CVE-2023-33921

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devices contain an exposed UART console login interface. An attacker with direct physical access could try to bruteforce or crack the root password to login to the device.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html
http://seclists.org/fulldisclosure/2023/Jul/14
https://cert-portal.siemens.com/productcert/pdf/ssa-731916.pdf	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:siemens:cpci85_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:cp-8050_master_module:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:siemens:cpci85_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:cp-8031_master_module:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-06-13 09:15

Updated : 2023-07-11 18:15

NVD link : CVE-2023-33921

Mitre link : CVE-2023-33921

CVE.ORG link : CVE-2023-33921

JSON object : View

Products Affected

siemens

cpci85_firmware
cp-8050_master_module
cp-8031_master_module

CWE

NVD-CWE-Other CWE-749

Exposed Dangerous Method or Function

{"id": "CVE-2023-33921", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2023-06-13T09:15:18.733", "references": [{"url": "http://packetstormsecurity.com/files/173370/Siemens-A8000-CP-8050-CP-8031-Code-Execution-Command-Injection.html", "source": "productcert@siemens.com"}, {"url": "http://seclists.org/fulldisclosure/2023/Jul/14", "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-731916.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-749"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devices contain an exposed UART console login interface. An attacker with direct physical access could try to bruteforce or crack the root password to login to the device."}], "lastModified": "2023-07-11T18:15:16.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:cpci85_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59D83EB4-A263-4070-A864-56EB7B120CE2", "versionEndExcluding": "v05"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:cp-8050_master_module:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E7686251-7011-46F9-9CEB-CC5DADCB5284"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:cpci85_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59D83EB4-A263-4070-A864-56EB7B120CE2", "versionEndExcluding": "v05"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:cp-8031_master_module:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E84CEC33-3B34-42EF-A698-164AF0343316"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "productcert@siemens.com"}