CVE-2022-22128 Siemens CVE debrief

Who should care

Siemens Opcenter Intelligence administrators, OT/industrial control system operators, vulnerability management teams, and security responders responsible for network-exposed or enterprise-managed Siemens deployments.

Technical summary

The CISA CSAF advisory identifies a path traversal vulnerability in Siemens Opcenter Intelligence. The affected component is the product’s internal file transfer service. The provided CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, which supports a high-severity assessment with potential remote code execution impact if successfully exploited. The advisory’s remediation points to Siemens version V2501 or later.

Defensive priority

High priority. This is a critical, network-reachable vulnerability with no privileges or user interaction required per the supplied CVSS vector, and the stated impact includes potential remote code execution.

Recommended defensive actions

• Update Siemens Opcenter Intelligence to V2501 or later, following the vendor guidance referenced in the Siemens advisory.
• Inventory all Opcenter Intelligence deployments and confirm which systems are affected.
• Limit access to the internal file transfer service to trusted hosts and segment industrial environments where possible.
• Review exposure of any network-facing or cross-zone pathways that could reach the affected service.
• Track the Siemens advisory and apply the latest available vendor-recommended version as soon as change control allows.

Evidence notes

This debrief follows the advisory metadata in the supplied CISA CSAF source for Siemens Opcenter Intelligence. The source corpus contains an internal description text that references Tableau Server Administration Agent, which conflicts with the advisory title, vendor, affected product, and remediation data identifying Siemens Opcenter Intelligence. For that reason, the debrief relies on the product and remediation metadata rather than the mismatched description text. The advisory was published on 2025-02-11 and revised on 2025-05-06 for typo fixes.

Official resources