Sign-up

ID

VAR-202307-0572


CVE

CVE-2023-37376


TITLE

Siemens'  tecnomatix  Vulnerability regarding mix-ups in

Trust: 0.8

sources: JVNDB: JVNDB-2023-021700

DESCRIPTION

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application contains a type confusion vulnerability while parsing STP files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21051). Siemens' tecnomatix contains a type confusion vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of STP files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. Siemens Tecnomatix Plant Simulation is an industrial control device of Siemens, Germany. It uses discrete event simulation to analyze and optimize production volume, thereby improving the performance of manufacturing systems

Trust: 2.88

sources: NVD: CVE-2023-37376 // JVNDB: JVNDB-2023-021700 // ZDI: ZDI-23-1575 // CNVD: CNVD-2023-56534 // VULMON: CVE-2023-37376

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-56534

AFFECTED PRODUCTS

vendor:siemensmodel:tecnomatixscope:ltversion:2201.0008

Trust: 1.0

vendor:siemensmodel:tecnomatixscope:gteversion:2201

Trust: 1.0

vendor:siemensmodel:tecnomatixscope:gteversion:2302

Trust: 1.0

vendor:siemensmodel:tecnomatixscope:ltversion:2302.0002

Trust: 1.0

vendor:シーメンスmodel:tecnomatixscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:tecnomatixscope:eqversion:2302 that's all 2302.0002

Trust: 0.8

vendor:シーメンスmodel:tecnomatixscope:eqversion:2201 that's all 2201.0008

Trust: 0.8

vendor:シーメンスmodel:tecnomatixscope: - version: -

Trust: 0.8

vendor:siemensmodel:tecnomatix plant simulationscope: - version: -

Trust: 0.7

vendor:siemensmodel:tecnomatix plant simulationscope:eqversion:v2201<v2201.0008

Trust: 0.6

vendor:siemensmodel:tecnomatix plant simulationscope:eqversion:v2302<v2302.0002

Trust: 0.6

sources: ZDI: ZDI-23-1575 // CNVD: CNVD-2023-56534 // JVNDB: JVNDB-2023-021700 // NVD: CVE-2023-37376

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-37376
value: HIGH

Trust: 1.0

productcert@siemens.com: CVE-2023-37376
value: HIGH

Trust: 1.0

NVD: CVE-2023-37376
value: HIGH

Trust: 0.8

ZDI: CVE-2023-37376
value: HIGH

Trust: 0.7

CNVD: CNVD-2023-56534
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202307-724
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-56534
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-37376
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2023-37376
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-37376
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-1575 // CNVD: CNVD-2023-56534 // JVNDB: JVNDB-2023-021700 // CNNVD: CNNVD-202307-724 // NVD: CVE-2023-37376 // NVD: CVE-2023-37376

PROBLEMTYPE DATA

problemtype:CWE-843

Trust: 1.0

problemtype:Mistake of type (CWE-843) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-021700 // NVD: CVE-2023-37376

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202307-724

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202307-724

PATCH

title:Siemens has issued an update to correct this vulnerability.url:https://cert-portal.siemens.com/productcert/html/ssa-764801.html

Trust: 0.7

title:Patch for Siemens Tecnomatix Plant Simulation Type Confusion Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/443036

Trust: 0.6

title:Siemens Tecnomatix Plant Simulation Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=246648

Trust: 0.6

sources: ZDI: ZDI-23-1575 // CNVD: CNVD-2023-56534 // CNNVD: CNNVD-202307-724

EXTERNAL IDS

db:NVDid:CVE-2023-37376

Trust: 4.6

db:SIEMENSid:SSA-764801

Trust: 3.1

db:JVNid:JVNVU95292697

Trust: 0.8

db:JVNDBid:JVNDB-2023-021700

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-21051

Trust: 0.7

db:ZDIid:ZDI-23-1575

Trust: 0.7

db:CNVDid:CNVD-2023-56534

Trust: 0.6

db:CNNVDid:CNNVD-202307-724

Trust: 0.6

db:VULMONid:CVE-2023-37376

Trust: 0.1

sources: ZDI: ZDI-23-1575 // CNVD: CNVD-2023-56534 // VULMON: CVE-2023-37376 // JVNDB: JVNDB-2023-021700 // CNNVD: CNNVD-202307-724 // NVD: CVE-2023-37376

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf

Trust: 2.5

url:https://cert-portal.siemens.com/productcert/html/ssa-764801.html

Trust: 1.3

url:https://jvn.jp/vu/jvnvu95292697/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-37376

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2023-37376/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-23-1575 // CNVD: CNVD-2023-56534 // VULMON: CVE-2023-37376 // JVNDB: JVNDB-2023-021700 // CNNVD: CNNVD-202307-724 // NVD: CVE-2023-37376

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-23-1575

SOURCES

db:ZDIid:ZDI-23-1575
db:CNVDid:CNVD-2023-56534
db:VULMONid:CVE-2023-37376
db:JVNDBid:JVNDB-2023-021700
db:CNNVDid:CNNVD-202307-724
db:NVDid:CVE-2023-37376

LAST UPDATE DATE

2024-08-14T12:50:00.685000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-1575date:2023-10-19T00:00:00
db:CNVDid:CNVD-2023-56534date:2023-07-17T00:00:00
db:VULMONid:CVE-2023-37376date:2023-07-11T00:00:00
db:JVNDBid:JVNDB-2023-021700date:2024-01-19T08:06:00
db:CNNVDid:CNNVD-202307-724date:2023-07-19T00:00:00
db:NVDid:CVE-2023-37376date:2023-07-18T14:56:17.227

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-1575date:2023-10-19T00:00:00
db:CNVDid:CNVD-2023-56534date:2023-07-17T00:00:00
db:VULMONid:CVE-2023-37376date:2023-07-11T00:00:00
db:JVNDBid:JVNDB-2023-021700date:2024-01-19T00:00:00
db:CNNVDid:CNNVD-202307-724date:2023-07-11T00:00:00
db:NVDid:CVE-2023-37376date:2023-07-11T10:15:11.877