PT-2023-22152 · Siemens · Simatic Cloud Connect 7 Cc716+1

Published 2023-05-09 · Updated 2023-05-15 · CVE-2023-29104

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1

Description A path traversal vulnerability has been identified in the upload feature of the web-based management of the affected devices. This could allow an authenticated privileged remote attacker to overwrite any file the Linux user ccuser has write access to, or to download any file the Linux user ccuser has read-only access to.

Recommendations For SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1, update to a version outside of this range to mitigate the risk. For SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting the upload feature in the web-based management until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-29104

Affected Products

Simatic Cloud Connect 7 Cc712

Simatic Cloud Connect 7 Cc716

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29104 · Security Note
• https://t.me/cibsecurity/63593 · Telegram Post