Vulnerability in Siemens Opcenter Execution Foundation
CVE-2023-46281
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.
EPSS: 0.009 (58.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L.
Affected products
- Siemens Opcenter Execution Foundation — versions 0
- Siemens Opcenter Quality — versions 0
- Siemens Opcenter_quality
- Siemens Simatic Pcs Neo — versions 0
- Siemens Simatic_pcs_neo
- Siemens Sinec Nms — versions 0
- Siemens Sinumerik_integrate_runmyhmi_\/automotive
- Siemens Totally_integrated_automation_portal — versions 18
- Siemens Totally Integrated Automation Portal (Tia Portal) V14 — versions 0
- Siemens Totally Integrated Automation Portal (Tia Portal) V15.1 — versions 0
Weakness classification (CWE)
References
- productcert@siemens.com (Patch, Vendor Advisory)
- productcert@siemens.com
Frequently asked questions
- What is CVE-2023-46281?
- CVE-2023-46281 is a high-severity vulnerability in Siemens Opcenter Execution Foundation, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 7.1/10. Published 2023-12-12.
- How severe is CVE-2023-46281?
- High severity. CVSS v3 base score is 7.1 out of 10.