CVE-2023-28489

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter “Remote Operation” is enabled. The parameter is disabled by default. The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html
http://seclists.org/fulldisclosure/2023/Jul/14
https://cert-portal.siemens.com/productcert/pdf/ssa-472454.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:siemens:cp-8031:-:*:*:*:*:*:*:*

cpe:2.3:o:siemens:cp-8031_firmware:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:h:siemens:cp-8050:-:*:*:*:*:*:*:*

cpe:2.3:o:siemens:cp-8050_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-04-11 10:15

Updated : 2023-07-11 18:15

NVD link : CVE-2023-28489

Mitre link : CVE-2023-28489

CVE.ORG link : CVE-2023-28489

JSON object : View

Products Affected

siemens

cp-8050_firmware
cp-8050
cp-8031_firmware
cp-8031

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2023-28489", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-04-11T10:15:18.280", "references": [{"url": "http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html", "source": "productcert@siemens.com"}, {"url": "http://seclists.org/fulldisclosure/2023/Jul/14", "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-472454.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter \u201cRemote Operation\u201d is enabled. The parameter is disabled by default.\r\nThe vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device."}], "lastModified": "2023-07-11T18:15:12.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:cp-8031:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D24F9EDC-DA14-477D-B9C1-C9BF56E9B057"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:cp-8031_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA401321-A9D1-48B1-A1B3-219AE95C64AB", "versionEndExcluding": "cpci85_v05"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:cp-8050:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "929EF3DE-C8E6-49DA-98C0-13AB4C966AA7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:cp-8050_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE2E15ED-C2B8-4FBD-9B34-8FD0C73FAB8C", "versionEndExcluding": "cpci85_v05"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "productcert@siemens.com"}