PT-2023-8242 · Siemens · Simatic Cn 4100

CVE-2023-49621 · Publicado 2023-11-28 · Atualizado 2024-01-17

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to V2.7

Description A vulnerability has been identified in the intermediate installation process of the SIMATIC CN 4100 communication gateway, which is related to the use of default credentials with admin privileges. This could allow a remote attacker to gain complete control of the affected device.

Recommendations For versions prior to V2.7, update to version V2.7 or later to resolve the issue. As a temporary workaround, consider changing the default credentials to custom ones to prevent exploitation. Restrict access to the intermediate installation system state to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-1392

CWE-255

Identificadores relacionados

BDU:2024-00275

CVE-2023-49621

Produtos afetados

Simatic Cn 4100

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-49621 · Nota de Segurança
• https://twitter.com/the_yellow_fall/status/1747812449779360177 · Publicação no Twitter
• https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf · Aviso do Fabricante
• https://twitter.com/vuldb/status/1744707609389850669 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1744685923223118064 · Publicação no Twitter
• https://vuldb.com/ru/?id.250098 · Nota
• https://osv.dev/vulnerability/CVE-2023-49621 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-00275 · Nota de Segurança
• https://twitter.com/CVEnew/status/1744664609901125787 · Publicação no Twitter