PT-2023-21995 · Siemens · Simatic Cloud Connect 7 Cc716+1

Published 2023-05-09 · Updated 2023-05-15 · CVE-2023-28832

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1

Description A vulnerability has been identified where the web-based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Recommendations For SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1, update to a version outside of this range to mitigate the risk. For SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-28832

Affected Products

Simatic Cloud Connect 7 Cc712

Simatic Cloud Connect 7 Cc716

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28832 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28832 · Vendor Advisory
• https://t.me/cibsecurity/63606 · Telegram Post