How severe is CVE-2022-33139?

CVE-2022-33139 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-33139 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (64th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-33139?

CVE-2022-33139 primarily affects Siemens Cerberus Dms. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-33139?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2022-33139 published?

CVE-2022-33139 was published on 2022-06-21 and last updated on 2026-06-17.

CVE-2022-33139

CVE-2022-33139 is a critical-severity vulnerability in Siemens Cerberus Dms with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-603.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 6.8
EPSS exploit prediction: 1% (64th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-603
Affected product: Siemens Cerberus Dms
Published: 2022-06-21
Last modified: 2026-06-17

Description

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.

Frequently asked questions

What is CVE-2022-33139?: A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.
How severe is CVE-2022-33139?: CVE-2022-33139 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-33139 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (64th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-33139?: CVE-2022-33139 primarily affects Siemens Cerberus Dms. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-33139?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2022-33139 published?: CVE-2022-33139 was published on 2022-06-21 and last updated on 2026-06-17.

References

Affected products (6)

cpe:2.3:a:siemens:cerberus_dms:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc_compact:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:wincc_open_architecture:3.16:*:*:*:*:*:*:*
cpe:2.3:a:siemens:wincc_open_architecture:3.17:*:*:*:*:*:*:*
cpe:2.3:a:siemens:wincc_open_architecture:3.18:*:*:*:*:*:*:*

More vulnerabilities in Siemens Cerberus Dms

CVE-2021-37181 — Critical (CVSS 10.0): A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS…

All CVEs affecting Siemens Cerberus Dms →

Other CWE-603 vulnerabilities

CVE-2026-1363 — Critical (CVSS 9.8): IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing…
CVE-2025-12868 — Critical (CVSS 9.8): New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated…
CVE-2024-39375 — Critical (CVSS 9.8): TELSAT marKoni FM Transmitters are vulnerable to an attacker bypassing authentication and gaining administrator…
CVE-2025-64119 — Critical (CVSS 9.3): A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery…
CVE-2020-7591 — High (CVSS 8.8): A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow…
CVE-2026-42098 — High (CVSS 8.7): Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role.…

Browse all CWE-603 vulnerabilities →