SSA-348662 V1.0: Multiple Vulnerabilities in SIMATIC MV500 Devices before V3.3

Risk Summary

<p> SIMATIC MV500 devices before V3.3 are affected by multiple vulnerabilities that could allow attackers to hijack other users’ web based management sessions (CVE-2022-33137) or access data on the device without prior authentication (CVE-2022-33138). </p> <p> Siemens has released an update for the SIMATIC MV500 devices and recommends to update to the latest version. Note that the update also contains additional fixes for vulnerabilities documented in Siemens Security Advisory SSA-712929. </p>

CVEs (2)

Remediations

• Refer to Siemens ProductCERT advisory for patch and remediation guidance.

Affected Vendors

Affected Products (1)