Unauthenticated attackers can forge credentials to gain full administrative control of Siemens Opcenter X
A critical flaw in Siemens Opcenter X allows anyone on the network to forge their own credentials and take over administrative accounts. This vulnerability carries a CVSS score of 10.0 due to its ease of exploitation and total impact. Update to version V2604 immediately to close this gap. 馃毃
Summary
Siemens has disclosed a critical authentication bypass vulnerability affecting all versions of Opcenter X prior to V2604. The flaw resides in how the application processes JSON Web Tokens (JWT), specifically failing to validate the algorithm specified in the token header. This oversight enables an unauthenticated remote attacker to forge arbitrary tokens, allowing them to impersonate any user-including those with full administrative privileges-and gain complete unauthorized access to the application.
Technical details
The vulnerability stems from improper validation of the algorithm field within the JSON Web Token (JWT) header. In a standard secure implementation, the server should enforce a specific, trusted cryptographic algorithm for all incoming tokens. However, because Opcenter X does not strictly validate this field, an attacker can manipulate the token to use a different or unexpected algorithm.
By exploiting this lack of validation, an attacker can generate a forged JWT that the application accepts as legitimate. This process allows the attacker to bypass standard authentication mechanisms entirely. Once the forged token is presented, the application treats the bearer as the identity specified in the token payload, which can include high-privilege administrative accounts.
Affected products and fixed versions
The vulnerability impacts all versions of Siemens Opcenter X that have not yet been patched.
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Opcenter X | All versions < V2604 | V2604 |
Defender guidance
Immediate action is required to mitigate the risk of full application takeover.
- Update Software: Upgrade all instances of Opcenter X to version V2604 or later. Siemens has released this new version specifically to address this authentication bypass.
- Network Isolation: Protect network access to these devices using appropriate access control mechanisms. Ensure that the application is not exposed directly to untrusted networks.
- Follow Industrial Security Guidelines: Configure your environment according to Siemens' operational guidelines for Industrial Security to maintain a protected IT environment.
Sources
