LOW🇵🇱 Wersja polska

CVE-2023-28829

CVSS 3.9v3.1pub. 2023-06-13upd. 2024-11-21

A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.

CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

  • Siemens Simatic Net Pc Software

    APP
    Siemens
    14.015.0

  • Siemens Simatic Pcs 7

    APP
    Siemens
    8.29.09.1

  • Siemens Simatic Wincc

    APP
    Siemens
    < 8.0

  • Siemens Sinaut St7sc

    APP
    Siemens
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-25910CRITICAL10.0PL ✓same product

Siemens SIMATIC — RCE przez wbudowane funkcje systemu zarządzania bazą danych

CVE-2021-40358CRITICAL9.9PL ✓same product

Path Traversal w SIMATIC PCS 7 i WinCC — nieautoryzowany dostęp do plików

CVE-2019-10922CRITICAL9.8PL ✓same product

RCE bez uwierzytelnienia w Siemens SIMATIC PCS 7 i WinCC

CVE-2016-5743CRITICAL9.8PL ✓same product

RCE w Siemens SIMATIC WinCC i PCS 7 poprzez spreparowane pakiety sieciowe

CVE-2023-48363HIGH7.1same product

A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All ...