CVE-2023-29105

CVE-2023-29105 affects Siemens SIMATIC Cloud Connect 7 CC712/CC716 (V2.0–V2.1, including versions before V2.1) and is caused by a denial-of-service vulnerability when parsing a random non-JSON MQTT payload. An attacker capable of manipulating MQTT broker communications could trigger DoS on the af...

CVE-2023-29104

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

CVE-2023-29104

Summary: CVE-2023-29104 affects Siemens SIMATIC Cloud Connect 7 CC712 and CC716. The issue is a path traversal vulnerability in the upload feature of the device’s web-based management, allowing an authenticated privileged attacker to overwrite files that the ccuser Linux user can write to, or dow...

CVE-2023-29104

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

CVE-2023-29103

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1, SIMATIC Cloud Connect 7 CC716 All versions V2.1. The affected device uses a hard-coded password to protect the diagnostic files. This could allow an authenticated attacker to access protected dat...

CVE-2023-29103

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1, SIMATIC Cloud Connect 7 CC716 All versions V2.1. The affected device uses a hard-coded password to protect the diagnostic files. This could allow an authenticated attacker to access protected dat...

CVE-2023-29103

The CVE-2023-29103 entry concerns Siemens SIMATIC Cloud Connect 7 CC712/CC716 with versions 2.0–2.1, where a hard-coded password protects diagnostic files, enabling an authenticated attacker to access protected data. Red Hat and NVD entries corroborate the affected products and vulnerability clas...

CVE-2023-28832

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to...

CVE-2023-28832

Siemens SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00) and CC716 (6GK1411-5AC00) are affected for versions 2.0 to 2.1. The issue is a web-based management input validation flaw that enables command injection, allowing an authenticated privileged remote attacker to execute arbitrary code with root ...

CVE-2023-28832

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to...

PT-2023-22162 · Siemens · Simatic Cloud Connect 7 Cc712 +1

Name of the Vulnerable Software and Affected Versions: SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.0 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.0 Description: A path traversal vulnerability has been identified in the upload feature of the web-based management of the affected...

CVE-2023-29104: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in SIMATIC Cloud Connect, Siveillance, SINEC, Solid Edge and Scalance products. The vulnerabilities potentially enable a malicious party to launch attacks execute attacks that could result in the following categories of damage: Denial-of-Service DoS Manipulation ...

PT-2023-22154

Name of the Vulnerable Software and Affected Versions SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1 Description A vulnerability has been identified where the export endpoint is accessible via REST API without authentication. This cou...

Siemens SIMATIC Cloud Connect 信息泄露漏洞

SIMATIC Cloud Connect 7 is an IoT gateway for connecting programmable logic controllers to cloud services and allows field devices with OPC UA server interfaces to be connected as OPC UA clients. An information disclosure vulnerability exists in Siemens SIMATIC Cloud Connect 7, which can be...

CVE-2023-29106: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint...

CVE-2023-29128: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

CVE-2023-28832: Improper Neutralization of Special Elements used in a Command

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to...

PT-2023-21995 · Siemens · Simatic Cloud Connect 7 Cc712 +1

Name of the Vulnerable Software and Affected Versions: SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1 Description: A vulnerability has been identified where the web-based management of affected devices does not properly validate user...

CVE-2023-29107: Files or Directories Accessible to External Parties

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources...