PT-2023-8241 · Siemens · Simatic Cn 4100

Published 2023-11-24 · Updated 2024-01-11 · CVE-2023-49252

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to V2.7

Description A vulnerability has been identified that allows IP configuration changes without authentication to the device, potentially leading to a denial of service condition. The issue is related to insufficient input validation in the software of the communication gateway SIMATIC CN 4100. This could enable a remote attacker to modify the IP configuration and cause a denial of service.

Recommendations For versions prior to V2.7, update to version V2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to prevent unauthorized IP configuration changes. Avoid using the device without proper authentication until the issue is resolved.

Fix

RCE

Improper Resource Release

Weakness Enumeration

CWE-20

CWE-404

Related Identifiers

BDU:2024-00274

CVE-2023-49252

Affected Products

Simatic Cn 4100

References · 7

• https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49252 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00274 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-49252 · Security Note
• https://vuldb.com/ru/?id.250097 · Note
• https://twitter.com/VulmonFeeds/status/1744684911125045379 · Twitter Post
• https://twitter.com/CVEnew/status/1744664610979148044 · Twitter Post