CVE-2022-44731mediumCWE-88

CVE-2022-44731: medium-severity vulnerability in Siemens SIMATIC WinCC OA V3.15

Published · Updated

Follow this CVE+ Monitor SIMATIC WinCC OA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.6%
A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances. This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
Affected products
Siemens · SIMATIC WinCC OA V3.15Siemens · SIMATIC WinCC OA V3.16Siemens · SIMATIC WinCC OA V3.17Siemens · SIMATIC WinCC OA V3.18
Related CVEs — Siemens SIMATIC WinCC OA V3.15

In the same product, most dangerous first.

CVE-2022-33139—CVE-2022-33139EPSS 1.3%CVE-2023-28831HIGHCVE-2023-28831EPSS 1.1%CVE-2020-7580—CVE-2020-7580EPSS 0.5%CVE-2023-46280HIGHCVE-2023-46280EPSS 0.3%