PT-2023-22152 · Siemens · Simatic Cloud Connect 7 Cc716+1

CVE-2023-29104 · Publicado 2023-05-09 · Atualizado 2023-05-15

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1

Description A path traversal vulnerability has been identified in the upload feature of the web-based management of the affected devices. This could allow an authenticated privileged remote attacker to overwrite any file the Linux user ccuser has write access to, or to download any file the Linux user ccuser has read-only access to.

Recommendations For SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1, update to a version outside of this range to mitigate the risk. For SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting the upload feature in the web-based management until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-29104

Produtos afetados

Simatic Cloud Connect 7 Cc712

Simatic Cloud Connect 7 Cc716

Referências · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-29104 · Aviso do Fabricante
• https://t.me/cibsecurity/63593 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29104 · Nota de Segurança