CVE-2022-33138 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2022-33138

Analyzed

More Info Official Page

Source-productcert@siemens.com

Published At-12 Jul, 2022 | 10:15

Updated At-15 Jul, 2022 | 17:31

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). Affected devices do not perform authentication for several web API endpoints. This could allow an unauthenticated remote attacker to read and download data from the device.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

>>simatic_mv540_h_firmware>>Versions before 3.3(exclusive)

cpe:2.3:o:siemens:simatic_mv540_h_firmware:*:*:*:*:*:*:*:*

>>simatic_mv540_h>>-

cpe:2.3:h:siemens:simatic_mv540_h:-:*:*:*:*:*:*:*

>>simatic_mv540_s_firmware>>Versions before 3.3(exclusive)

cpe:2.3:o:siemens:simatic_mv540_s_firmware:*:*:*:*:*:*:*:*

>>simatic_mv540_s>>-

cpe:2.3:h:siemens:simatic_mv540_s:-:*:*:*:*:*:*:*

>>simatic_mv550_h_firmware>>Versions before 3.3(exclusive)

cpe:2.3:o:siemens:simatic_mv550_h_firmware:*:*:*:*:*:*:*:*

>>simatic_mv550_h>>-

cpe:2.3:h:siemens:simatic_mv550_h:-:*:*:*:*:*:*:*

>>simatic_mv550_s_firmware>>Versions before 3.3(exclusive)

cpe:2.3:o:siemens:simatic_mv550_s_firmware:*:*:*:*:*:*:*:*

>>simatic_mv550_s>>-

cpe:2.3:h:siemens:simatic_mv550_s:-:*:*:*:*:*:*:*

>>simatic_mv560_u_firmware>>Versions before 3.3(exclusive)

cpe:2.3:o:siemens:simatic_mv560_u_firmware:*:*:*:*:*:*:*:*

>>simatic_mv560_u>>-

cpe:2.3:h:siemens:simatic_mv560_u:-:*:*:*:*:*:*:*

>>simatic_mv560_x_firmware>>Versions before 3.3(exclusive)

cpe:2.3:o:siemens:simatic_mv560_x_firmware:*:*:*:*:*:*:*:*

>>simatic_mv560_x>>-

cpe:2.3:h:siemens:simatic_mv560_x:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-306	Primary	nvd@nist.gov
CWE-306	Secondary	productcert@siemens.com

CWE ID: CWE-306

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-306

Type: Secondary

Source: productcert@siemens.com

References

Hyperlink	Source	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-348662.pdf	productcert@siemens.com	Patch Vendor Advisory

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-348662.pdf

Source: productcert@siemens.com

Resource:

Patch

Vendor Advisory