Critical SSA-626968 7 CVEs

SSA-626968: Multiple Webserver Vulnerabilities in Desigo PXC and DXR Devices

Published May 10, 2022 · Updated Jun 14, 2022 · Revision 2

Vendor: Siemens Product: Desigo DXR2 Product: Desigo PXC3 Product: Desigo PXC4 Product: Desigo PXC5

Summary

Desigo PXC3, PXC4, PXC5 and DXR2 devices contain multiple vulnerabilities in the webserver application that could allow an attacker to potentially intercept unencrypted transmission of sensitive information, cause a denial of service condition, or perform remote code execution.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 7

Unscored —

CVE-2022-24039

A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V0…

Siemens Desigo PXC4 Desigo PXC5 ICS / OT

May 10, 2022
Unscored —

CVE-2022-24040

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21…

Siemens Desigo PXC4 Desigo PXC3 Desigo PXC5 ICS / OT

May 10, 2022
Unscored —

CVE-2022-24041

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21…

Siemens Desigo PXC4 Desigo DXR2 Desigo PXC3 ICS / OT

May 10, 2022
Unscored —

CVE-2022-24042

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21…

Siemens Desigo PXC4 Desigo PXC5 Desigo DXR2 ICS / OT

May 10, 2022
Unscored —

CVE-2022-24043

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21…

Siemens Desigo PXC4 Desigo DXR2 Desigo PXC3 ICS / OT

May 10, 2022
Unscored —

CVE-2022-24044

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21…

Siemens Desigo PXC4 Desigo DXR2 Desigo PXC3 ICS / OT

May 10, 2022
Unscored —

CVE-2022-24045

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21…

Siemens Desigo PXC4 Desigo PXC5 Desigo DXR2 ICS / OT

May 10, 2022

Revision history

2022-06-14 #2
Added steps to contact local Siemens office for obtaining update
2022-05-10 #1
Publication Date

References

SSA-626968: Multiple Webserver Vulnerabilities in Desigo PXC and DXR Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
SSA-626968: Multiple Webserver Vulnerabilities in Desigo PXC and DXR Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-626968.txt