PT-2022-12022 · Siemens · Simatic Easie Core Package

Published 2022-07-12 · Updated 2022-07-15 · CVE-2021-44222

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC eaSie Core Package versions prior to V22.00

Description A vulnerability has been identified where the underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and issue arbitrary requests in the affected system.

Recommendations For versions prior to V22.00, update to version V22.00 or later to resolve the issue. As a temporary workaround, consider configuring the MQTT service to perform authentication to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-44222

Affected Products

Simatic Easie Core Package

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-44222 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44222 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-580125.pdf · Vendor Advisory