Vulnerability in Siemens Simatic Net Pc Software
CVE-2023-28829
A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.
EPSS: 0.003 (21.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Siemens Simatic_net_pc_software — versions 14.0, 15.0
- Siemens Simatic Net Pc Software V14 — versions All versions
- Siemens Simatic Net Pc Software V15 — versions All versions
- Siemens Simatic_pcs_7 — versions 8.2, 9.0, 9.1
- Siemens Simatic Pcs 7 V8.2 — versions All versions
- Siemens Simatic Pcs 7 V9.0 — versions All versions
- Siemens Simatic Pcs 7 V9.1 — versions All versions
- Siemens Simatic Wincc — versions All versions < V8.0
- Siemens Simatic_wincc
- Siemens Sinaut Software St7sc — versions All versions
Weakness classification (CWE)
References
- productcert@siemens.com (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-28829?
- CVE-2023-28829 is a low-severity vulnerability in Siemens Simatic Net Pc Software, classified under CWE-477. CVSS score: 3.9/10. Published 2023-06-13.
- How severe is CVE-2023-28829?
- Low severity. CVSS v3 base score is 3.9 out of 10.