CVE-2022-24287

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-20 · updated 2026-06-17
Weakness: CWE-1188

Description

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Upd4), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 21), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 8). A missing printer configuration on the host could allow an authenticated attacker to escape the WinCC Kiosk Mode.

Affected products

Siemens SIMATIC PCS 7: through 9.0; 9.1
Siemens Simatic Wincc: through 7.4; 7.5, 7.5-sp1, 7.5-sp1_update1, 7.5-sp1_update2, 7.5-sp2, 7.5-sp2_update1 (+6)
Siemens AG SIMATIC WinCC Runtime Professional: through 16; 17

References

Get alerted when CVE-2022-24287 or the next vulnerability affects your stack