Sign-up

ID

VAR-202306-0974


CVE

CVE-2023-28829


TITLE

Vulnerabilities in multiple Siemens products

Trust: 0.8

sources: JVNDB: JVNDB-2023-014286

DESCRIPTION

A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents. simatic net pc software , SIMATIC PCS 7 , SIMATIC WinCC Unspecified vulnerabilities exist in multiple Siemens products.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2023-28829 // JVNDB: JVNDB-2023-014286 // VULMON: CVE-2023-28829

AFFECTED PRODUCTS

vendor:siemensmodel:simatic pcs 7scope:eqversion:9.0

Trust: 1.0

vendor:siemensmodel:simatic net pc softwarescope:eqversion:15.0

Trust: 1.0

vendor:siemensmodel:simatic pcs 7scope:eqversion:8.2

Trust: 1.0

vendor:siemensmodel:simatic net pc softwarescope:eqversion:14.0

Trust: 1.0

vendor:siemensmodel:simatic pcs 7scope:eqversion:9.1

Trust: 1.0

vendor:siemensmodel:simatic winccscope:ltversion:8.0

Trust: 1.0

vendor:siemensmodel:sinaut st7scscope:eqversion:*

Trust: 1.0

vendor:シーメンスmodel:simatic pcs 7scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic winccscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic net pc softwarescope: - version: -

Trust: 0.8

vendor:シーメンスmodel:sinaut st7scscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-014286 // NVD: CVE-2023-28829

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-28829
value: HIGH

Trust: 1.0

productcert@siemens.com: CVE-2023-28829
value: LOW

Trust: 1.0

NVD: CVE-2023-28829
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202306-882
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2023-28829
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2023-28829
baseSeverity: LOW
baseScore: 3.9
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 0.5
impactScore: 3.4
version: 3.1

Trust: 1.0

NVD: CVE-2023-28829
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-014286 // CNNVD: CNNVD-202306-882 // NVD: CVE-2023-28829 // NVD: CVE-2023-28829

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-477

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-014286 // NVD: CVE-2023-28829

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202306-882

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202306-882

PATCH

title:Siemens SIMATIC PCS 7 Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=244458

Trust: 0.6

sources: CNNVD: CNNVD-202306-882

EXTERNAL IDS

db:NVDid:CVE-2023-28829

Trust: 3.3

db:SIEMENSid:SSA-508677

Trust: 2.5

db:JVNid:JVNVU99464755

Trust: 0.8

db:ICS CERTid:ICSA-23-166-05

Trust: 0.8

db:JVNDBid:JVNDB-2023-014286

Trust: 0.8

db:CNNVDid:CNNVD-202306-882

Trust: 0.6

db:VULMONid:CVE-2023-28829

Trust: 0.1

sources: VULMON: CVE-2023-28829 // JVNDB: JVNDB-2023-014286 // CNNVD: CNNVD-202306-882 // NVD: CVE-2023-28829

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdf

Trust: 2.5

url:https://jvn.jp/vu/jvnvu99464755/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-28829

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-05

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2023-28829/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2023-28829 // JVNDB: JVNDB-2023-014286 // CNNVD: CNNVD-202306-882 // NVD: CVE-2023-28829

SOURCES

db:VULMONid:CVE-2023-28829
db:JVNDBid:JVNDB-2023-014286
db:CNNVDid:CNNVD-202306-882
db:NVDid:CVE-2023-28829

LAST UPDATE DATE

2024-08-14T12:54:22.598000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2023-28829date:2023-06-13T00:00:00
db:JVNDBid:JVNDB-2023-014286date:2023-12-22T08:15:00
db:CNNVDid:CNNVD-202306-882date:2023-07-06T00:00:00
db:NVDid:CVE-2023-28829date:2023-07-05T17:36:45.750

SOURCES RELEASE DATE

db:VULMONid:CVE-2023-28829date:2023-06-13T00:00:00
db:JVNDBid:JVNDB-2023-014286date:2023-12-22T00:00:00
db:CNNVDid:CNNVD-202306-882date:2023-06-13T00:00:00
db:NVDid:CVE-2023-28829date:2023-06-13T09:15:16.707