CVE-2023-26293

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26293
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-116924.html
https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:siemens:tia_portal:15:*:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:16:*:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:-:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update1:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update2:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update3:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update4:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update5:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:18:-:*:*:*:*:*:*
History

13 Aug 2024, 08:15

Type Values Removed Values Added
Summary (en) A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution. (en) A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-116924.html -

01 Feb 2024, 15:19

Type Values Removed Values Added
References (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf - Vendor Advisory (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf - Patch, Vendor Advisory
CPE cpe:2.3:a:siemens:tia_portal:17:*:*:*:*:*:*:* cpe:2.3:a:siemens:tia_portal:17:update2:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update3:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update5:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update4:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:update1:*:*:*:*:*:*
cpe:2.3:a:siemens:tia_portal:17:-:*:*:*:*:*:*

09 May 2023, 13:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 7.3
CWE CWE-22 CWE-20
Summary A vulnerability has been identified in TIA Portal V15 (All versions), TIA Portal V16 (All versions), TIA Portal V17 (All versions), TIA Portal V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution. A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.

19 Apr 2023, 19:59

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-11 10:15

Updated : 2024-08-13 08:15

NVD link : CVE-2023-26293

Mitre link : CVE-2023-26293

CVE.ORG link : CVE-2023-26293

JSON object : View

Products Affected

siemens

  • tia_portal
CWE
CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')