What is CVE-2023-38558?

CVE-2023-38558 is a medium-severity vulnerability in Siemens Simatic Pcs Neo, classified under Insertion of Sensitive Information into Externally-Accessible File or Directory. CVSS score: 5.5/10. Published 2023-09-14.

How severe is CVE-2023-38558?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Information disclosure in Siemens Simatic Pcs Neo

CVE-2023-38558

A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems.

EPSS: 0.002 (6.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Siemens Simatic_pcs_neo — versions 4.0
Siemens Simatic Pcs Neo (Administration Console) V4.0 — versions All versions
Siemens Simatic Pcs Neo (Administration Console) V4.0 Update 1 — versions All versions

Weakness classification (CWE)

References

productcert@siemens.com (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2023-38558?: CVE-2023-38558 is a medium-severity vulnerability in Siemens Simatic Pcs Neo, classified under Insertion of Sensitive Information into Externally-Accessible File or Directory. CVSS score: 5.5/10. Published 2023-09-14.
How severe is CVE-2023-38558?: Medium severity. CVSS v3 base score is 5.5 out of 10.