A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf | Patch Vendor Advisory |
Configurations
History
15 May 2023, 18:49
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Siemens 6gk1411-5ac00
Siemens 6gk1411-5ac00 Firmware Siemens Siemens 6gk1411-1ac00 Firmware Siemens 6gk1411-1ac00 |
|
| References | (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf - Patch, Vendor Advisory | |
| CPE | cpe:2.3:h:siemens:6gk1411-1ac00:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:6gk1411-1ac00_firmware:2.0:*:*:*:*:*:*:* cpe:2.3:o:siemens:6gk1411-5ac00_firmware:2.0:*:*:*:*:*:*:* cpe:2.3:h:siemens:6gk1411-5ac00:-:*:*:*:*:*:*:* |
09 May 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-09 13:15
Updated : 2023-05-15 18:49
NVD link : CVE-2023-28832
Mitre link : CVE-2023-28832
JSON object : View
Products Affected
siemens
- 6gk1411-1ac00_firmware
- 6gk1411-1ac00
- 6gk1411-5ac00
- 6gk1411-5ac00_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')