PT-2023-21099 · Siemens · Scalance Lpe9403

Published 2023-05-09 · Updated 2023-05-15 · CVE-2023-27410

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions SCALANCE LPE9403 versions prior to V2.1

Description A heap-based buffer overflow issue was found in the edgebox web app binary. This occurs when a backup password longer than 255 characters is supplied, causing the binary to crash. An authenticated privileged attacker could exploit this to cause a denial of service.

Recommendations For SCALANCE LPE9403 versions prior to V2.1, update to version V2.1 or later to resolve the issue. As a temporary workaround, consider restricting the length of backup passwords to 255 characters or less to prevent the binary from crashing.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2023-27410

Affected Products

Scalance Lpe9403

References · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27410 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27410 · Vendor Advisory