VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jun 21, 2022· Updated Jun 17, 2026

CVE-2022-33139

CVE-2022-33139

Description

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.

Affected products

16
  • Siemens Foundation/Cerberus Dms3 versions
    cpe:2.3:a:siemens:cerberus_dms:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:siemens:cerberus_dms:*:*:*:*:*:*:*:*
    • (no CPE)range: All versions
    • (no CPE)range: All versions
  • Siemens Foundation/Desigo Cc4 versions
    cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*
    • (no CPE)range: All versions
    • (no CPE)range: All versions
    • (no CPE)range: All versions
  • Siemens Foundation/Desigo Cc Compact2 versions
    cpe:2.3:a:siemens:desigo_cc_compact:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:siemens:desigo_cc_compact:*:*:*:*:*:*:*:*
    • (no CPE)range: All versions
  • Siemens Foundation/Wincc Open Architecture3 versions
    cpe:2.3:a:siemens:wincc_open_architecture:3.16:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:siemens:wincc_open_architecture:3.16:*:*:*:*:*:*:*
    • cpe:2.3:a:siemens:wincc_open_architecture:3.17:*:*:*:*:*:*:*
    • cpe:2.3:a:siemens:wincc_open_architecture:3.18:*:*:*:*:*:*:*
  • Siemens Foundation/Simatic Wincc Oallm-fuzzy
    Range: V3.16 (default config), V3.17 (non-default config), V3.18 (non-default config)
  • Siemens Foundation/Wincccpe-rescue3 versions
    All versions in default configuration+ 2 more
    • (no CPE)range: All versions in default configuration
    • (no CPE)range: All versions in non-default configuration
    • (no CPE)range: All versions in non-default configuration

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.