Vulnerability · Published Jun 14, 2022 · Assigned by siemens

CVE-2022-31619

High 8.8

In plain English

A high-severity hard-coded credentials in Teamcenter V12.4 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)1.4%top 27.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All versions < V13.1.0.9), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.3), Teamcenter V14.0 (All versions < V14.0.0.2). Java EE Server Manager HTML Adaptor in Teamcenter consists of default hardcoded credentials. Access to the application allows a user to perform a series of actions that could potentially lead to remote code execution with elevated permissions.

Affected products (as reported)

Vendor	Product	Versions
Siemens	Teamcenter V12.4	All versions < V12.4.0.13
Siemens	Teamcenter V13.0	All versions < V13.0.0.9
Siemens	Teamcenter V13.1	All versions < V13.1.0.9
Siemens	Teamcenter V13.2	All versions < V13.2.0.9
Siemens	Teamcenter V13.3	All versions < V13.3.0.3
Siemens	Teamcenter V14.0	All versions < V14.0.0.2

Weakness: CWE-798

References

https://cert-portal.siemens.com/productcert/pdf/ssa-220589.pdf x_refsource_MISC