PT-2023-3379 · Siemens · Cp-8031 Master Module+1

Christian Hager

+5

·

Published

2023-06-13

·

Updated

2023-07-11

·

CVE-2023-33921

CVSS v2.0

7.2

High

VectorAV:L/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions CP-8031 MASTER MODULE versions prior to CPCI85 V05 CP-8050 MASTER MODULE versions prior to CPCI85 V05
Description A vulnerability has been identified that involves an exposed UART console login interface. This issue could allow an attacker with direct physical access to attempt bruteforcing or cracking the root password to gain login access to the device. The vulnerability is related to the web server software of the Siemens SICAM processor control modules, specifically affecting the CP-8031 and CP-8050 models. Exploitation of this vulnerability may enable an attacker to elevate their privileges to the root level.
Recommendations For CP-8031 MASTER MODULE versions prior to CPCI85 V05, consider restricting physical access to the device to prevent potential bruteforcing or password cracking attempts until a patch or update is available. For CP-8050 MASTER MODULE versions prior to CPCI85 V05, consider restricting physical access to the device to prevent potential bruteforcing or password cracking attempts until a patch or update is available. As a temporary workaround, consider disabling the UART console login interface on both CP-8031 and CP-8050 MASTER MODULEs to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-749

Related Identifiers

BDU:2023-03543
CVE-2023-33921

Affected Products

Cp-8031 Master Module
Cp-8050 Master Module