Full Report
SIMATIC WinCC OA implements client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated. Siemens recommends to enable server-side authentication (SSA) or Kerberos authentication for all WinCC OA projects, as documented in the WinCC OA Security Guideline. In SIMATIC WinCC OA server-side authentication is available since V3.15 (and offered as the default configuration since V3.17). Additional information can be found at: https://cert-portal.siemens.com/productcert/news.html?id=21.
Analysis Summary
# Vulnerability: Improper Authentication in SIMATIC WinCC OA
## CVE Details
- **CVE ID:** CVE-2022-33716 (Based on Siemens SSA-712929; note: the provided text describes the flaw associated with this identifier).
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287: Improper Authentication
## Affected Systems
- **Products:** Siemens SIMATIC WinCC OA (Open Architecture)
- **Versions:** All versions prior to V3.15, and versions V3.15, V3.16 when not configured correctly.
- **Configurations:** Systems where **neither** Server-Side Authentication (SSA) nor Kerberos authentication is enabled.
## Vulnerability Description
The vulnerability arises from the implementation of client-side-only authentication. In this insecure configuration, the server relies on the client to verify identity. An attacker can bypass this by crafting malicious packets or using a rogue client to communicate directly with the server. Because the server does not perform its own independent validation of the user's credentials, it accepts the identity claimed by the client.
## Exploitation
- **Status:** Not reported as exploited in the wild (based on current Siemens advisories); PoC concepts exist for protocol manipulation.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Access to sensitive SCADA data and system configuration)
- **Integrity:** High (Unauthorized modification of control logic or process values)
- **Availability:** High (Potential for unauthorized shutdown or disruption of services)
## Remediation
### Patches
- **Upgrade to V3.17 or newer:** Server-side authentication (SSA) is offered as the default configuration starting with version V3.17.
- **Upgrade to V3.15 / V3.16:** These versions support SSA, but it must be manually enabled.
### Workarounds
- **Enable Server-Side Authentication (SSA):** Follow the steps outlined in the WinCC OA Security Guideline to activate SSA.
- **Enable Kerberos:** Use Kerberos authentication as an alternative to SSA to ensure the server validates all client requests.
- **Network Segmentation:** Ensure the WinCC OA management network is isolated from untrusted networks to limit potential attacker access to the client-server protocol.
## Detection
- **Indicators of Compromise:** Monitor for unusual login patterns, such as multiple administrative logins from unexpected IP addresses.
- **Detection methods and tools:**
- Audit system logs for "Authentication bypassed" or mismatched identity reports.
- Use network intrusion detection systems (NIDS) to monitor for unauthorized traffic on the WinCC OA communication ports (default TCP/4999, 5678, etc.).
- Review the `config` file for the project to verify if `useSSA = 1` is set.
## References
- **Vendor Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/news[.]html?id=21
- **Security Guideline:** hxxps[://]www[.]siemens[.]com/cert/advisories/