PT-2023-5169 · Siemens · Spectrum Power 7

Published 2023-09-14 · Updated 2023-09-21 · CVE-2023-38557

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spectrum Power 7 versions prior to V23Q3

Description The issue is related to the improper assignment of access rights to a critical resource, specifically the update script. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.

Recommendations For versions prior to V23Q3, update to version V23Q3 or later to resolve the issue. As a temporary workaround, consider restricting access to the update script to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2023-05761

CVE-2023-38557

Affected Products

Spectrum Power 7

References · 7

• https://cert-portal.siemens.com/productcert/pdf/ssa-357182.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38557 · Security Note
• https://bdu.fstec.ru/vul/2023-05761 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38557 · Vendor Advisory
• https://twitter.com/cracbot/status/1702562942141812925 · Twitter Post
• https://vuldb.com/ru/?id.239727 · Note
• https://t.me/cibsecurity/70438 · Telegram Post