CVE-2023-51438

A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish® server is configured for remote system management, a vulnerability has been identified that can provide unauthorized access.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-702935.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:microchip:maxview_storage_manager:*:*:*:*:*:windows:*:*

OR	cpe:2.3:h:siemens:simatic_ipc1047e:-:::::::*
	cpe:2.3:h:siemens:simatic_ipc647e:-:::::::*
	cpe:2.3:h:siemens:simatic_ipc847e:-:::::::*

History

No history.

Information

Published : 2024-01-09 10:15

Updated : 2024-01-16 16:16

NVD link : CVE-2023-51438

Mitre link : CVE-2023-51438

CVE.ORG link : CVE-2023-51438

JSON object : View

Products Affected

microchip

maxview_storage_manager

siemens

simatic_ipc1047e
simatic_ipc847e
simatic_ipc647e

CWE

NVD-CWE-noinfo CWE-20

Improper Input Validation

{"id": "CVE-2023-51438", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2024-01-09T10:15:21.077", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-702935.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish\u00ae server is configured for remote system management, a vulnerability has been identified that can provide unauthorized access."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC IPC1047E (todas las versiones con maxView Storage Manager < V4.14.00.26068 en Windows), SIMATIC IPC647E (todas las versiones con maxView Storage Manager < V4.14.00.26068 en Windows), SIMATIC IPC847E (todas las versiones con maxView Storage Manager < V4.14.00.26068 en Windows). En instalaciones predeterminadas de maxView Storage Manager donde el servidor Redfish\u00ae est\u00e1 configurado para la administraci\u00f3n remota del sistema, se ha identificado una vulnerabilidad que puede proporcionar acceso no autorizado."}], "lastModified": "2024-01-16T16:16:21.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microchip:maxview_storage_manager:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "6AA7D140-D1C3-4B8A-A364-A24E4587B6E7", "versionEndExcluding": "4.14.00.26068"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_ipc1047e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "85F2895E-AFB0-4516-B549-93CCD5BB5814"}, {"criteria": "cpe:2.3:h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E430C4C5-D887-47C6-B50F-66EEE9519151"}, {"criteria": "cpe:2.3:h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1157418C-14C4-43C4-B63E-7E98D868A94F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "productcert@siemens.com"}