PT-2023-3391 · Unknown · Cp-8031 Master Module+1

Christian Hager + 5 · Published 2023-06-13 · Updated 2024-07-04 · CVE-2023-33919

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CP-8031 MASTER MODULE versions prior to CPCI85 V05 CP-8050 MASTER MODULE versions prior to CPCI85 V05

Description A vulnerability has been identified in the web interface of affected devices due to missing server-side input sanitation, making it vulnerable to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Recommendations For CP-8031 MASTER MODULE versions prior to CPCI85 V05, update to version CPCI85 V05 or later to resolve the issue. For CP-8050 MASTER MODULE versions prior to CPCI85 V05, update to version CPCI85 V05 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface of affected devices to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-03559

CVE-2023-33919

Affected Products

Cp-8031 Master Module

Cp-8050 Master Module

References · 11

• https://cert-portal.siemens.com/productcert/pdf/ssa-731916.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33919 · Security Note
• https://bdu.fstec.ru/vul/2023-03559 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33919 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2023061511 · Note
• http://seclists.org/fulldisclosure/2023/Jul/14 · Note
• https://vuldb.com/?id.231317 · Note
• http://seclists.org/fulldisclosure/2025/Feb/19 · Note
• https://t.me/cibsecurity/65153 · Telegram Post
• http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html · Note
• http://seclists.org/fulldisclosure/2024/Jul/4 · Note