CVE-2022-30694

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-08 · updated 2026-06-17
Weakness: CWE-352

Description

The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.

Affected products

Siemens 6Ag1151-8Ab01-7Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Ag1151-8Fb01-2Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Ag1314-6Eh04-7Ab0 Firmware: before 3.3.19 — fixed in 3.3.19
Siemens 6Ag1315-2Eh14-7Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Ag1315-2Fj14-2Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Ag1317-2Ek14-7Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Ag1317-2Fk14-2Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7151-8Ab01-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7151-8Fb01-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7154-8Ab01-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7154-8Fb01-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7154-8Fx00-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7314-6Eh04-0Ab0 Firmware: before 3.3.19 — fixed in 3.3.19
Siemens 6Es7315-2Eh14-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7315-2Fj14-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7315-7Tj10-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7317-2Ek14-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7317-2Fk14-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7317-7Tk10-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7317-7Ul10-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7318-3El01-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens 6Es7318-3Fl01-0Ab0 Firmware: before 3.2.19 — fixed in 3.2.19
Siemens Simatic Drive Controller Cpu 1504D Tf Firmware: all versions
Siemens Simatic Drive Controller Cpu 1507D Tf Firmware: all versions
Siemens Simatic Pcs Firmware: through 2.1
Siemens Simatic S7-1200 Cpu 1211C Firmware: all versions
Siemens Simatic S7-1200 Cpu 1212C Firmware: all versions
Siemens Simatic S7-1200 Cpu 1212Fc Firmware: all versions
Siemens Simatic S7-1200 Cpu 1214 Fc Firmware: all versions
Siemens Simatic S7-1200 Cpu 1214C Firmware: all versions

How to fix

Upgrade to a fixed version: Siemens 6Ag1151-8Ab01-7Ab0 Firmware 3.2.19; Siemens 6Ag1151-8Fb01-2Ab0 Firmware 3.2.19; Siemens 6Ag1314-6Eh04-7Ab0 Firmware 3.3.19; Siemens 6Ag1315-2Eh14-7Ab0 Firmware 3.2.19; Siemens 6Ag1315-2Fj14-2Ab0 Firmware 3.2.19; Siemens 6Ag1317-2Ek14-7Ab0 Firmware 3.2.19; Siemens 6Ag1317-2Fk14-2Ab0 Firmware 3.2.19; Siemens 6Es7151-8Ab01-0Ab0 Firmware 3.2.19; Siemens 6Es7151-8Fb01-0Ab0 Firmware 3.2.19; Siemens 6Es7154-8Ab01-0Ab0 Firmware 3.2.19; Siemens 6Es7154-8Fb01-0Ab0 Firmware 3.2.19; Siemens 6Es7154-8Fx00-0Ab0 Firmware 3.2.19. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-30694 or the next vulnerability affects your stack