A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These
services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdf | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
05 Jul 2023, 17:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Siemens simatic Pcs 7
Siemens sinaut St7sc Siemens simatic Wincc Siemens Siemens simatic Net Pc Software |
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:siemens:sinaut_st7sc:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:simatic_net_pc_software:15.0:*:*:*:*:*:*:* cpe:2.3:a:siemens:simatic_pcs_7:8.2:-:*:*:*:*:*:* cpe:2.3:a:siemens:simatic_pcs_7:9.1:-:*:*:*:*:*:* cpe:2.3:a:siemens:simatic_pcs_7:9.0:-:*:*:*:*:*:* cpe:2.3:a:siemens:simatic_net_pc_software:14.0:*:*:*:*:*:*:* |
|
| References | (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdf - Patch, Vendor Advisory |
13 Jun 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-13 09:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-28829
Mitre link : CVE-2023-28829
CVE.ORG link : CVE-2023-28829
JSON object : View
Products Affected
siemens
- sinaut_st7sc
- simatic_net_pc_software
- simatic_wincc
- simatic_pcs_7
CWE