A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf | Patch Vendor Advisory |
| https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf | Patch Vendor Advisory |
Configurations
History
21 Nov 2024, 07:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf - Patch, Vendor Advisory |
15 May 2023, 18:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf - Patch, Vendor Advisory | |
| CPE | cpe:2.3:o:siemens:6gk1411-1ac00_firmware:2.0:*:*:*:*:*:*:* cpe:2.3:h:siemens:6gk1411-5ac00:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:6gk1411-5ac00_firmware:2.0:*:*:*:*:*:*:* cpe:2.3:h:siemens:6gk1411-1ac00:-:*:*:*:*:*:*:* |
09 May 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-09 13:15
Updated : 2024-11-21 07:56
NVD link : CVE-2023-28832
Mitre link : CVE-2023-28832
CVE.ORG link : CVE-2023-28832
JSON object : View
Products Affected
siemens
- 6gk1411-1ac00_firmware
- 6gk1411-5ac00
- 6gk1411-5ac00_firmware
- 6gk1411-1ac00
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')