Summary
Siemens OPC UA Modeling Editor (SiOME) is affected by an XML external entity (XXE) injection vulnerability that could allow an attacker to interfere with an application's processing of XML data and read arbitrary files in the system.
Siemens has released a new version for Siemens OPC UA Modelling Editor (SiOME) and recommends to update to the latest version.
Vulnerabilities 1
-
High 7.5
A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products…
Revision history
-
#1
Publication Date
References
-
SSA-197270: Information Disclosure Vulnerability in Siemens OPC UA Modeling Editor (SiOME) - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-197270.html
-
SSA-197270: Information Disclosure Vulnerability in Siemens OPC UA Modeling Editor (SiOME) - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf
-
SSA-197270: Information Disclosure Vulnerability in Siemens OPC UA Modeling Editor (SiOME) - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-197270.txt
-
ICS Advisory ICSA-23-320-07 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-07
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B