How severe is CVE-2022-44731?

CVE-2022-44731 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2022-44731 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-44731?

CVE-2022-44731 primarily affects Siemens Simatic Wincc Oa. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-44731?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-44731 published?

CVE-2022-44731 was published on 2022-12-13 and last updated on 2026-06-17.

CVE-2022-44731

CVE-2022-44731 is a medium-severity vulnerability in Siemens Simatic Wincc Oa with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-88.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-88
Affected product: Siemens Simatic Wincc Oa
Published: 2022-12-13
Last modified: 2026-06-17

Description

A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances. This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).

Frequently asked questions

What is CVE-2022-44731?: A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances. This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).
How severe is CVE-2022-44731?: CVE-2022-44731 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2022-44731 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-44731?: CVE-2022-44731 primarily affects Siemens Simatic Wincc Oa. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-44731?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-44731 published?: CVE-2022-44731 was published on 2022-12-13 and last updated on 2026-06-17.

References

https://cert-portal.siemens.com/productcert/pdf/ssa-547714.pdf

Affected products (4)

cpe:2.3:a:siemens:simatic_wincc_oa:3.15:*:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_wincc_oa:3.16:-:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_wincc_oa:3.17:-:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_wincc_oa:3.18:-:*:*:*:*:*:*

More vulnerabilities in Siemens Simatic Wincc Oa

CVE-2021-20093 — Critical (CVSS 9.1): A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker…
CVE-2019-6575 — High (CVSS 7.5): A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU…
CVE-2021-41057 — High (CVSS 7.1): In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file…

All CVEs affecting Siemens Simatic Wincc Oa →

Other CWE-88 (Argument Injection) vulnerabilities

CVE-2026-57572 — Critical (CVSS 10.0): Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted…
CVE-2026-40281 — Critical (CVSS 10.0): Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint…
CVE-2023-6269 — Critical (CVSS 10.0): An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify…
CVE-2007-0882 — Critical (CVSS 10.0): Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11)…
CVE-2004-0480 — Critical (CVSS 10.0): Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via…
CVE-1999-0113 — Critical (CVSS 10.0): Some implementations of rlogin allow root access if given a -froot parameter.

Browse all CWE-88 (Argument Injection) vulnerabilities →