ICSA-22-132-16 — Siemens Teamcenter

Summary

Teamcenter is affected by XML External Entity Injection (XXE,
CVE-2022-29801) and a stack based buffer overflow vulnerability
(CVE-2022-24290). XXE impacts only Teamcenter versions before V13.1.
Siemens has released updates for the affected products and recommends
to update to the latest versions.

Vulnerabilities 2

Unscored —

CVE-2022-24290

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V…

Siemens Teamcenter V12.4 Teamcenter V13.0 Teamcenter V13.1 ICS / OT

May 10, 2022
Unscored —

CVE-2022-29801

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V…

Siemens Teamcenter V13.0 Teamcenter V12.4 ICS / OT

May 10, 2022

Revision history

2022-08-09 #3
Added fix for Teamcenter version line V14.0
2022-06-14 #2
Added fix for Teamcenter version line V13.1
2022-05-10 #1
Publication Date

References

SSA-789162: Vulnerabilities in Teamcenter - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-789162.txt
SSA-789162: Vulnerabilities in Teamcenter - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-789162.pdf
ICS Advisory ICSA-22-132-16 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-132-16
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B