Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Siemens SIMATIC Cloud Connect 7 CC712

CVE-2023-29105
MEDIUM 5.9

En bref

Source
NVD
EPSS
EPSS 0.55 % · centile 46 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
siemens
Statut NVD
Modified

Rechercher sur…

Description

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions < V2.1). The affected device is vulnerable to a denial of service while parsing a random (non-JSON) MQTT payload. This could allow an attacker who can manipulate the communication between the MQTT broker and the affected device to cause a denial of service (DoS).

Faiblesses (CWE)

  • CWE-544 — Missing Standardized Error Handling Mechanism

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csiemens
CVSS 3.1MEDIUM 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · productcert@siemens.com (Secondary)
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Siemens · SIMATIC Cloud Connect 7 CC712affected All versions >= V2.0 < V2.1
Siemens · SIMATIC Cloud Connect 7 CC712affected All versions < V2.1
Siemens · SIMATIC Cloud Connect 7 CC716affected All versions >= V2.0 < V2.1
Siemens · SIMATIC Cloud Connect 7 CC716affected All versions < V2.1

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD