{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "Desigo CC and Cerberus DMS are based on SIMATIC WinCC OA and implement client-side only authentication for specific parts of their client-server communication. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated, as documented for SIMATIC WinCC OA in SSA-111512 [1].\n\nSiemens recommends specific mitigations, documented in [2], for products where fixes are not, or not yet available. Additional details regarding these mitigations can be found in the chapter Additional Information.\n\n[1] \nhttps://cert-portal.siemens.com/productcert/html/ssa-111512.html\n[2] https://support.industry.siemens.com/cs/ww/en/view/109813389/",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-836027: Client-side Authentication in Desigo CC and Cerberus DMS - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-836027.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-836027: Client-side Authentication in Desigo CC and Cerberus DMS - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-836027.txt"
      },
      {
        "category": "self",
        "summary": "SSA-836027: Client-side Authentication in Desigo CC and Cerberus DMS - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-836027.json"
      }
    ],
    "title": "SSA-836027: Client-side Authentication in Desigo CC and Cerberus DMS",
    "tracking": {
      "current_release_date": "2022-10-11T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-836027",
      "initial_release_date": "2022-10-11T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-10-11T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Cerberus DMS",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Cerberus DMS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Desigo CC",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo CC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Desigo CC Compact",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo CC Compact"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-33139",
      "cwe": {
        "id": "CWE-603",
        "name": "Use of Client-Side Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled.\n\nIn this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "See \nhttps://support.industry.siemens.com/cs/ww/en/view/109813389/ for a list of specific mitigations",
          "product_ids": [
            "1",
            "2",
            "3"
          ]
        },
        {
          "category": "none_available",
          "details": "Currently no fix is available",
          "product_ids": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "title": "CVE-2022-33139"
    }
  ]
}