CVE-2022-24287 — Initialization of a Resource with an Insecure Default in Siemens Simatic PCS 7

CWE-1188 — Initialization of a Resource with an Insecure Default3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 82.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Siemens Simatic PCS 7Siemens Simatic WinccSiemens Simatic Wincc Runtime Professional+8 more
Timeline
PublishedMay 20
Latest updateMay 21

Description

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Upd4), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 21), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 8). A missing printer configuration on the host c…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages11 packages

▶CVEListV5siemens/simatic_wincc_runtime_professional_v17All versions < V17 Upd4
▶CVEListV5siemens/simatic_wincc_v7.3All versions

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8h6x-wrc8-g9xc: A vulnerability has been identified in SIMATIC PCS 7 V9↗2022-05-21
▶
CVEList
CVE-2022-24287: A vulnerability has been identified in SIMATIC PCS 7 V8↗2022-05-10
▶
CVE-2022-24287 — Siemens Simatic PCS 7 vulnerability | cvebase