Yüksek CVSS 8.8
CVE-2023-28829: Simatic Net Pc Software: güvenlik açığı
Açıklama (NVD)
A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.
Özet bilgiler
- Ürün
- Siemens Simatic Net Pc Software
- CVSS v3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,29 (yüzdelik 22)
- CWE
- CWE-477
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| siemens-simatic-net-pc-software | 14.0 | 14.0 | — |
| siemens-simatic-net-pc-software | 15.0 | 15.0 | — |
| siemens-simatic-pcs-7 | 8.2 | 8.2 | — |
| siemens-simatic-pcs-7 | 9.0 | 9.0 | — |
| siemens-simatic-pcs-7 | 9.1 | 9.1 | — |
| siemens-simatic-wincc | — | — | 8.0 |
| siemens-sinaut-st7sc | — | — | — |