CVE-2023-48363

Опубликовано: 13 фев. 2024

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 Update 4). The implementation of the RPC (Remote Procedure call) communication protocol in the affected products do not properly handle certain unorganized RPC messages. An attacker could use this vulnerability to cause a denial of service condition in the RPC server.

Ссылки

https://cert-portal.siemens.com/productcert/html/ssa-753746.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-753746.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:openpcs_7:*:*:*:*:*:*:*:*

Версия до 9.1 (включая)

cpe:2.3:a:siemens:simatic_batch:*:*:*:*:*:*:*:*

Версия до 9.1 (включая)

cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*

Версия до 9.1 (включая)

cpe:2.3:a:siemens:simatic_route_control:*:*:*:*:*:*:*:*

Версия до 9.1 (включая)

cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*

cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*

cpe:2.3:a:siemens:simatic_wincc:8.0:*:*:*:*:*:*:*

cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*

Версия до 18 (включая)

cpe:2.3:a:siemens:simatic_wincc_runtime_professional:19:*:*:*:*:*:*:*

EPSS

Процентиль: 27%

0.00094

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-476

Связанные уязвимости

GHSA-q3m2-hxcv-vxp6

CVSS3: 6.5

github

почти 2 года назад

A vulnerability has been identified in OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 SP4). The implementation of the RPC (Remote Procedure call) communication protocol in the affected products do not properly handle certain unorganized RPC messages. An attacker could use this vulnerability to cause a denial of service condition in the RPC server.

BDU:2024-02886

CVSS3: 6.5

fstec

почти 2 года назад

Уязвимость реализации протокола RPC (Remote Procedure call) систем управления процессами Siemens SIMATIC PCS 7, OpenPCS 7 и SCADA-системы Siemens SIMATIC WinCC, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 27%

0.00094

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-476