa_csaf_otUS
A vulnerability was found in SIMATIC WinCC that could allow authenticated attackers to escape the Kiosk Mode. Siemens has released updates for the affected products and recommends to update to the latest versions.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

published 2022-05-20modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan