PT-2023-6999 · Siemens · Simatic Pcs Neo

Published 2023-11-14 · Updated 2023-11-20 · CVE-2023-46097

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC PCS neo versions prior to V4.1

Description A vulnerability has been identified in the PUD Manager of SIMATIC PCS neo, where it does not properly neutralize user-provided inputs. This could allow an authenticated adjacent attacker to execute SQL statements in the underlying database. The issue is related to the lack of protection against SQL query structure exploitation, which may enable a remote attacker to execute arbitrary SQL queries to the database.

Recommendations For versions prior to V4.1, update to version V4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the PUD Manager to minimize the risk of exploitation. Avoid using user-provided inputs in the affected SQL queries until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-08018

CVE-2023-46097

Affected Products

Simatic Pcs Neo

References · 7

• https://osv.dev/vulnerability/CVE-2023-46097 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08018 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46097 · Security Note
• https://twitter.com/VulmonFeeds/status/1724427533813215632 · Twitter Post
• https://twitter.com/CVEnew/status/1724387625501397267 · Twitter Post
• https://vuldb.com/ru/?id.245152 · Note