PT-2023-6260 · Siemens · Simatic Cp 1623+4

Published 2023-10-10 · Updated 2023-10-16 · CVE-2023-37194

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC CP 1604 (All versions) SIMATIC CP 1616 (All versions) SIMATIC CP 1623 (All versions) SIMATIC CP 1626 (All versions) SIMATIC CP 1628 (All versions)

Description A vulnerability has been identified that exposes kernel memory of affected devices to user-mode via direct memory access (DMA), potentially allowing a local attacker with administrative privileges to execute arbitrary code on the host system without restrictions. The issue is related to inadequate access control in the firmware of SIMATIC CP communication modules.

Recommendations For SIMATIC CP 1604, consider restricting access to the device until a patch is available. For SIMATIC CP 1616, restrict administrative privileges to minimize the risk of exploitation. For SIMATIC CP 1623, avoid using direct memory access (DMA) until the issue is resolved. For SIMATIC CP 1626, limit user-mode access to kernel memory as a temporary workaround. For SIMATIC CP 1628, disable any unnecessary features that may exploit the vulnerability until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-06969

CVE-2023-37194

Affected Products

Simatic Cp 1604

Simatic Cp 1616

Simatic Cp 1623

Simatic Cp 1626

Simatic Cp 1628

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-37194 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-784849.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06969 · Security Note
• https://t.me/cibsecurity/71903 · Telegram Post