PT-2023-7780 · Siemens · Opcenter Quality+4

Published 2023-12-12 · Updated 2024-10-08 · CVE-2023-46284

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Opcenter Execution Foundation versions prior to V2407 Opcenter Quality versions prior to V2312 SIMATIC PCS neo versions prior to V4.1 SINEC NMS versions prior to V2.0 SP1 Totally Integrated Automation Portal (TIA Portal) V14 Totally Integrated Automation Portal (TIA Portal) V15.1 Totally Integrated Automation Portal (TIA Portal) V16 Totally Integrated Automation Portal (TIA Portal) V17 versions prior to V17 Update 8 Totally Integrated Automation Portal (TIA Portal) V18 versions prior to V18 Update 3

Description The affected applications contain a vulnerability that allows an out of bounds write past the end of an allocated buffer when handling specific requests on port 4002/tcp and 4004/tcp. This could allow an attacker to crash the application, resulting in a denial of service. The corresponding service is auto-restarted after the crash. The issue is related to a buffer copy without checking the size of the input data, which can be exploited by a remote attacker.

Recommendations For Opcenter Execution Foundation versions prior to V2407, update to version V2407 or later. For Opcenter Quality versions prior to V2312, update to version V2312 or later. For SIMATIC PCS neo versions prior to V4.1, update to version V4.1 or later. For SINEC NMS versions prior to V2.0 SP1, update to version V2.0 SP1 or later. For Totally Integrated Automation Portal (TIA Portal) V14, consider upgrading to a later version with the fix. For Totally Integrated Automation Portal (TIA Portal) V15.1, consider upgrading to a later version with the fix. For Totally Integrated Automation Portal (TIA Portal) V16, consider upgrading to a later version with the fix. For Totally Integrated Automation Portal (TIA Portal) V17 versions prior to V17 Update 8, update to V17 Update 8 or later. For Totally Integrated Automation Portal (TIA Portal) V18 versions prior to V18 Update 3, update to V18 Update 3 or later. As a temporary workaround, consider restricting access to ports 4002/tcp and 4004/tcp to minimize the risk of exploitation.

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

BDU:2023-08847

CVE-2023-46284

Affected Products

Opcenter Execution Foundation

Opcenter Quality

Simatic Pcs Neo

Sinec Nms

Totally Integrated Automation Portal

References · 7

• https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46284 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46284 · Security Note
• https://bdu.fstec.ru/vul/2023-08847 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2023-12-15.1.pdf · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-999588.html · Note
• https://twitter.com/CVEnew/status/1734537930092216748 · Twitter Post