Siemens SIMATIC PCS 7
At a glance
- Source
- NVD
- EPSS
- EPSS 1.00 % · percentile 63 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Modified
Description
A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7-PM (All versions < V5.7 SP2 HF1), SIMATIC STEP 7 V5 (All versions < V5.7). The affected product contains a database management system that could allow remote users with low privileges to use embedded functions of the database (local or in a network share) that have impact on the server. An attacker with network access to the server network could leverage these embedded functions to run code with elevated privileges in the database management system's server.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:T/RC:C | siemens |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · productcert@siemens.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-29798
- GCVE · GCVE-0-2023-25910
CERT-FR advisories
- CERTFR-2023-AVI-0453 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_s7-pm:*:*:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:*< 5.7
Affected products
| Product | Versions |
|---|---|
| Siemens · SIMATIC PCS 7 | affected 0 < V9.1 SP2 UC04 |
| Siemens · SIMATIC S7-PM | affected 0 < V5.7 SP1 HF1 |
| Siemens · SIMATIC S7-PM | affected 0 < V5.7 SP2 HF1 |
| Siemens · SIMATIC STEP 7 V5 | affected 0 < V5.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |