Summary
Siemens has released updates for Opcenter Quality to fix an authentication bypass vulnerability. This could allow unauthenticated access to the application or cause denial of service condition for existing users. The issue is based on rich client modules using IbsGailWrapper-interface. After issuing the record the authentication bypass vulnerability could take place on all modules.
Siemens has released updates for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (…
Revision history
-
#1
Publication Date
References
-
SSA-944952: Authentication Bypass Vulnerability in Opcenter Quality - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-944952.txt
-
SSA-944952: Authentication Bypass Vulnerability in Opcenter Quality - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-944952.pdf
-
ICS Advisory ICSA-22-195-17 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-195-17
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B