What is CVE-2023-38640?

CVE-2023-38640 is a medium-severity vulnerability in Siemens Sicam Pas/pqs, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.6/10. Published 2023-10-10.

How severe is CVE-2023-38640?

Medium severity. CVSS v3 base score is 6.6 out of 10.

Vulnerability in Siemens Sicam Pas/pqs

CVE-2023-38640

A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to read and modify configuration data in the context of the application process.

EPSS: 0.001 (4.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H.

Affected products

Siemens Sicam Pas/pqs — versions V8.00
Siemens Sicam_pas\/pqs

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

References

productcert@siemens.com (Patch, Vendor Advisory)
productcert@siemens.com

Frequently asked questions

What is CVE-2023-38640?: CVE-2023-38640 is a medium-severity vulnerability in Siemens Sicam Pas/pqs, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.6/10. Published 2023-10-10.
How severe is CVE-2023-38640?: Medium severity. CVSS v3 base score is 6.6 out of 10.