PT-2023-3371 · Siemens · Simatic S7-Pm+2

Thomas Riedmaier · Publicado 2023-06-13 · Atualizado 2024-05-14 · CVE-2023-25910

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC PCS 7 versions prior to V9.1 SP2 UC04 SIMATIC S7-PM versions prior to V5.7 SP1 HF1 SIMATIC S7-PM versions prior to V5.7 SP2 HF1 SIMATIC STEP 7 V5 versions prior to V5.7

Description A vulnerability has been identified in the affected products, which contain a database management system that could allow remote users with low privileges to use embedded functions of the database, potentially impacting the server. An attacker with network access to the server network could leverage these embedded functions to run code with elevated privileges in the database management system's server. The issue is related to incorrect code generation management.

Recommendations For SIMATIC PCS 7 versions prior to V9.1 SP2 UC04, update to V9.1 SP2 UC04 or later. For SIMATIC S7-PM versions prior to V5.7 SP1 HF1, update to V5.7 SP1 HF1 or later. For SIMATIC S7-PM versions prior to V5.7 SP2 HF1, update to V5.7 SP2 HF1 or later. For SIMATIC STEP 7 V5 versions prior to V5.7, update to V5.7 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2023-03527

CVE-2023-25910

Produtos afetados

Simatic Pcs 7

Simatic S7-Pm

Simatic Step 7 V5

Referências · 7

• https://cybersecurity-help.cz/vdb/SB2023061509 · Nota
• https://vuldb.com/?id.231344 · Nota
• https://bdu.fstec.ru/vul/2023-03527 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-968170.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25910 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/html/ssa-968170.html · Nota
• https://osv.dev/vulnerability/CVE-2023-25910 · Aviso do Fabricante