SSA-836027 V1.0: Client-side Authentication in Desigo CC and Cerberus DMS

Risk Summary

<p>Desigo CC and Cerberus DMS are based on SIMATIC WinCC OA and implement client-side only authentication for specific parts of their client-server communication. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated, as documented for SIMATIC WinCC OA in SSA-111512 [1].</p> <p>Siemens recommends specific mitigations, documented in [2], for products where fixes are not, or not yet available. Additional details regarding these mitigations can be found in the chapter Additional Information.</p> <p>[1] <a href="https://cert-portal.siemens.com/productcert/html/ssa-111512.html" class="uri">https://cert-portal.siemens.com/productcert/html/ssa-111512.html</a><br /> [2] <a href="https://support.industry.siemens.com/cs/ww/en/view/109813389/" class="uri">https://support.industry.siemens.com/cs/ww/en/view/109813389/</a></p>

Remediations

• Refer to Siemens ProductCERT advisory for patch and remediation guidance.

Affected Vendors

Affected Products (1)