Information disclosure in Siemens Simatic Pcs Neo
CVE-2023-38558
A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (6.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Siemens Simatic Pcs Neo — versions 4.0
- Siemens Simatic Pcs Neo (Administration Console) V4.0 — versions All versions
- Siemens Simatic Pcs Neo (Administration Console) V4.0 Update 1 — versions All versions
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-646240.pdf (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-38558?
- CVE-2023-38558 is a medium-severity vulnerability in Siemens Simatic Pcs Neo, classified under Insertion of Sensitive Information into Externally-Accessible File or Directory. CVSS score: 5.5/10. Published 2023-09-14.
- How severe is CVE-2023-38558?
- Medium severity. CVSS v3 base score is 5.5 out of 10.