PT-2023-22162 · Siemens · Simatic Cloud Connect 7 Cc716+1

CVE-2023-29128 · Publicado 2023-05-09 · Atualizado 2023-05-15

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.0 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.0

Description A path traversal vulnerability has been identified in the upload feature of the web-based management of the affected devices. This could allow an authenticated privileged remote attacker to write any file with the extension .db.

Recommendations For SIMATIC Cloud Connect 7 CC712 version 2.0, consider restricting access to the upload feature in the web-based management until a patch is available. For SIMATIC Cloud Connect 7 CC716 version 2.0, consider restricting access to the upload feature in the web-based management until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-29128

Produtos afetados

Simatic Cloud Connect 7 Cc712

Simatic Cloud Connect 7 Cc716

Referências · 3

• https://osv.dev/vulnerability/CVE-2023-29128 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-29128 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · Aviso do Fabricante