Vulnerability · Published Apr 11, 2023 · Assigned by siemens
CVE-2023-26293
High 7.3
In plain English
A high-severity improper input validation in Totally Integrated Automation Portal (TIA Portal) V15 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Totally Integrated Automation Portal (TIA Portal) V15 | 0 – before * |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V16 | 0 – before V16 Update 7 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V17 | 0 – before V17 Update 6 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V18 | 0 – before V18 Update 1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C