CVE-2022-44731

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances. This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
Siemens	SIMATIC WinCC OA V3.15	All versions < V3.15 P038
Siemens	SIMATIC WinCC OA V3.16	All versions < V3.16 P035
Siemens	SIMATIC WinCC OA V3.17	All versions < V3.17 P024
Siemens	SIMATIC WinCC OA V3.18	All versions < V3.18 P014

References

https://cert-portal.siemens.com/productcert/pdf/ssa-547714.pdfPatch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-547714.pdfPatch, Vendor Advisory

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-447327.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo CVE-2022-447337.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo CVE-2022-447344.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.CVE-2022-447354.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gus Sevilla WP Clictracker plugin <= 1.0.5 versions.CVE-2022-447364.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.CVE-2022-447378.8Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on Wor CVE-2022-447388.8Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts a CVE-2022-447399.8Cross-Site Request Forgery (CSRF) vulnerability in ThingsForRestaurants Quick Restaurant Reservations plugin <= 1.5.4 versions.CVE-2022-44745.4The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back CVE-2022-447408.8Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.CVE-2022-447418.8Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 o CVE-2022-447424.8Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions.