Log in Start free

Vulnerability · Published Jan 9, 2024 · Assigned by siemens

CVE-2023-42797

Medium 6.6

In plain English

A medium-severity security flaw in CP-8031 MASTER MODULE from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network configuration service of affected devices contains a flaw in the conversion of ipv4 addresses that could lead to an uninitialized variable being used in succeeding validation steps. By uploading specially crafted network configuration, an authenticated remote attacker could be able to inject commands that are executed on the device with root privileges during device startup.

Affected products (as reported)

VendorProductVersions
Siemens CP-8031 MASTER MODULE All versions < CPCI85 V05.20
Siemens CP-8050 MASTER MODULE All versions < CPCI85 V05.20

Weakness: CWE-908 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

References