CVE-2023-35920

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35920
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). Affected devices cannot properly process specially crafted IP packets sent to the devices. This could allow an unauthenticated remote attacker to cause a denial of service condition. The affected devices must be restarted manually.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:siemens:simatic_mv540_h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv540_h:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:simatic_mv540_s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv540_s:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:siemens:simatic_mv550_h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv550_h:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:siemens:simatic_mv550_s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv550_s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:siemens:simatic_mv560_u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv560_u:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:siemens:simatic_mv560_x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv560_x:-:*:*:*:*:*:*:*
History

19 Jul 2023, 14:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf - (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf - Vendor Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:siemens:simatic_mv540_h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_mv550_s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_mv550_h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv550_s:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_mv560_u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv540_s:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv550_h:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_mv560_x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv540_h:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_mv540_s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv560_u:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv560_x:-:*:*:*:*:*:*:*

11 Jul 2023, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-11 10:15

Updated : 2024-02-04 23:37

NVD link : CVE-2023-35920

Mitre link : CVE-2023-35920

CVE.ORG link : CVE-2023-35920

JSON object : View

Products Affected

siemens

  • simatic_mv540_h
  • simatic_mv550_h
  • simatic_mv560_x
  • simatic_mv560_x_firmware
  • simatic_mv540_s_firmware
  • simatic_mv550_h_firmware
  • simatic_mv540_h_firmware
  • simatic_mv550_s_firmware
  • simatic_mv560_u
  • simatic_mv560_u_firmware
  • simatic_mv540_s
  • simatic_mv550_s
CWE
NVD-CWE-noinfo CWE-400

Uncontrolled Resource Consumption