Sign-up

ID

VAR-202407-0475


CVE

CVE-2023-32737


TITLE

Siemens SIMATIC STEP Deserialization Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-35255

DESCRIPTION

A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300. Siemens SIMATIC STEP is a comprehensive engineering tool for configuring and programming SIMATIC controllers from Siemens, Germany

Trust: 1.44

sources: NVD: CVE-2023-32737 // CNVD: CNVD-2024-35255

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-35255

AFFECTED PRODUCTS

vendor:siemensmodel:totally integrated automation portalscope:eqversion:v18

Trust: 0.6

vendor:siemensmodel:totally integrated automation portalscope: - version: -

Trust: 0.6

vendor:siemensmodel:simatic stepscope:eqversion:v18

Trust: 0.6

sources: CNVD: CNVD-2024-35255

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2023-32737
value: HIGH

Trust: 1.0

CNVD: CNVD-2024-35255
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2024-35255
severity: MEDIUM
baseScore: 5.9
vectorString: AV:L/AC:H/AU:M/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: MULTIPLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 1.2
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

productcert@siemens.com: CVE-2023-32737
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.3
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-35255 // NVD: CVE-2023-32737

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.0

sources: NVD: CVE-2023-32737

PATCH

title:Patch for Siemens SIMATIC STEP Deserialization Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/576811

Trust: 0.6

sources: CNVD: CNVD-2024-35255

EXTERNAL IDS

db:SIEMENSid:SSA-313039

Trust: 1.6

db:NVDid:CVE-2023-32737

Trust: 1.6

db:CNVDid:CNVD-2024-35255

Trust: 0.6

sources: CNVD: CNVD-2024-35255 // NVD: CVE-2023-32737

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-313039.html

Trust: 1.6

sources: CNVD: CNVD-2024-35255 // NVD: CVE-2023-32737

SOURCES

db:CNVDid:CNVD-2024-35255
db:NVDid:CVE-2023-32737

LAST UPDATE DATE

2024-08-15T12:48:41.315000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-35255date:2024-08-13T00:00:00
db:NVDid:CVE-2023-32737date:2024-07-09T18:19:14.047

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-35255date:2024-08-13T00:00:00
db:NVDid:CVE-2023-32737date:2024-07-09T12:15:09.627