Siemens Teamcenter

Siemens Teamcenter has a reflected cross-site scripting (XSS) vulnerability in its authentication redirect flow (/auth/). This vulnerability allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL. The vulnerability stems from a failure to properly encode user-supplied input reflected into HTML attribute contexts. Successful exploitation could enable the attacker to steal data or perform actions within the victim's Teamcenter session without needing credentials. Siemens has released updated versions of Teamcenter to address this issue, and users are strongly encouraged to update to the latest versions to mitigate the risk.

Affected Products:

• Siemens Teamcenter

Known Affected Versions:

• Teamcenter V2412 < V2412.0013
• Teamcenter V2506 < V2506.0010
• Teamcenter V2512 < V2512.2607
• Teamcenter V2606 < V2606.2607

Relevant CWE:

• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Remediation:

• Update to V2412.0013 or later version: https://support.sw.siemens.com/product/282219420/
• Update to V2506.0010 or later version: https://support.sw.siemens.com/product/282219420/
• Update to V2512.2607 or later version: https://support.sw.siemens.com/product/282219420/
• Update to V2606.2607 or later version: https://support.sw.siemens.com/product/282219420/

CISA recommends implementing defensive measures to minimize exploitation risk, including minimizing network exposure for control system devices, isolating control systems from business networks, and utilizing secure remote access methods like VPNs (while recognizing VPN vulnerabilities). Organizations should perform impact analysis and risk assessments prior to deploying defensive measures and report suspected malicious activity to CISA.