PT-2023-8243 · Siemens · Simatic Cn 4100

CVE-2023-49251 · Publicado 2023-11-24 · Atualizado 2024-01-12

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to V2.7

Description A vulnerability has been identified that allows an attacker to add their own login credentials to the device during the "intermediate installation" system state. This enables the attacker to remotely login as root and take control of the device even after it is fully set up. The issue is related to bypassing authorization using a user-controlled key, which can allow a remote attacker to enter the system and gain full control over the application.

Recommendations For versions prior to V2.7, update to version V2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the device during the "intermediate installation" state to minimize the risk of exploitation.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

BDU:2024-00276

CVE-2023-49251

Produtos afetados

Simatic Cn 4100

Referências · 7

• https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf · Aviso do Fabricante
• https://vuldb.com/?id.250083 · Nota
• https://twitter.com/CVEnew/status/1744670230587101626 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2024-00276 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-49251 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49251 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1744691254577783063 · Publicação no Twitter