PT-2023-4084 · Siemens · Simatic Cn 4100

CVE-2023-29131 · Publicado 2023-07-11 · Atualizado 2023-07-18

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to V2.5

Description A vulnerability has been identified in the SIMATIC CN 4100, related to an incorrect default value in the SSH configuration. This issue could allow an attacker to bypass network isolation. The vulnerability is associated with incorrect default access settings, which can be exploited by a remote attacker.

Recommendations For versions prior to V2.5, update to version V2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSH configuration to minimize the risk of exploitation.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

BDU:2023-04384

CVE-2023-29131

Produtos afetados

Simatic Cn 4100

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-29131 · Aviso do Fabricante
• https://t.me/cibsecurity/66357 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29131 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-04384 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-23-194-03 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-313488.pdf · Aviso do Fabricante