Siemens QMS Automotive
Plan Patch7.6ICS-CERT ICSA-22-314-06Nov 8, 2022
Attack VectorAdjacent
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
QMS Automotive stores user credentials in plaintext within the user database, allowing attackers with database access to read credentials and use them to gain unauthorized access to the system. Siemens has released version 12.39 with a fix. A workaround to enable password encryption is available immediately.
What this means
What could happen
An attacker with access to the QMS Automotive database could read plaintext user credentials and use them to authenticate and modify automotive manufacturing process configurations or data. This could disrupt production lines or alter critical manufacturing parameters.
Who's at risk
Automotive manufacturing facilities using Siemens QMS Automotive for production management and process control. This includes operations staff, engineers, and IT personnel who authenticate to the system. Risk is highest if the database server is accessible from compromised networks or if attackers can gain local access to the server.
How it could be exploited
An attacker must gain access to the QMS Automotive user database. If database access is obtained—either through network compromise, local access, or insider action—credentials are stored in plaintext and can be immediately read. The attacker can then use these credentials to log in to QMS Automotive and make unauthorized changes to manufacturing processes or settings.
Prerequisites
- Access to the QMS Automotive user database (local or via compromised network access to the database system
- QMS Automotive version prior to 12.39
Plaintext credential storageLow authentication requirement if database is compromisedAffects manufacturing configuration and operations
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
QMS Automotive<V12.3912.39
Remediation & Mitigation
0/5
Do now
0/1WORKAROUNDEnable encryption for user passwords in QMS Automotive settings
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate QMS Automotive to version 12.39 or later
Long-term hardening
0/3HARDENINGLocate QMS Automotive systems behind firewalls and isolate from business networks
HARDENINGMinimize network exposure and ensure QMS Automotive is not directly accessible from the Internet
HARDENINGImplement secure remote access methods such as VPNs if remote access to QMS Automotive is required
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/d8bde95d-d276-4f37-9e6d-4d76d85992cc