PT-2024-1007 · Siemens · Simatic Ipc847E+3

Published 2024-01-09 · Updated 2024-01-17 · CVE-2023-51438

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC IPC1047E versions with maxView Storage Manager prior to V4.14.00.26068 SIMATIC IPC647E versions with maxView Storage Manager prior to V4.14.00.26068 SIMATIC IPC847E versions with maxView Storage Manager prior to V4.14.00.26068

Description A vulnerability has been identified in the maxView Storage Manager of SIMATIC IPC devices, which can provide unauthorized access when the Redfish server is configured for remote system management. The issue is related to errors in processing input data, allowing a remote attacker to gain full unauthorized access to the device.

Recommendations For SIMATIC IPC1047E with maxView Storage Manager prior to V4.14.00.26068, update maxView Storage Manager to version V4.14.00.26068 or later. For SIMATIC IPC647E with maxView Storage Manager prior to V4.14.00.26068, update maxView Storage Manager to version V4.14.00.26068 or later. For SIMATIC IPC847E with maxView Storage Manager prior to V4.14.00.26068, update maxView Storage Manager to version V4.14.00.26068 or later. As a temporary workaround, consider disabling the Redfish server for remote system management until the maxView Storage Manager is updated.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-00115

CVE-2023-51438

Affected Products

Simatic Ipc1047E

Simatic Ipc647E

Simatic Ipc847E

Maxview Storage Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-51438 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-702935.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00115 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51438 · Vendor Advisory
• https://twitter.com/CVEnew/status/1744664608827473986 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1747812449779360177 · Twitter Post
• https://twitter.com/vuldb/status/1744707610794992064 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1744685417092260010 · Twitter Post