Lucene search

SiemensCVELIST:CVE-2023-49251

HistoryJan 09, 2024 - 10:00 a.m.

CVE-2023-49251

2024-01-0910:00:08

CWE-639

siemens

www.cve.org

simatic cn 4100

vulnerability

unauthorized credential addition

remote login

root access

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

33.2%

JSON

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The “intermediate installation” system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up.

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "SIMATIC CN 4100",
    "versions": [
      {
        "version": "All versions < V2.7",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

33.2%

JSON

Related for CVELIST:CVE-2023-49251