CVE-2023-29128

The CVE-2023-29128 vulnerability affects SIMATIC Cloud Connect 7 CC712 (versions 2.0–2.0, up to 2.1) and CC716 (versions 2.0–2.1). The issue is a path traversal vulnerability in the upload feature of the web-based management interface, enabling an authenticated privileged remote attacker to write...

CVE-2023-29128

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

CVE-2023-29107

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources...

CVE-2023-29107

Siemens SIMATIC Cloud Connect 7 CC712 (versions 2.0–2.1) and CC716 (versions 2.0–2.1) disclose undocumented files via the export endpoint, allowing an unauthenticated remote attacker to access additional information resources. The issue is caused by an information-disclosure weakness in the expor...

CVE-2023-29107

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources...

CVE-2023-29106

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint...

CVE-2023-29106

CVE-2023-29106 affects SIMATIC Cloud Connect 7 CC712/CC716 (V2.0 to V2.1). An export endpoint exposed via REST API without authentication could allow an unauthenticated remote attacker to download files available through the endpoint, per multiple sources (NVD/Red Hat/NCSC advisories). The Red Ha...

CVE-2023-29106

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint...

CVE-2023-29105

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1, SIMATIC Cloud Connect 7 CC716 All versions V2.1. The affected device is vulnerable to a denial of service while parsing a random non-JSON MQTT payload. This could allow an attacker who can...

CVE-2023-29105

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1, SIMATIC Cloud Connect 7 CC716 All versions V2.1. The affected device is vulnerable to a denial of service while parsing a random non-JSON MQTT payload. This could allow an attacker who can...

CVE-2023-29105

CVE-2023-29105 affects Siemens SIMATIC Cloud Connect 7 CC712/CC716 (V2.0–V2.1, including versions before V2.1) and is caused by a denial-of-service vulnerability when parsing a random non-JSON MQTT payload. An attacker capable of manipulating MQTT broker communications could trigger DoS on the af...

CVE-2023-29104

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

CVE-2023-29104

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

CVE-2023-29104

Summary: CVE-2023-29104 affects Siemens SIMATIC Cloud Connect 7 CC712 and CC716. The issue is a path traversal vulnerability in the upload feature of the device’s web-based management, allowing an authenticated privileged attacker to overwrite files that the ccuser Linux user can write to, or dow...

CVE-2023-29103

The CVE-2023-29103 entry concerns Siemens SIMATIC Cloud Connect 7 CC712/CC716 with versions 2.0–2.1, where a hard-coded password protects diagnostic files, enabling an authenticated attacker to access protected data. Red Hat and NVD entries corroborate the affected products and vulnerability clas...

CVE-2023-29103

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1, SIMATIC Cloud Connect 7 CC716 All versions V2.1. The affected device uses a hard-coded password to protect the diagnostic files. This could allow an authenticated attacker to access protected dat...

CVE-2023-29103

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1, SIMATIC Cloud Connect 7 CC716 All versions V2.1. The affected device uses a hard-coded password to protect the diagnostic files. This could allow an authenticated attacker to access protected dat...

CVE-2023-28832

Siemens SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00) and CC716 (6GK1411-5AC00) are affected for versions 2.0 to 2.1. The issue is a web-based management input validation flaw that enables command injection, allowing an authenticated privileged remote attacker to execute arbitrary code with root ...

CVE-2023-28832

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to...

CVE-2023-28832

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to...