Lucene search

SiemensCVE-2023-49251

HistoryJan 09, 2024 - 10:15 a.m.

CVE-2023-49251

2024-01-0910:15:19

CWE-639

siemens

web.nvd.nist.gov

simatic

cn 4100

vulnerability

unauthenticated access

remote login

root access

nvd

cve-2023-49251

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

33.2%

JSON

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The “intermediate installation” system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up.

Affected configurations

Nvd

Node

siemenssimatic_cn_4100Range<2.7

VendorProductVersionCPE
siemenssimatic_cn_4100*cpe:2.3:a:siemens:simatic_cn_4100:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	simatic_cn_4100	*	cpe:2.3:a:siemens:simatic_cn_4100::::::::

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "SIMATIC CN 4100",
    "versions": [
      {
        "version": "All versions < V2.7",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

33.2%

JSON

Related for CVE-2023-49251