CVE-2023-49621

{"id": "CVE-2023-49621", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-01-09T10:15:20.503", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-1392"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The \"intermediate installation\" system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control of the affected device."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC CN 4100 (todas las versiones &lt; V2.7). El estado del sistema de \"intermediate installation\" de la aplicaci\u00f3n afectada utiliza la credencial predeterminada con privilegios de administrador. Un atacante podr\u00eda utilizar las credenciales para obtener el control total del dispositivo afectado."}], "lastModified": "2024-01-11T22:46:50.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:simatic_cn_4100:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8B14973-F641-462C-8DC5-810D7956A123", "versionEndExcluding": "2.7"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}