Details of VAR-202312-0239

ID

VAR-202312-0239

CVE

CVE-2022-46141

TITLE

Siemens' SIMATIC STEP 7 Vulnerability in plaintext storage of important information in

Trust: 0.8

sources: JVNDB: JVNDB-2022-024735

DESCRIPTION

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware configuration of the affected application. Siemens' SIMATIC STEP 7 There is a vulnerability in plaintext storage of important information.Information may be obtained

Trust: 2.16

sources: NVD: CVE-2022-46141 // JVNDB: JVNDB-2022-024735 // CNVD: CNVD-2023-97271

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2023-97271

AFFECTED PRODUCTS

vendor:	siemens	model:	simatic step 7	scope:	lt	version:	19	Trust: 1.0
vendor:	シーメンス	model:	simatic step 7	scope:	eq	version:	19	Trust: 0.8
vendor:	シーメンス	model:	simatic step 7	scope:	eq	version:	-	Trust: 0.8
vendor:	シーメンス	model:	simatic step 7	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic step	scope:	eq	version:	7<v19	Trust: 0.6

sources: CNVD: CNVD-2023-97271 // JVNDB: JVNDB-2022-024735 // NVD: CVE-2022-46141

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-46141
value:	MEDIUM
Trust: 1.0
productcert@siemens.com:	CVE-2022-46141
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2022-46141
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2023-97271
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2023-97271
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:L/AC:L/AU:M/C:C/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2022-46141
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.1
Trust: 1.0
productcert@siemens.com:	CVE-2022-46141
baseSeverity:	MEDIUM
baseScore:	4.2
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	0.6
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2022-46141
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2023-97271 // JVNDB: JVNDB-2022-024735 // NVD: CVE-2022-46141 // NVD: CVE-2022-46141

PROBLEMTYPE DATA

problemtype:	CWE-316	Trust: 1.0
problemtype:	CWE-312	Trust: 1.0
problemtype:	Plaintext storage of important information (CWE-312) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-024735 // NVD: CVE-2022-46141

PATCH

title:

Patch for Siemens SIMATIC STEP 7 (TIA Portal) information leakage vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/500401

Trust: 0.6

sources: CNVD: CNVD-2023-97271

EXTERNAL IDS

db:	NVD	id:	CVE-2022-46141	Trust: 3.2
db:	SIEMENS	id:	SSA-887801	Trust: 2.4
db:	JVN	id:	JVNVU98271228	Trust: 0.8
db:	ICS CERT	id:	ICSA-23-348-07	Trust: 0.8
db:	JVNDB	id:	JVNDB-2022-024735	Trust: 0.8
db:	CNVD	id:	CNVD-2023-97271	Trust: 0.6

sources: CNVD: CNVD-2023-97271 // JVNDB: JVNDB-2022-024735 // NVD: CVE-2022-46141

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-887801.pdf	Trust: 1.8
url:	https://jvn.jp/vu/jvnvu98271228/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-46141	Trust: 0.8
url:	https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-07	Trust: 0.8
url:	https://cert-portal.siemens.com/productcert/html/ssa-887801.html	Trust: 0.6

sources: CNVD: CNVD-2023-97271 // JVNDB: JVNDB-2022-024735 // NVD: CVE-2022-46141

SOURCES

db:	CNVD	id:	CNVD-2023-97271
db:	JVNDB	id:	JVNDB-2022-024735
db:	NVD	id:	CVE-2022-46141

LAST UPDATE DATE

2024-08-14T12:10:26.814000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2023-97271	date:	2023-12-13T00:00:00
db:	JVNDB	id:	JVNDB-2022-024735	date:	2024-01-15T02:22:00
db:	NVD	id:	CVE-2022-46141	date:	2023-12-15T15:25:08.557

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2023-97271	date:	2023-12-14T00:00:00
db:	JVNDB	id:	JVNDB-2022-024735	date:	2024-01-15T00:00:00
db:	NVD	id:	CVE-2022-46141	date:	2023-12-12T12:15:10.003