Multiple vulnerabilities in Siemens SIMATIC Cloud Connect 7

1) Use of Hard-coded Password

EUVDB-ID: #VU76011

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-29103

CWE-ID: CWE-259 - Use of Hard-coded Password

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected device uses a hard-coded password to protect the diagnostic files. A remote user can gain access to protected data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SIMATIC Cloud Connect 7 CC712: before 2.1

SIMATIC Cloud Connect 7 CC716: before 2.1

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Missing Standardized Error Handling Mechanism

EUVDB-ID: #VU76012

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-29105

CWE-ID: CWE-544 - Missing Standardized Error Handling Mechanism

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing standardized error handling mechanism while parsing a random (non-JSON) MQTT payload. A remote attacker can manipulate the communication between the MQTT broker and the affected device and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SIMATIC Cloud Connect 7 CC712: before 2.1

SIMATIC Cloud Connect 7 CC716: before 2.1

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Command Injection

EUVDB-ID: #VU76013

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28832

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web based management. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SIMATIC Cloud Connect 7 CC712: 2.0

SIMATIC Cloud Connect 7 CC716: 2.0

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Path traversal

EUVDB-ID: #VU76014

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-29104

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the filename in the upload feature. A remote administrator can send a specially crafted HTTP request and overwrite arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC Cloud Connect 7 CC712: 2.0

SIMATIC Cloud Connect 7 CC716: 2.0

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU76015

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-29106

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the export endpoint is accessible via REST API without authentication. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SIMATIC Cloud Connect 7 CC712: 2.0

SIMATIC Cloud Connect 7 CC716: 2.0

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Insufficiently protected credentials

EUVDB-ID: #VU76018

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-29107

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the export endpoint discloses some undocumented files. A remote attacker can gain access to additional information resources.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SIMATIC Cloud Connect 7 CC712: 2.0

SIMATIC Cloud Connect 7 CC716: 2.0

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Path traversal

EUVDB-ID: #VU76021

Risk: Low

CVSSv3.1: 3.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-29128

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the filename in the upload feature. A remote administrator can send a specially crafted HTTP request and write arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC Cloud Connect 7 CC716: 2.0

SIMATIC Cloud Connect 7 CC712: 2.0

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.