Multiple vulnerabilities in Siemens Industrial products
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2023-28827 CVE-2023-30755 CVE-2023-30756 |
| CWE-ID | CWE-476 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SIMATIC HMI Comfort Panels Server applications / SCADA systems SIMATIC IPC DiagBase Server applications / SCADA systems SIMATIC IPC DiagMonitor Server applications / SCADA systems SIMATIC WinCC Runtime Advanced Server applications / SCADA systems SIMATIC CP 1242-7 V2 Hardware solutions / Firmware SIMATIC CP 1243-1 Hardware solutions / Firmware SIMATIC CP 1243-1 DNP3 Hardware solutions / Firmware SIMATIC CP 1243-1 IEC Hardware solutions / Firmware SIMATIC CP 1243-7 LTE Hardware solutions / Firmware SIMATIC CP 1243-8 IRC Hardware solutions / Firmware SIPLUS TIM 1531 IRC Hardware solutions / Firmware TIM 1531 IRC Hardware solutions / Firmware |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) NULL pointer dereference
EUVDB-ID: #VU97429
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-28827
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the web server. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSIMATIC HMI Comfort Panels: All versions
SIMATIC IPC DiagBase: All versions
SIMATIC IPC DiagMonitor: All versions
SIMATIC WinCC Runtime Advanced: All versions
SIMATIC CP 1242-7 V2: before 3.5.20
SIMATIC CP 1243-1: before 3.5.20
SIMATIC CP 1243-1 DNP3: before 3.5.20
SIMATIC CP 1243-1 IEC: before 3.5.20
SIMATIC CP 1243-7 LTE: before 3.5.20
SIMATIC CP 1243-8 IRC: before 3.5.20
SIPLUS TIM 1531 IRC: before 2.4.8
TIM 1531 IRC: before 2.4.8
CPE2.3- cpe:2.3:a:siemens:simatic_hmi_comfort_panels:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_ipc_diagbase:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_ipc_diagmonitor:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1242-7_v2:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1_dnp3:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1_iec:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-7_lte:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-8_irc:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:siplus_tim_1531_irc:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:tim_1531_irc:*:*:*:*:*:*:*:
http://cert-portal.siemens.com/productcert/html/ssa-423808.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) NULL pointer dereference
EUVDB-ID: #VU97430
Risk: Low
CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-30755
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the web server. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSIMATIC HMI Comfort Panels: All versions
SIMATIC IPC DiagBase: All versions
SIMATIC IPC DiagMonitor: All versions
SIMATIC WinCC Runtime Advanced: All versions
SIMATIC CP 1242-7 V2: before 3.5.20
SIMATIC CP 1243-1: before 3.5.20
SIMATIC CP 1243-1 DNP3: before 3.5.20
SIMATIC CP 1243-1 IEC: before 3.5.20
SIMATIC CP 1243-7 LTE: before 3.5.20
SIMATIC CP 1243-8 IRC: before 3.5.20
SIPLUS TIM 1531 IRC: before 2.4.8
TIM 1531 IRC: before 2.4.8
CPE2.3- cpe:2.3:a:siemens:simatic_hmi_comfort_panels:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_ipc_diagbase:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_ipc_diagmonitor:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1242-7_v2:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1_dnp3:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1_iec:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-7_lte:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-8_irc:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:siplus_tim_1531_irc:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:tim_1531_irc:*:*:*:*:*:*:*:
http://cert-portal.siemens.com/productcert/html/ssa-423808.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) NULL pointer dereference
EUVDB-ID: #VU97431
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-30756
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the web server. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSIMATIC HMI Comfort Panels: All versions
SIMATIC IPC DiagBase: All versions
SIMATIC IPC DiagMonitor: All versions
SIMATIC WinCC Runtime Advanced: All versions
SIMATIC CP 1242-7 V2: before 3.5.20
SIMATIC CP 1243-1: before 3.5.20
SIMATIC CP 1243-1 DNP3: before 3.5.20
SIMATIC CP 1243-1 IEC: before 3.5.20
SIMATIC CP 1243-7 LTE: before 3.5.20
SIMATIC CP 1243-8 IRC: before 3.5.20
SIPLUS TIM 1531 IRC: before 2.4.8
TIM 1531 IRC: before 2.4.8
CPE2.3- cpe:2.3:a:siemens:simatic_hmi_comfort_panels:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_ipc_diagbase:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_ipc_diagmonitor:*:*:*:*:*:*:*:
- cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1242-7_v2:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1_dnp3:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-1_iec:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-7_lte:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:simatic_cp_1243-8_irc:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:siplus_tim_1531_irc:*:*:*:*:*:*:*:
- cpe:2.3:h:siemens:tim_1531_irc:*:*:*:*:*:*:*:
http://cert-portal.siemens.com/productcert/html/ssa-423808.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
