CVE-2022-46141 - OpenCVE

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware configuration of the affected application.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Siemens	Simatic Step 7

Configuration 1 [-]

cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:*

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-887801.pdf	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: siemens

Published: 2023-12-12T11:25:26.583Z

Updated: 2023-12-12T11:25:26.583Z

Reserved: 2022-11-28T16:50:58.483Z

Link: CVE-2022-46141

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-12-12T12:15:10.003

Modified: 2023-12-15T15:25:08.557

Link: CVE-2022-46141

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:*", "matchCriteriaId": "F77226E4-F3B3-4D3B-B944-17CED48BD73A", "versionEndExcluding": "19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware configuration of the affected application."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC STEP 7 (TIA Portal) (todas las versiones < V19). Una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n podr\u00eda permitir a un atacante local obtener acceso a la contrase\u00f1a de nivel de acceso de las CPU SIMATIC S7-1200 y S7-1500, cuando la ingresa un usuario leg\u00edtimo en la configuraci\u00f3n de hardware de la aplicaci\u00f3n afectada."}], "id": "CVE-2022-46141", "lastModified": "2023-12-15T15:25:08.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 3.6, "source": "productcert@siemens.com", "type": "Secondary"}]}, "published": "2023-12-12T12:15:10.003", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-887801.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-316"}], "source": "productcert@siemens.com", "type": "Secondary"}]}