Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Siemens Security Configuration Tool (SCT)

CVE-2023-46280
HIGH 8.2

En bref

Source
NVD
EPSS
EPSS 0.26 % · centile 18 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
siemens
Statut NVD
Deferred

Rechercher sur…

Description

A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 Upd5), SIMATIC NET PC Software V16 (All versions < V16 Update 8), SIMATIC NET PC Software V17 (All versions), SIMATIC NET PC Software V18 (All versions < V18 SP1), SIMATIC NET PC Software V19 (All versions < V19 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PDM V9.2 (All versions < V9.2 SP2 Upd3), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 Upd3), SIMATIC S7-PCT (All versions < V3.5 SP3 Update 6), SIMATIC STEP 7 V5 (All versions < V5.7 SP3), SIMATIC WinCC OA V3.17 (All versions), SIMATIC WinCC OA V3.18 (All versions < V3.18 P025), SIMATIC WinCC OA V3.19 (All versions < V3.19 P010), SIMATIC WinCC Runtime Advanced (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 6), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5), SINAMICS Startdrive (All versions < V19 SP1), SINEC NMS (All versions < V3.0), SINUMERIK ONE virtual (All versions < V6.23), SINUMERIK PLC Programming Tool (All versions < V3.3.12), TIA Portal Cloud Connector (All versions < V2.0), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 4), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 2), SINEC NMS (All versions < V3.0 SP1). The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.

Faiblesses (CWE)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csiemens
CVSS 4.0HIGH 8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Hsiemens
CVSS 4.0HIGH 8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · productcert@siemens.com (Secondary)
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HNVD · productcert@siemens.com (Secondary)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Siemens · Security Configuration Tool (SCT)affected 0 < *
Siemens · SIMATIC Automation Toolaffected 0 < V5.0 SP2
Siemens · SIMATIC BATCH V9.1affected 0 < V9.1 SP2 Upd5
Siemens · SIMATIC NET PC Software V16affected 0 < V16 Update 8
Siemens · SIMATIC NET PC Software V17affected 0 < *
Siemens · SIMATIC NET PC Software V18affected 0 < V18 SP1
Siemens · SIMATIC NET PC Software V19affected 0 < V19 Update 2
Siemens · SIMATIC PCS 7 V9.1affected 0 < V9.1 SP2 UC05
Siemens · SIMATIC PDM V9.2affected 0 < V9.2 SP2 Upd3
Siemens · SIMATIC Route Control V9.1affected 0 < V9.1 SP2 Upd3
Siemens · SIMATIC S7-PCTaffected 0 < V3.5 SP3 Update 6
Siemens · SIMATIC STEP 7 V5affected 0 < V5.7 SP3
Siemens · SIMATIC WinCC OA V3.17affected 0 < *
Siemens · SIMATIC WinCC OA V3.18affected 0 < V3.18 P025
Siemens · SIMATIC WinCC OA V3.19affected 0 < V3.19 P010
Siemens · SIMATIC WinCC Runtime Advancedaffected 0 < V17 Update 8
Siemens · SIMATIC WinCC Runtime Professional V16affected 0 < V16 Update 6
Siemens · SIMATIC WinCC Runtime Professional V17affected 0 < V17 Update 8
Siemens · SIMATIC WinCC Runtime Professional V18affected 0 < V18 Update 4
Siemens · SIMATIC WinCC Runtime Professional V19affected 0 < V19 Update 2

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD