What’s Vulnerable › Vulnerabilities

CVE-2022-44731

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-13 · updated 2026-06-17
• Weakness: CWE-88

Description

A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances. This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).

Affected products

• Siemens SIMATIC WinCC OA: 3.15, 3.16, 3.17, 3.18

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-547714.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-547714.pdf

Get alerted when CVE-2022-44731 or the next vulnerability affects your stack