CVE:CVE-2022-40177
CNNVD:CNNVD-202210-512
Siemens Desigo PX是德国西门子（Siemens）公司的一套楼宇自动化控制系统。
Siemens 多款产品存在信息泄露漏洞，该漏洞源于解释和执行 Axon 语言查询的“Operation” Web 应用程序的端点允许以 root 权限对设备文件系统进行文件读取访问。通过提供特定的 I/O 相关 Axon 查询，远程低权限攻击者可以读取设备上的敏感文件。Desigo PXM30-1 V02.20.126.11-41 版本之前，Desigo PXM30.E V02.20.126.11-41 版本之前，Desigo PXM40-1 V02.20.126.11-41 版本之前，Desigo PXM40.E V02.20.126.11-41 版本之前，Desigo PXM50-1 V02.20.126.11-41 版本之前，Desigo PXM50.E V02.20.126.11-41 版本之前，PXG3.W100-1 V02.20.126.11-37 版本之前，PXG3.W100-2 V02.20.126.11-41 版本之前，PXG3.W200-1 V02.20.126.11-37 版本之前，PXG3.W200-2 V02.20.126.11-41 版本之前。
solution:Upgrade siemens desigo_pxm30-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm30.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w100-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w100-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w200-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w200-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41)