Read the docs
TI-2022-14579 Aliases CVE-2022-33139GHSA-28c6-247x-r9mw

Improper authentication in Siemens Cerberus DMS

Priority MEDIUM 45CWE-603Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.

Why it matters now

EPSS 0.01265 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensCerberus DMSAll versions—No fix listedCNA
SiemensDesigo CCAll versions—No fix listedCNA
SiemensDesigo CC CompactAll versions—No fix listedCNA
SiemensSIMATIC WinCC OA V3.16All versions in default configuration—No fix listedCNA
SiemensSIMATIC WinCC OA V3.17All versions in non-default configuration—No fix listedCNA
SiemensSIMATIC WinCC OA V3.18All versions in non-default configuration—No fix listedCNA
  • Cerberus DMS VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Desigo CC VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Desigo CC Compact VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC OA V3.16 VendorSiemens Affected All versions in default configuration Fixed in — No fix listed CNA
  • SIMATIC WinCC OA V3.17 VendorSiemens Affected All versions in non-default configuration Fixed in — No fix listed CNA
  • SIMATIC WinCC OA V3.18 VendorSiemens Affected All versions in non-default configuration Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:siemens:cerberus_dms:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_compact:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:wincc_open_architecture:3.16:*:*:*:*:*:*:*3.16VulnerableSiemens
cpe:2.3:a:siemens:wincc_open_architecture:3.17:*:*:*:*:*:*:*3.17VulnerableSiemens
cpe:2.3:a:siemens:wincc_open_architecture:3.18:*:*:*:*:*:*:*3.18VulnerableSiemens
  • cpe:2.3:a:siemens:cerberus_dms:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_compact:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:wincc_open_architecture:3.16:*:*:*:*:*:*:* Versions 3.16 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:wincc_open_architecture:3.17:*:*:*:*:*:*:* Versions 3.17 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:wincc_open_architecture:3.18:*:*:*:*:*:*:* Versions 3.18 Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-33139
  2. 2026-10-03 Alias added: GHSA-28c6-247x-r9mw

References

Advisory 2

  • TI-2021-15243 Deserialization of untrusted data in Siemens Cerberus DMS V4.0 CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences