Summary
Due to SmartClient Installation technology (ClickOnce) a customer/integrator needs to create a customer specific Smartclient installer. The mentioned products delivered a trusted but yet expired codesigning certificate.
An attacker could have exploited the vulnerability by spoofing the code-signing certificate and signing a malicious executable resulting in having a trusted digital signature from a trusted provider.
The certificate was revoked immediately.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30).…
Revision history
-
#1
Publication Date
References
-
SSA-788287: Disclosure of Private Data - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-788287.pdf
-
SSA-788287: Disclosure of Private Data - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-788287.txt