Log in Start free

Vulnerability · Published Oct 10, 2023 · Assigned by siemens

CVE-2023-36380

Critical 9.8

In plain English

A critical-severity hard-coded credentials in CP-8031 MASTER MODULE from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)). The affected devices contain a hard-coded ID in the SSH `authorized_keys` configuration file. An attacker with knowledge of the corresponding private key could login to the device via SSH. Only devices with activated debug support are affected.

Affected products (as reported)

VendorProductVersions
Siemens CP-8031 MASTER MODULE All versions < CPCI85 V05.11 (only with activated debug support)
Siemens CP-8050 MASTER MODULE All versions < CPCI85 V05.11 (only with activated debug support)

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

References