CVE-2021-44222

CRITICAL

9.1

Description

A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and thereby issue arbitrary requests in the affected system.

CVE Details

CVSS v3.1 Score9.1

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/12/2022

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

siemens:simatic_easie_core_package

Weaknesses (CWE)

CWE-306CWE-306

References

https://cert-portal.siemens.com/productcert/pdf/ssa-580125.pdf(productcert@siemens.com)

https://cert-portal.siemens.com/productcert/pdf/ssa-580125.pdf(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.