CVE-2022-34820

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All versions < V3.3.46), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0 < V2.2.28), SIMATIC CP 1543-1 (All versions < V3.0.22), SIMATIC CP 1543SP-1 (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application does not correctly escape some user provided fields during the authentication process. This could allow an attacker to inject custom commands and execute arbitrary code with elevated privileges.

• CWE-77
• CWE-116

• https://cert-portal.siemens.com/productcert/pdf/ssa-517377.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-517377.pdfPatch, Vendor Advisory

Published

Jul 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34815A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2022-34816Jenkins HPE Network Virtualization Plugin 1.0 stores passwor…6.5
• CVE-2022-34817A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2022-34818Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does…4.3
• CVE-2022-34819A vulnerability has been identified in SIMATIC CP 1242-7 V2 …10
• CVE-2022-3482An improper access control issue in GitLab CE/EE affecting a…5.3
• CVE-2022-34821A vulnerability has been identified in RUGGEDCOM RM1224 LTE(…8.8
• CVE-2022-34822Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows…9.8
• CVE-2022-34823Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Window…9.8
• CVE-2022-34824Weak File and Folder Permissions vulnerability in CLUSTERPRO…9.8
• CVE-2022-34825Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Win…9.8
• CVE-2022-34826In Couchbase Server 7.1.x before 7.1.1, an encrypted Private…5.9