Vulnerability in Siemens Qms Automotive
CVE-2023-40728
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensitive application data in an external insecure storage. This could allow an attacker to alter content, leading to arbitrary code execution or denial-of-service condition.
EPSS: 0.002 (8.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L.
Affected products
- Siemens Qms Automotive — versions All versions < V12.39
- Siemens Qms_automotive
Weakness classification (CWE)
Public proof-of-concept exploits
References
- productcert@siemens.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-40728?
- CVE-2023-40728 is a high-severity vulnerability in Siemens Qms Automotive, classified under CWE-922. CVSS score: 7.3/10. Published 2023-09-12.
- How severe is CVE-2023-40728?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2023-40728 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.