PT-2023-4084 · Siemens · Simatic Cn 4100

Published 2023-07-11 · Updated 2023-07-18 · CVE-2023-29131

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to V2.5

Description A vulnerability has been identified in the SIMATIC CN 4100, related to an incorrect default value in the SSH configuration. This issue could allow an attacker to bypass network isolation. The vulnerability is associated with incorrect default access settings, which can be exploited by a remote attacker.

Recommendations For versions prior to V2.5, update to version V2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSH configuration to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2023-04384

CVE-2023-29131

Affected Products

Simatic Cn 4100

References · 6

• https://osv.dev/vulnerability/CVE-2023-29131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29131 · Security Note
• https://bdu.fstec.ru/vul/2023-04384 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-313488.pdf · Vendor Advisory
• https://t.me/cibsecurity/66357 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-194-03 · Note