Sign-up

ID

VAR-202305-0430


CVE

CVE-2023-28832


TITLE

Siemens'  6gk1411-1ac00  firmware and  6gk1411-5ac00  Command injection vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2023-009653

DESCRIPTION

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges. Siemens' 6gk1411-1ac00 firmware and 6gk1411-5ac00 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. SIMATIC Cloud Connect 7 is an IoT gateway for connecting programmable logic controllers to cloud services and allows field devices to be interfaced with OPC UA servers as OPC UA clients

Trust: 2.25

sources: NVD: CVE-2023-28832 // JVNDB: JVNDB-2023-009653 // CNVD: CNVD-2023-35774 // VULMON: CVE-2023-28832

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-35774

AFFECTED PRODUCTS

vendor:siemensmodel:6gk1411-1ac00scope:eqversion:2.0

Trust: 1.0

vendor:siemensmodel:6gk1411-5ac00scope:eqversion:2.0

Trust: 1.0

vendor:シーメンスmodel:6gk1411-5ac00scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:6gk1411-1ac00scope: - version: -

Trust: 0.8

vendor:siemensmodel:simatic cloud connect cc716scope:eqversion:7>=v2.0,<v2.1

Trust: 0.6

vendor:siemensmodel:simatic cloud connect cc712scope:eqversion:7>=v2.0,<v2.1

Trust: 0.6

sources: CNVD: CNVD-2023-35774 // JVNDB: JVNDB-2023-009653 // NVD: CVE-2023-28832

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2023-28832
value: HIGH

Trust: 1.0

OTHER: JVNDB-2023-009653
value: HIGH

Trust: 0.8

CNVD: CNVD-2023-35774
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202305-650
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-35774
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

productcert@siemens.com: CVE-2023-28832
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2023-009653
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-35774 // JVNDB: JVNDB-2023-009653 // CNNVD: CNNVD-202305-650 // NVD: CVE-2023-28832

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:Command injection (CWE-77) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-009653 // NVD: CVE-2023-28832

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202305-650

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202305-650

PATCH

title:Patch for Siemens SIMATIC Cloud Connect 7 Command Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/424686

Trust: 0.6

title:Siemens SIMATIC Cloud Connect Fixes for command injection vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=237051

Trust: 0.6

sources: CNVD: CNVD-2023-35774 // CNNVD: CNNVD-202305-650

EXTERNAL IDS

db:NVDid:CVE-2023-28832

Trust: 3.9

db:SIEMENSid:SSA-555292

Trust: 3.1

db:JVNid:JVNVU98195668

Trust: 0.8

db:ICS CERTid:ICSA-23-131-04

Trust: 0.8

db:JVNDBid:JVNDB-2023-009653

Trust: 0.8

db:CNVDid:CNVD-2023-35774

Trust: 0.6

db:CNNVDid:CNNVD-202305-650

Trust: 0.6

db:VULMONid:CVE-2023-28832

Trust: 0.1

sources: CNVD: CNVD-2023-35774 // VULMON: CVE-2023-28832 // JVNDB: JVNDB-2023-009653 // CNNVD: CNNVD-202305-650 // NVD: CVE-2023-28832

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2023-28832

Trust: 1.4

url:https://jvn.jp/vu/jvnvu98195668/

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-04

Trust: 0.8

url:https://cert-portal.siemens.com/productcert/html/ssa-555292.html

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2023-28832/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/77.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2023-35774 // VULMON: CVE-2023-28832 // JVNDB: JVNDB-2023-009653 // CNNVD: CNNVD-202305-650 // NVD: CVE-2023-28832

SOURCES

db:CNVDid:CNVD-2023-35774
db:VULMONid:CVE-2023-28832
db:JVNDBid:JVNDB-2023-009653
db:CNNVDid:CNNVD-202305-650
db:NVDid:CVE-2023-28832

LAST UPDATE DATE

2024-08-14T12:04:34.126000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-35774date:2023-05-10T00:00:00
db:VULMONid:CVE-2023-28832date:2023-05-09T00:00:00
db:JVNDBid:JVNDB-2023-009653date:2023-12-06T05:17:00
db:CNNVDid:CNNVD-202305-650date:2023-05-11T00:00:00
db:NVDid:CVE-2023-28832date:2023-05-15T18:49:38.067

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-35774date:2023-05-10T00:00:00
db:VULMONid:CVE-2023-28832date:2023-05-09T00:00:00
db:JVNDBid:JVNDB-2023-009653date:2023-12-06T00:00:00
db:CNNVDid:CNNVD-202305-650date:2023-05-09T00:00:00
db:NVDid:CVE-2023-28832date:2023-05-09T13:15:17.373