Sign-up

ID

VAR-202309-0631


CVE

CVE-2023-38557


TITLE

Siemens'  Spectrum Power 7  Vulnerability in improper permission assignment for critical resources in

Trust: 0.8

sources: JVNDB: JVNDB-2023-012738

DESCRIPTION

A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the update script. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges. Siemens' Spectrum Power 7 Contains a vulnerability in improper permission assignment for critical resources.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Spectrum Power 7 provides basic components for SCADA, communications and data modeling for control and monitoring systems. Suites of applications can be added to optimize network and generation management in all areas of energy management

Trust: 2.25

sources: NVD: CVE-2023-38557 // JVNDB: JVNDB-2023-012738 // CNVD: CNVD-2023-69972 // VULMON: CVE-2023-38557

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-69972

AFFECTED PRODUCTS

vendor:siemensmodel:spectrum power 7scope:ltversion:23q3

Trust: 1.0

vendor:シーメンスmodel:spectrum power 7scope:eqversion:23q3

Trust: 0.8

vendor:シーメンスmodel:spectrum power 7scope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:spectrum power 7scope: - version: -

Trust: 0.8

vendor:siemensmodel:spectrum power <v23q3scope:eqversion:7

Trust: 0.6

sources: CNVD: CNVD-2023-69972 // JVNDB: JVNDB-2023-012738 // NVD: CVE-2023-38557

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-38557
value: HIGH

Trust: 1.0

productcert@siemens.com: CVE-2023-38557
value: HIGH

Trust: 1.0

NVD: CVE-2023-38557
value: HIGH

Trust: 0.8

CNVD: CNVD-2023-69972
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2023-69972
severity: MEDIUM
baseScore: 6.8
vectorString: AV:L/AC:L/AU:S/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-38557
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2023-38557
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.5
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2023-38557
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-69972 // JVNDB: JVNDB-2023-012738 // NVD: CVE-2023-38557 // NVD: CVE-2023-38557

PROBLEMTYPE DATA

problemtype:CWE-732

Trust: 1.0

problemtype:Improper permission assignment for critical resources (CWE-732) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-012738 // NVD: CVE-2023-38557

PATCH

title:Patch for Siemens Spectrum Power 7 local privilege escalation vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/461011

Trust: 0.6

sources: CNVD: CNVD-2023-69972

EXTERNAL IDS

db:NVDid:CVE-2023-38557

Trust: 3.3

db:SIEMENSid:SSA-357182

Trust: 2.5

db:JVNid:JVNVU98137233

Trust: 0.8

db:ICS CERTid:ICSA-23-264-02

Trust: 0.8

db:JVNDBid:JVNDB-2023-012738

Trust: 0.8

db:CNVDid:CNVD-2023-69972

Trust: 0.6

db:VULMONid:CVE-2023-38557

Trust: 0.1

sources: CNVD: CNVD-2023-69972 // VULMON: CVE-2023-38557 // JVNDB: JVNDB-2023-012738 // NVD: CVE-2023-38557

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-357182.pdf

Trust: 1.9

url:https://jvn.jp/vu/jvnvu98137233/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-38557

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-02

Trust: 0.8

url:https://cert-portal.siemens.com/productcert/html/ssa-357182.html

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/732.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2023-69972 // VULMON: CVE-2023-38557 // JVNDB: JVNDB-2023-012738 // NVD: CVE-2023-38557

SOURCES

db:CNVDid:CNVD-2023-69972
db:VULMONid:CVE-2023-38557
db:JVNDBid:JVNDB-2023-012738
db:NVDid:CVE-2023-38557

LAST UPDATE DATE

2024-08-14T12:59:16.775000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-69972date:2023-09-15T00:00:00
db:VULMONid:CVE-2023-38557date:2023-09-14T00:00:00
db:JVNDBid:JVNDB-2023-012738date:2023-12-19T01:07:00
db:NVDid:CVE-2023-38557date:2023-09-21T16:12:01.620

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-69972date:2023-09-15T00:00:00
db:VULMONid:CVE-2023-38557date:2023-09-14T00:00:00
db:JVNDBid:JVNDB-2023-012738date:2023-12-19T00:00:00
db:NVDid:CVE-2023-38557date:2023-09-14T11:15:07.497