Sign-up

ID

VAR-202307-0655


CVE

CVE-2023-36521


TITLE

Vulnerability in limiting or non-slotting resource allocation in multiple Siemens products

Trust: 0.8

sources: JVNDB: JVNDB-2023-021743

DESCRIPTION

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). The result synchronization server of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation of all socket-based communication of the affected products if the result server is enabled. simatic mv540 h firmware, simatic mv540 s firmware, simatic mv550 h Multiple Siemens products, including firmware, contain vulnerabilities related to limited or unthrottled resource allocation.Service operation interruption (DoS) It may be in a state. The SIMATIC MV500 products are fixed mount optical readers for capturing printed, laser, drilled, punched and dot-dash codes on a variety of different surfaces

Trust: 2.25

sources: NVD: CVE-2023-36521 // JVNDB: JVNDB-2023-021743 // CNVD: CNVD-2023-56540 // VULMON: CVE-2023-36521

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-56540

AFFECTED PRODUCTS

vendor:siemensmodel:simatic mv540 hscope:ltversion:3.3.4

Trust: 1.0

vendor:siemensmodel:simatic mv550 hscope:ltversion:3.3.4

Trust: 1.0

vendor:siemensmodel:simatic mv560 uscope:ltversion:3.3.4

Trust: 1.0

vendor:siemensmodel:simatic mv540 sscope:ltversion:3.3.4

Trust: 1.0

vendor:siemensmodel:simatic mv560 xscope:ltversion:3.3.4

Trust: 1.0

vendor:siemensmodel:simatic mv550 sscope:ltversion:3.3.4

Trust: 1.0

vendor:シーメンスmodel:simatic mv550 hscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic mv540 hscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic mv550 sscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic mv560 uscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic mv560 xscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic mv540 sscope: - version: -

Trust: 0.8

vendor:siemensmodel:simatic mv540 hscope:ltversion:v3.3.4

Trust: 0.6

vendor:siemensmodel:simatic mv540 sscope:ltversion:v3.3.4

Trust: 0.6

vendor:siemensmodel:simatic mv550 hscope:ltversion:v3.3.4

Trust: 0.6

vendor:siemensmodel:simatic mv550 sscope:ltversion:v3.3.4

Trust: 0.6

vendor:siemensmodel:simatic mv560 uscope:ltversion:v3.3.4

Trust: 0.6

vendor:siemensmodel:simatic mv560scope:eqversion:x<v3.3.4

Trust: 0.6

sources: CNVD: CNVD-2023-56540 // JVNDB: JVNDB-2023-021743 // NVD: CVE-2023-36521

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-36521
value: HIGH

Trust: 1.0

productcert@siemens.com: CVE-2023-36521
value: HIGH

Trust: 1.0

NVD: CVE-2023-36521
value: HIGH

Trust: 0.8

CNVD: CNVD-2023-56540
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202307-740
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-56540
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-36521
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2023-36521
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 4.0
version: 3.1

Trust: 1.0

NVD: CVE-2023-36521
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-56540 // JVNDB: JVNDB-2023-021743 // CNNVD: CNNVD-202307-740 // NVD: CVE-2023-36521 // NVD: CVE-2023-36521

PROBLEMTYPE DATA

problemtype:CWE-770

Trust: 1.0

problemtype:Allocation of resources without limits or throttling (CWE-770) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-021743 // NVD: CVE-2023-36521

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202307-740

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202307-740

PATCH

title:Patch for Siemens SIMATIC MV500 Devices Uncontrolled Resource Consumption Vulnerability (CNVD-2023-56540)url:https://www.cnvd.org.cn/patchInfo/show/443066

Trust: 0.6

title:Siemens SIMATIC Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=246824

Trust: 0.6

sources: CNVD: CNVD-2023-56540 // CNNVD: CNNVD-202307-740

EXTERNAL IDS

db:NVDid:CVE-2023-36521

Trust: 3.9

db:SIEMENSid:SSA-561322

Trust: 3.1

db:JVNid:JVNVU95292697

Trust: 0.8

db:JVNDBid:JVNDB-2023-021743

Trust: 0.8

db:CNVDid:CNVD-2023-56540

Trust: 0.6

db:CNNVDid:CNNVD-202307-740

Trust: 0.6

db:VULMONid:CVE-2023-36521

Trust: 0.1

sources: CNVD: CNVD-2023-56540 // VULMON: CVE-2023-36521 // JVNDB: JVNDB-2023-021743 // CNNVD: CNNVD-202307-740 // NVD: CVE-2023-36521

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf

Trust: 2.5

url:https://jvn.jp/vu/jvnvu95292697/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-36521

Trust: 0.8

url:https://cert-portal.siemens.com/productcert/html/ssa-561322.html

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2023-36521/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2023-56540 // VULMON: CVE-2023-36521 // JVNDB: JVNDB-2023-021743 // CNNVD: CNNVD-202307-740 // NVD: CVE-2023-36521

SOURCES

db:CNVDid:CNVD-2023-56540
db:VULMONid:CVE-2023-36521
db:JVNDBid:JVNDB-2023-021743
db:CNNVDid:CNNVD-202307-740
db:NVDid:CVE-2023-36521

LAST UPDATE DATE

2024-08-14T12:47:30.923000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-56540date:2023-07-17T00:00:00
db:VULMONid:CVE-2023-36521date:2023-07-11T00:00:00
db:JVNDBid:JVNDB-2023-021743date:2024-01-19T08:07:00
db:CNNVDid:CNNVD-202307-740date:2023-07-20T00:00:00
db:NVDid:CVE-2023-36521date:2023-07-19T15:21:04.790

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-56540date:2023-07-17T00:00:00
db:VULMONid:CVE-2023-36521date:2023-07-11T00:00:00
db:JVNDBid:JVNDB-2023-021743date:2024-01-19T00:00:00
db:CNNVDid:CNNVD-202307-740date:2023-07-11T00:00:00
db:NVDid:CVE-2023-36521date:2023-07-11T10:15:10.897