The vulnerability of web-servers of microprogramming software for devices such as SIMATIC CP, SIMATIC HMI, SIMATIC IPC, and SIMATIC WinCC Runtime Advanced DiagBase, as well as SIPLUS TIM, allows a perpetrator to cause service interruptions.

🗓️ 23 Oct 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Simatic web servers have variable name assignment errors enabling disruption by manipulating the Expect header.

Reporter	Title	Published	Views	Family All 11
CNNVD	Siemens SIMATIC 代码问题漏洞	10 Sep 202400:00	–	cnnvd
CNVD	Siemens Industrial Product Null Pointer Dereference Vulnerability (CNVD-2024-38015)	12 Sep 202400:00	–	cnvd
CVE	CVE-2023-30756	10 Sep 202409:33	–	cve
Cvelist	CVE-2023-30756	10 Sep 202409:33	–	cvelist
EUVD	EUVD-2023-35120	3 Oct 202520:07	–	euvd
ICS	Siemens SIMATIC, SIPLUS, and TIM	10 Sep 202400:00	–	ics
NCSC	Vulnerabilities fixed in Siemens products	10 Sep 202418:20	–	ncsc
NVD	CVE-2023-30756	10 Sep 202410:15	–	nvd
Positive Technologies	PT-2024-7079 · Siemens · Simatic Cp 1242-7 V2 +11	10 Sep 202400:00	–	ptsecurity
RedhatCVE	CVE-2023-30756	23 May 202505:31	–	redhatcve

Vulners

Node

siemens_ag simatic_cp_1242-7_v2Range<3.5.20

OR

siemens_ag simatic_cp_1243-1_dnp3Range<3.5.20

OR

siemens_ag simatic_cp_1243-1_iecRange<3.5.20

OR

siemens_ag simatic_cp_1243-7_lteRange<3.5.20

OR

siemens_ag simatic_cp_1243-1_ircRange<3.5.20

OR

siemens_ag simatic_cp_1243-8_ircRange<3.5.20

OR

siemens_ag siplus_tim_1531_ircRange<2.4.8

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-30756
developer	www.developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-423808.html
web	www.web.nvd.nist.gov/view/vuln/detail

23 Oct 2024 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 25.4

CVSS 35.9

EPSS0.00453

Simatic devices Variable name assignments Expect header Service disruption Siplus TIM Web servers