Lucene search

[email protected]NVD:CVE-2023-28829

HistoryJun 13, 2023 - 9:15 a.m.

CVE-2023-28829

2023-06-1309:15:16

CWE-477

[email protected]

web.nvd.nist.gov

vulnerability

simatic net pc software

simatic pcs 7

opc services

windows activex

dcom

authentication

encryption

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

25.4%

JSON

A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These
services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.

Affected configurations

Nvd

Node

siemenssimatic_net_pc_softwareMatch14.0

siemenssimatic_net_pc_softwareMatch15.0

siemenssimatic_pcs_7Match8.2-

siemenssimatic_pcs_7Match9.0-

siemenssimatic_pcs_7Match9.1-

siemenssimatic_winccRange<8.0

siemenssinaut_st7sc

VendorProductVersionCPE
siemenssimatic_net_pc_software14.0cpe:2.3:a:siemens:simatic_net_pc_software:14.0:*:*:*:*:*:*:*
siemenssimatic_net_pc_software15.0cpe:2.3:a:siemens:simatic_net_pc_software:15.0:*:*:*:*:*:*:*
siemenssimatic_pcs_78.2cpe:2.3:a:siemens:simatic_pcs_7:8.2:-:*:*:*:*:*:*
siemenssimatic_pcs_79.0cpe:2.3:a:siemens:simatic_pcs_7:9.0:-:*:*:*:*:*:*
siemenssimatic_pcs_79.1cpe:2.3:a:siemens:simatic_pcs_7:9.1:-:*:*:*:*:*:*
siemenssimatic_wincc*cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*
siemenssinaut_st7sc*cpe:2.3:a:siemens:sinaut_st7sc:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	simatic_net_pc_software	14.0	cpe:2.3:a:siemens:simatic_net_pc_software:14.0:::::::*
siemens	simatic_net_pc_software	15.0	cpe:2.3:a:siemens:simatic_net_pc_software:15.0:::::::*
siemens	simatic_pcs_7	8.2	cpe:2.3:a:siemens:simatic_pcs_7:8.2:-::::::
siemens	simatic_pcs_7	9.0	cpe:2.3:a:siemens:simatic_pcs_7:9.0:-::::::
siemens	simatic_pcs_7	9.1	cpe:2.3:a:siemens:simatic_pcs_7:9.1:-::::::
siemens	simatic_wincc	*	cpe:2.3:a:siemens:simatic_wincc::::::::
siemens	sinaut_st7sc	*	cpe:2.3:a:siemens:sinaut_st7sc::::::::