CVE-2023-28489

🗓️ 11 Apr 2023 09:03:04Reported by siemensType

cve🔗 web.nvd.nist.gov👁 102 Views🌐 WEB

Vulnerability in CP-8031 and CP-8050 Master Modules allows remote code executio

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2023-28489	11 Apr 202314:23	–	circl
CNNVD	Siemens SICAM A8000 命令注入漏洞	11 Apr 202300:00	–	cnnvd
CNVD	Siemens SICAM A8000 Command Injection Vulnerability	16 Apr 202300:00	–	cnvd
Cvelist	CVE-2023-28489	11 Apr 202309:03	–	cvelist
EUVD	EUVD-2023-32159	3 Oct 202520:07	–	euvd
ICS	Siemens CPCI85 Firmware of SICAM A8000 Devices	11 Apr 202300:00	–	ics
NCSC	Vulnerabilities fixed in Siemens products	11 Apr 202300:00	–	ncsc
NVD	CVE-2023-28489	11 Apr 202310:15	–	nvd
OSV	CVE-2023-28489	11 Apr 202310:15	–	osv
Packet Storm	Siemens A8000 CP-8050 / CP-8031 Code Execution / Command Injection	11 Jul 202300:00	–	packetstorm

NVD

Node

siemens cp-8031_firmwareRange<cpci85_v05

AND

siemens cp-8031Match-

Node

siemens cp-8050_firmwareRange<cpci85_v05

AND

siemens cp-8050Match-

[
  {
    "vendor": "Siemens",
    "product": "CP-8031 MASTER MODULE",
    "versions": [
      {
        "version": "All versions < CPCI85 V05",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "CP-8050 MASTER MODULE",
    "versions": [
      {
        "version": "All versions < CPCI85 V05",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
seclists	www.seclists.org/fulldisclosure/2023/Jul/14
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-472454.pdf
packetstormsecurity	www.packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html

Parameter	Position	Path	Description	CWE
p0	request body	/sicweb-ajax/rtum85/cview	Authenticated command injection via SICAM WEB interface capturing configuration field.	CWE-77

21 Nov 2024 07:55Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.02697

SSVC

CWE-77