Vulnerability · Published Jun 13, 2023 · Assigned by siemens
CVE-2023-28829
Low 3.9
In plain English
A low-severity security flaw in SIMATIC NET PC Software V14 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC NET PC Software V14 | All versions |
| Siemens | SIMATIC NET PC Software V15 | All versions |
| Siemens | SIMATIC PCS 7 V8.2 | All versions |
| Siemens | SIMATIC PCS 7 V9.0 | All versions |
| Siemens | SIMATIC PCS 7 V9.1 | All versions |
| Siemens | SIMATIC WinCC | All versions < V8.0 |
| Siemens | SINAUT Software ST7sc | All versions |
Weakness: CWE-477 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C