Sign-up

ID

VAR-202310-0250


CVE

CVE-2023-37195


TITLE

Resource Exhaustion Vulnerability in Multiple Siemens Products

Trust: 0.8

sources: JVNDB: JVNDB-2023-014726

DESCRIPTION

A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 1628 (All versions). Affected devices insufficiently control continuous mapping of direct memory access (DMA) requests. This could allow local attackers with administrative privileges to cause a denial of service situation on the host. A physical power cycle is required to get the system working again. SIMATIC CP 1604 firmware, SIMATIC CP 1616 firmware, simatic cp 1623 Multiple Siemens products such as firmware contain a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state. SIMATIC CP 1623, CP 1626 and CP 1628 are PCI express cards for connecting Industrial Ethernet. SIMATIC CP 1604 and CP 1616 are PCI/PCI-104 cards for connecting field devices to PROFINET Industrial Ethernet

Trust: 2.16

sources: NVD: CVE-2023-37195 // JVNDB: JVNDB-2023-014726 // CNVD: CNVD-2023-75575

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-75575

AFFECTED PRODUCTS

vendor:siemensmodel:simatic cp 1623scope:eqversion: -

Trust: 1.0

vendor:siemensmodel:simatic cp 1616scope:eqversion: -

Trust: 1.0

vendor:siemensmodel:simatic cp 1628scope:eqversion: -

Trust: 1.0

vendor:siemensmodel:simatic cp 1626scope:eqversion: -

Trust: 1.0

vendor:siemensmodel:simatic cp 1604scope:eqversion: -

Trust: 1.0

vendor:シーメンスmodel:simatic cp 1626scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic cp 1616scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic cp 1623scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic cp 1604scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic cp 1628scope: - version: -

Trust: 0.8

vendor:siemensmodel:simatic cpscope:eqversion:1604

Trust: 0.6

vendor:siemensmodel:simatic cpscope:eqversion:1616

Trust: 0.6

vendor:siemensmodel:simatic cpscope:eqversion:1623

Trust: 0.6

vendor:siemensmodel:simatic cpscope:eqversion:1626

Trust: 0.6

vendor:siemensmodel:simatic cpscope:eqversion:1628

Trust: 0.6

sources: CNVD: CNVD-2023-75575 // JVNDB: JVNDB-2023-014726 // NVD: CVE-2023-37195

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2023-37195
value: MEDIUM

Trust: 1.0

OTHER: JVNDB-2023-014726
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2023-75575
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2023-75575
severity: MEDIUM
baseScore: 4.7
vectorString: AV:L/AC:M/AU:N/C:N/I:N/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

productcert@siemens.com: CVE-2023-37195
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 3.6
version: 3.1

Trust: 1.0

OTHER: JVNDB-2023-014726
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-75575 // JVNDB: JVNDB-2023-014726 // NVD: CVE-2023-37195

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.0

problemtype:Resource exhaustion (CWE-400) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-014726 // NVD: CVE-2023-37195

PATCH

title:Patch for Siemens SIMATIC CP device resource consumption out of control vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/466716

Trust: 0.6

sources: CNVD: CNVD-2023-75575

EXTERNAL IDS

db:NVDid:CVE-2023-37195

Trust: 3.2

db:SIEMENSid:SSA-784849

Trust: 2.4

db:JVNid:JVNVU98753493

Trust: 0.8

db:ICS CERTid:ICSA-23-285-01

Trust: 0.8

db:JVNDBid:JVNDB-2023-014726

Trust: 0.8

db:CNVDid:CNVD-2023-75575

Trust: 0.6

sources: CNVD: CNVD-2023-75575 // JVNDB: JVNDB-2023-014726 // NVD: CVE-2023-37195

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-784849.pdf

Trust: 1.8

url:https://jvn.jp/vu/jvnvu98753493/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-37195

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-01

Trust: 0.8

url:https://cert-portal.siemens.com/productcert/html/ssa-784849.html

Trust: 0.6

sources: CNVD: CNVD-2023-75575 // JVNDB: JVNDB-2023-014726 // NVD: CVE-2023-37195

SOURCES

db:CNVDid:CNVD-2023-75575
db:JVNDBid:JVNDB-2023-014726
db:NVDid:CVE-2023-37195

LAST UPDATE DATE

2024-08-14T13:19:43.887000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-75575date:2023-10-11T00:00:00
db:JVNDBid:JVNDB-2023-014726date:2023-12-25T06:04:00
db:NVDid:CVE-2023-37195date:2023-10-16T18:31:17.237

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-75575date:2023-10-13T00:00:00
db:JVNDBid:JVNDB-2023-014726date:2023-12-25T00:00:00
db:NVDid:CVE-2023-37195date:2023-10-10T11:15:11.983