PT-2023-4690 · Unknown · Sicam Toolbox Ii

Published 2023-08-08 · Updated 2023-08-15 · CVE-2023-38641

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SICAM TOOLBOX II versions prior to V07.10

Description A vulnerability has been identified in the SICAM TOOLBOX II application, where the database service is executed as NT AUTHORITYSYSTEM. This could allow a local attacker to execute operating system commands with elevated privileges. The issue is related to access control errors, which may enable an attacker to execute arbitrary commands with increased privileges.

Recommendations For versions prior to V07.10, update to version V07.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the database service to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

BDU:2023-05110

CVE-2023-38641

Affected Products

Sicam Toolbox Ii

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-38641 · Security Note
• https://bdu.fstec.ru/vul/2023-05110 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38641 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2023080943 · Note
• https://twitter.com/cracbot/status/1689154679270498304 · Twitter Post
• https://vuldb.com/ru/?id.236412 · Note