Main Vulnerability Database SB2022071324

SB2022071324 - Multiple vulnerabilities in Siemens SIMATIC MV500 Devices

Published: July 13, 2022 Updated: July 14, 2022

Security Bulletin ID SB2022071324

Severity

Medium

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Information disclosure

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Insufficient Session Expiration (CVE-ID: CVE-2022-33137)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue. A remote user can hijack other users' sessions.

2) Missing Authentication for Critical Function (CVE-ID: CVE-2022-33138)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to missing authentication for several web API endpoints. A remote attacker can read and download data from the device.

Install update from vendor's website.