Log in Start free

Vulnerability · Published Oct 11, 2022 · Assigned by siemens

CVE-2022-40177

Medium 5.7

In plain English

A medium-severity information exposure in Desigo PXM30-1 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS NVD)5.7Medium
Exploit odds (30 days)1.0%top 37.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). Endpoints of the “Operation” web application that interpret and execute Axon language queries allow file read access to the device file system with root privileges. By supplying specific I/O related Axon queries, a remote low-privileged attacker can read sensitive files on the device.

Affected products (as reported)

VendorProductVersions
Siemens Desigo PXM30-1 All versions < V02.20.126.11-41
Siemens Desigo PXM30.E All versions < V02.20.126.11-41
Siemens Desigo PXM40-1 All versions < V02.20.126.11-41
Siemens Desigo PXM40.E All versions < V02.20.126.11-41
Siemens Desigo PXM50-1 All versions < V02.20.126.11-41
Siemens Desigo PXM50.E All versions < V02.20.126.11-41
Siemens PXG3.W100-1 All versions < V02.20.126.11-37
Siemens PXG3.W100-2 All versions < V02.20.126.11-41
Siemens PXG3.W200-1 All versions < V02.20.126.11-37
Siemens PXG3.W200-2 All versions < V02.20.126.11-41

Weakness: CWE-200

References