CVE-2023-28829
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-03-24 CVE Reserved
- 2023-06-13 CVE Published
- 2025-01-03 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-477: Use of Obsolete Function
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdf | 2023-07-05 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Siemens Search vendor "Siemens" | Simatic Net Pc Software Search vendor "Siemens" for product "Simatic Net Pc Software" | 14.0 Search vendor "Siemens" for product "Simatic Net Pc Software" and version "14.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Net Pc Software Search vendor "Siemens" for product "Simatic Net Pc Software" | 15.0 Search vendor "Siemens" for product "Simatic Net Pc Software" and version "15.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7" | 8.2 Search vendor "Siemens" for product "Simatic Pcs 7" and version "8.2" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7" | 9.0 Search vendor "Siemens" for product "Simatic Pcs 7" and version "9.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7" | 9.1 Search vendor "Siemens" for product "Simatic Pcs 7" and version "9.1" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | < 8.0 Search vendor "Siemens" for product "Simatic Wincc" and version " < 8.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinaut St7sc Search vendor "Siemens" for product "Sinaut St7sc" | * | - |
Affected
| ||||||