Skip to content
Fencer Vulns
critical 9.8

CVE-2022-33139 json

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC Win…

published 2022-06-21 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-36190

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-286-16 updated cvss 9.8

Siemens Desigo CC and Cerberus DMS

  • Siemens Cerberus DMS Siemens Desigo CC Siemens Desigo CC Compact
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-172-06 updated cvss 9.8

Siemens WinCC OA

  • Siemens SIMATIC WinCC OA V3.16 All_versions_in_default_configuration
    affected: vendor fix winccoa.com
  • Siemens SIMATIC WinCC OA V3.17 All_versions_in_non-default_configuration
    affected: vendor fix winccoa.com
  • Siemens SIMATIC WinCC OA V3.18 All_versions_in_non-default_configuration
    affected: vendor fix winccoa.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.26% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Siemens Cerberus DMS
  • Siemens Desigo CC
  • Siemens Desigo CC Compact
  • Siemens SIMATIC WinCC OA V3.16
  • Siemens SIMATIC WinCC OA V3.17
  • Siemens SIMATIC WinCC OA V3.18

Classification

Weakness
  • CWE-603 Use of Client-Side Authentication
  • CWE-287 Improper Authentication

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.