CVE-2023-38558

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems.

Se ha identificado una vulnerabilidad en SIMATIC PCS neo (Consola de administración) V4.0 (todas las versiones), SIMATIC PCS neo (Consola de administración) V4.0 Update 1 (todas las versiones). La aplicación afectada pierde las credenciales de administrador de Windows. Un atacante con acceso local a la Consola de Administración podría obtener las credenciales y hacerse pasar por el usuario administrador, obteniendo así acceso de administrador a otros sistemas Windows.

*Credits: N/A

CVSS Scores

Siemens AGv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-07-20 CVE Reserved
2023-09-14 CVE Published
2023-09-15 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-668: Exposure of Resource to Wrong Sphere

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-646240.pdf	2023-09-20

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Siemens Search vendor "Siemens"		Simatic Pcs Neo Search vendor "Siemens" for product "Simatic Pcs Neo"				4.0 Search vendor "Siemens" for product "Simatic Pcs Neo" and version "4.0"		-		Affected
Siemens Search vendor "Siemens"		Simatic Pcs Neo Search vendor "Siemens" for product "Simatic Pcs Neo"				4.0 Search vendor "Siemens" for product "Simatic Pcs Neo" and version "4.0"		update_1		Affected