CVE-2023-29130

Published Jul 11, 2023

Last updated 3 months ago

CVSS critical 9.9

Overview

Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper access controls in the configuration files that leads to privilege escalation. An attacker could gain admin access with this vulnerability leading to complete device control.
Source: productcert@siemens.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

productcert@siemens.com: CWE-284
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:siemens:simatic_cn_4100:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3F50C1C5-0934-44E6-A3F3-C473B6EA82F4",
            "versionEndExcluding": "2.5"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References