CVEvulnerability

CVE-2021-44222

9.1 CRITICAL Published 2022-07-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-306

Description

A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and thereby issue arbitrary requests in the affected system.

Affected configurations

• siemens simatic easie core package (< 22.00)

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References