Vulnerability · Published May 9, 2023 · Assigned by siemens
CVE-2023-28832
High 7.2
In plain English
A high-severity command injection in SIMATIC Cloud Connect 7 CC712 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Official description
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC Cloud Connect 7 CC712 | All versions >= V2.0 < V2.1 |
| Siemens | SIMATIC Cloud Connect 7 CC716 | All versions >= V2.0 < V2.1 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C