7.3
CVE-2023-32736
- EPSS 0.22%
- Published 12.11.2024 13:15:05
- Last modified 14.01.2025 11:15:12
- Source productcert@siemens.com
- Teams watchlist Login
- Open Login
A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 8), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 5), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 8), SIMATIC STEP 7 V18 (All versions < V18 Update 5), SIMATIC WinCC Unified V16 (All versions), SIMATIC WinCC Unified V17 (All versions < V17 Update 8), SIMATIC WinCC Unified V18 (All versions < V18 SP5), SIMATIC WinCC V16 (All versions), SIMATIC WinCC V17 (All versions < V17 Update 8), SIMATIC WinCC V18 (All versions < V18 SP5), SIMOCODE ES V16 (All versions), SIMOCODE ES V17 (All versions < V17 Update 8), SIMOCODE ES V18 (All versions), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions < V17 Update 8), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions < V17 Update 8), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), TIA Portal Cloud V16 (All versions), TIA Portal Cloud V17 (All versions < V4.6.0.1), TIA Portal Cloud V18 (All versions < V4.6.1.0). Affected products do not properly sanitize user-controllable input when parsing user settings. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Vendorsiemens
≫
Product
simatic_step_7
Default Statusunknown
Version <
17
Version
16
Status
affected
Version <
17_update8
Version
17
Status
affected
Version <
18_update5
Version
18
Status
affected
Vendorsiemens
≫
Product
simatic_step_7
Default Statusunknown
Version <
17
Version
16
Status
affected
Version <
17_update8
Version
17
Status
affected
Version <
18_update5
Version
18
Status
affected
Vendorsiemens
≫
Product
simatic_s7-plcsim
Default Statusunknown
Version <
17
Version
16
Status
affected
Version <
*
Version
17
Status
affected
Vendorsiemens
≫
Product
simatic_wincc
Default Statusunknown
Version <
17
Version
16
Status
affected
Version <
17_update8
Version
17
Status
affected
Version <
18_update5
Version
18
Status
affected
Vendorsiemens
≫
Product
simatic_wincc_unified
Default Statusunknown
Version <
17
Version
16
Status
affected
Version <
17_update8
Version
17
Status
affected
Version <
18_update5
Version
18
Status
affected
Vendorsiemens
≫
Product
simocode_es
Default Statusunknown
Version <
17
Version
16
Status
affected
Version <
17_update8
Version
17
Status
affected
Version <
*
Version
18
Status
affected
Vendorsiemens
≫
Product
simotion_scout_tia
Default Statusunknown
Version <
*
Version
v5.4sp1
Status
affected
Version <
*
Version
v5.4sp3
Status
affected
Version <
*
Version
v5.5sp1
Status
affected
Vendorsiemens
≫
Product
sinamics_startdrive
Default Statusunknown
Version <
17
Version
16
Status
affected
Version <
18
Version
17
Status
affected
Version <
*
Version
18
Status
affected
Vendorsiemens
≫
Product
sirius_safety_es
Default Statusunknown
Version <
17_update8
Version
0
Status
affected
Version <
*
Version
18
Status
affected
Vendorsiemens
≫
Product
tia_portal_cloud
Default Statusunknown
Version <
*
Version
16
Status
affected
Version <
*
Version
17
Status
affected
Version <
*
Version
18
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.22% | 0.45 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| productcert@siemens.com | 7 | 0 | 0 |
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| productcert@siemens.com | 7.3 | 1.3 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.