High ICSA-22-286-06 7 CVEs

Siemens Desigo PXM Devices

Published Oct 11, 2022 · Updated Oct 11, 2022

Vendor: Siemens Product: Desigo PXM30-1 Product: Desigo PXM30.E Product: Desigo PXM40-1 Product: Desigo PXM40.E Product: Desigo PXM50-1 Product: Desigo PXM50.E Product: PXG3.W100-1 Product: PXG3.W100-2 Product: PXG3.W200-1 Product: PXG3.W200-2

Summary

Desigo PXM devices contain multiple vulnerabilities in the webserver application that could allow an attacker to potentially access sensitive information, execute arbitrary commands, cause a denial of service condition, or perform remote code execution.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 7

Unscored —

CVE-2022-40176

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions <…

Siemens Desigo PXM50.E PXG3.W100-2 Desigo PXM30-1 ICS / OT

Oct 11, 2022
Unscored —

CVE-2022-40177

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions <…

Siemens PXG3.W200-1 Desigo PXM30.E Desigo PXM40.E ICS / OT

Oct 11, 2022
Unscored —

CVE-2022-40178

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions <…

Siemens Desigo PXM50-1 PXG3.W100-1 PXG3.W200-1 ICS / OT

Oct 11, 2022
Unscored —

CVE-2022-40179

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions <…

Siemens Desigo PXM30-1 PXG3.W200-2 Desigo PXM40-1 ICS / OT

Oct 11, 2022
Unscored —

CVE-2022-40180

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions <…

Siemens Desigo PXM50.E PXG3.W100-2 Desigo PXM30-1 ICS / OT

Oct 11, 2022
Unscored —

CVE-2022-40181

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions <…

Siemens Desigo PXM50-1 PXG3.W100-1 PXG3.W200-1 ICS / OT

Oct 11, 2022
Unscored —

CVE-2022-40182

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions <…

Siemens Desigo PXM30-1 PXG3.W200-2 Desigo PXM40-1 ICS / OT

Oct 11, 2022

Revision history

2022-10-11 #1
Publication Date

References

SSA-360783: Multiple Webserver Vulnerabilities in Desigo PXM Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-360783.txt
SSA-360783: Multiple Webserver Vulnerabilities in Desigo PXM Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf
ICS Advisory ICSA-22-286-06 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-286-06
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B