Summary
QMS Automotive contains a vulnerability that stores user credentials in plantext within the user database. This could allow an attacker to read credentials from memory.
Siemens has released an update for QMS Automotive and recommends to update to the latest version.
Vulnerabilities 1
-
High 7.6
A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). …
Revision history
-
#3
Revision - Fixing typos
-
#2
Added fix for QMS Automotive and updated CWE information of CVE-2022-43958
-
#1
Publication Date
References
-
SSA-587547: Unencrypted Storage of User Credentials in QMS Automotive - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-587547.html
-
SSA-587547: Unencrypted Storage of User Credentials in QMS Automotive - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-587547.pdf
-
SSA-587547: Unencrypted Storage of User Credentials in QMS Automotive - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-587547.txt
-
ICS Advisory ICSA-22-314-06 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-314-06
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B