PT-2023-6998 · Siemens · Simatic Pcs Neo

Published 2023-11-14 · Updated 2023-11-20 · CVE-2023-46096

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC PCS neo versions prior to V4.1

Description The issue is related to a lack of authentication for a critical function in the administrative console of the SIMATIC PCS neo web system management technology process. This could allow a remote attacker to upload arbitrary documents. The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service, which could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents.

Recommendations For versions prior to V4.1, update to version V4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the PUD Manager web service to minimize the risk of exploitation. Avoid using the PUD Manager until the issue is resolved.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-08017

CVE-2023-46096

Affected Products

Simatic Pcs Neo

References · 7

• https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46096 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08017 · Security Note
• https://vuldb.com/ru/?id.245151 · Note
• https://twitter.com/VulmonFeeds/status/1724428295159140654 · Twitter Post
• https://twitter.com/CVEnew/status/1724387626558349357 · Twitter Post