CVE-2021-44222

Name of the Vulnerable Software and Affected Versions SIMATIC eaSie Core Package versions prior to V22.00

Description A vulnerability has been identified where the underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and issue arbitrary requests in the affected system.

Recommendations For versions prior to V22.00, update to version V22.00 or later to resolve the issue. As a temporary workaround, consider configuring the MQTT service to perform authentication to minimize the risk of exploitation.