PT-2023-3391 · Unknown · Cp-8031 Master Module+1

Christian Hager + 5 · Publicado 2023-06-13 · Atualizado 2024-07-04 · CVE-2023-33919

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CP-8031 MASTER MODULE versions prior to CPCI85 V05 CP-8050 MASTER MODULE versions prior to CPCI85 V05

Description A vulnerability has been identified in the web interface of affected devices due to missing server-side input sanitation, making it vulnerable to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Recommendations For CP-8031 MASTER MODULE versions prior to CPCI85 V05, update to version CPCI85 V05 or later to resolve the issue. For CP-8050 MASTER MODULE versions prior to CPCI85 V05, update to version CPCI85 V05 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface of affected devices to minimize the risk of exploitation.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-03559

CVE-2023-33919

Produtos afetados

Cp-8031 Master Module

Cp-8050 Master Module

Referências · 11

• https://cert-portal.siemens.com/productcert/pdf/ssa-731916.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33919 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03559 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023061511 · Nota
• https://osv.dev/vulnerability/CVE-2023-33919 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2023/Jul/14 · Nota
• https://vuldb.com/?id.231317 · Nota
• http://seclists.org/fulldisclosure/2025/Feb/19 · Nota
• https://t.me/cibsecurity/65153 · Publicação no Telegram
• http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html · Nota
• http://seclists.org/fulldisclosure/2024/Jul/4 · Nota