Input validation error in Siemens products - CVE-2023-45621
Published: February 14, 2024
Vulnerability identifier: #VU86518
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-45621
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the CLI service accessed via the PAPI protocol. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
SCALANCE W1750D (JP)
SCALANCE W1750D (ROW)
SCALANCE W1750D (USA)
Aruba InstantOS
ArubaOS (AOS)
SCALANCE W1750D (ROW)
SCALANCE W1750D (USA)
Aruba InstantOS
ArubaOS (AOS)
How to mitigate CVE-2023-45621
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Aruba InstantOS - addressed in versions 8.6.0.23, 8.10.0.9, 8.11.2.0
ArubaOS (AOS) - addressed in versions 10.4.0.3, 10.5.0.1
ArubaOS (AOS) - addressed in versions 10.4.0.3, 10.5.0.1