Sign-up

ID

VAR-202310-0155


CVE

CVE-2023-45204


TITLE

Siemens'  tecnomatix  Illegal type conversion vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2023-013978

DESCRIPTION

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain a type confusion vulnerability while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21268). Siemens' tecnomatix Exists in a vulnerability related to illegal type conversion.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of IGS files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. Siemens Tecnomatix Plant Simulation is an industrial control equipment from Germany's Siemens. Improve manufacturing system performance by leveraging the power of discrete event simulation for throughput analysis and optimization

Trust: 2.79

sources: NVD: CVE-2023-45204 // JVNDB: JVNDB-2023-013978 // ZDI: ZDI-23-1576 // CNVD: CNVD-2023-75580

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-75580

AFFECTED PRODUCTS

vendor:siemensmodel:tecnomatixscope:ltversion:2201.0009

Trust: 1.0

vendor:siemensmodel:tecnomatixscope:ltversion:2302.0003

Trust: 1.0

vendor:siemensmodel:tecnomatixscope:gteversion:2201

Trust: 1.0

vendor:siemensmodel:tecnomatixscope:gteversion:2302

Trust: 1.0

vendor:シーメンスmodel:tecnomatixscope:eqversion:2302 that's all 2302.0003

Trust: 0.8

vendor:シーメンスmodel:tecnomatixscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:tecnomatixscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:tecnomatixscope:eqversion:2201 that's all 2201.0009

Trust: 0.8

vendor:siemensmodel:tecnomatix plant simulationscope: - version: -

Trust: 0.7

vendor:siemensmodel:tecnomatix plant simulationscope:eqversion:v2201<v2201.0009

Trust: 0.6

vendor:siemensmodel:tecnomatix plant simulationscope:eqversion:v2302<v2302.0003

Trust: 0.6

sources: ZDI: ZDI-23-1576 // CNVD: CNVD-2023-75580 // JVNDB: JVNDB-2023-013978 // NVD: CVE-2023-45204

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-45204
value: HIGH

Trust: 1.0

productcert@siemens.com: CVE-2023-45204
value: HIGH

Trust: 1.0

NVD: CVE-2023-45204
value: HIGH

Trust: 0.8

ZDI: CVE-2023-45204
value: HIGH

Trust: 0.7

CNVD: CNVD-2023-75580
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-75580
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-45204
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2023-45204
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-45204
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-1576 // CNVD: CNVD-2023-75580 // JVNDB: JVNDB-2023-013978 // NVD: CVE-2023-45204 // NVD: CVE-2023-45204

PROBLEMTYPE DATA

problemtype:CWE-704

Trust: 1.0

problemtype:Illegal type conversion or cast (CWE-704) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-013978 // NVD: CVE-2023-45204

PATCH

title:Siemens has issued an update to correct this vulnerability.url:https://cert-portal.siemens.com/productcert/html/ssa-524778.html

Trust: 0.7

title:Patch for Siemens Tecnomatix Plant Simulation file analysis vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/466691

Trust: 0.6

sources: ZDI: ZDI-23-1576 // CNVD: CNVD-2023-75580

EXTERNAL IDS

db:NVDid:CVE-2023-45204

Trust: 3.9

db:SIEMENSid:SSA-524778

Trust: 2.4

db:JVNid:JVNVU98753493

Trust: 0.8

db:JVNDBid:JVNDB-2023-013978

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-21268

Trust: 0.7

db:ZDIid:ZDI-23-1576

Trust: 0.7

db:CNVDid:CNVD-2023-75580

Trust: 0.6

sources: ZDI: ZDI-23-1576 // CNVD: CNVD-2023-75580 // JVNDB: JVNDB-2023-013978 // NVD: CVE-2023-45204

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf

Trust: 1.8

url:https://cert-portal.siemens.com/productcert/html/ssa-524778.html

Trust: 1.3

url:https://jvn.jp/vu/jvnvu98753493/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-45204

Trust: 0.8

sources: ZDI: ZDI-23-1576 // CNVD: CNVD-2023-75580 // JVNDB: JVNDB-2023-013978 // NVD: CVE-2023-45204

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-23-1576

SOURCES

db:ZDIid:ZDI-23-1576
db:CNVDid:CNVD-2023-75580
db:JVNDBid:JVNDB-2023-013978
db:NVDid:CVE-2023-45204

LAST UPDATE DATE

2024-08-14T13:19:43.860000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-1576date:2023-10-19T00:00:00
db:CNVDid:CNVD-2023-75580date:2023-10-11T00:00:00
db:JVNDBid:JVNDB-2023-013978date:2023-12-22T05:15:00
db:NVDid:CVE-2023-45204date:2023-10-12T00:44:00.243

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-1576date:2023-10-19T00:00:00
db:CNVDid:CNVD-2023-75580date:2023-10-11T00:00:00
db:JVNDBid:JVNDB-2023-013978date:2023-12-22T00:00:00
db:NVDid:CVE-2023-45204date:2023-10-10T11:15:13.080