PT-2023-21995 · Siemens · Simatic Cloud Connect 7 Cc716+1

CVE-2023-28832 · Publicado 2023-05-09 · Atualizado 2023-05-15

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1

Description A vulnerability has been identified where the web-based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Recommendations For SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1, update to a version outside of this range to mitigate the risk. For SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2023-28832

Produtos afetados

Simatic Cloud Connect 7 Cc712

Simatic Cloud Connect 7 Cc716

Referências · 4

• https://t.me/cibsecurity/63606 · Publicação no Telegram
• https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28832 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28832 · Aviso do Fabricante