Command Injection Vulnerability in Siemens SIMATIC Products
CVE-2022-34820

8.4HIGH

Key Information:

Vendor
Siemens
Status
Simatic Cp 1242-7 V2
Simatic Cp 1243-1
Simatic Cp 1243-7 Lte Eu
Simatic Cp 1243-7 Lte Us
Vendor
CVE Published:
12 July 2022

Summary

A vulnerability exists in various Siemens SIMATIC CP products where user-provided fields during authentication are not properly escaped. This oversight could enable an attacker to inject malicious commands, potentially leading to arbitrary code execution with elevated privileges. Ensuring your systems are updated to the latest versions is crucial to mitigate this risk.

Affected Version(s)

SIMATIC CP 1242-7 V2 All versions < V3.3.46

SIMATIC CP 1243-1 All versions < V3.3.46

SIMATIC CP 1243-7 LTE EU All versions < V3.3.46

References

https://cert-portal.siemens.com/productcert/pdf/ssa-51737...

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.