Rewterz Threat Advisory – ICS: Multiple Siemens Products Vulnerabilities

April 14, 2023

Severity

High

Analysis Summary

CVE-2022-43716 CVSS:7.5

Siemens products are vulnerable to a denial of service, caused by an unspecified flaw in the webserver. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2022-43767 CVSS:7.5

CVE-2022-43768 CVSS:7.5

CVE-2023-26293 CVSS:7.3

Siemens TIA Portal could allow a remote attacker to execute arbitrary code on the system, caused by a path traversal vulnerability. By persuading a victim to open a specially-crafted PC system configuration file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2023-27464 CVSS:5.3

Siemens Mendix Forgot Password could allow a remote attacker to obtain sensitive information, caused by an observable response discrepancy. By sending multiple requests, an attacker could exploit this vulnerability to enumerate valid usernames, and use this information to launch further attacks against the affected system.

CVE-2023-28489 CVSS:9.8

Siemens SICAM A8000 CP-8050 and CP-8031 devices could allow a remote attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2023-28766 CVSS:7.5

Siemens SIPROTEC 5 devices are vulnerable to a denial of service, caused by a null pointer dereference vulnerability in the web service. By sending an unauthenticated maliciously crafted HTTP request, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2023-29053 CVSS:7.8

Siemens JT Open, JT Utilities could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds read in parsing JTfiles. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2023-2905 CVSS:6.7

Siemens SCALANCE X-200IRT is vulnerable to a man-in-the-middle attack, caused by using weak ciphers by default. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information.

CVE-2023-23588 CVSS:6.2

Siemens SIMATIC IPCs could allow a local attacker to obtain sensitive information, caused by the use of a non-unique TLS certificate across installations in the Adaptec Maxview application. By utilize cryptographic attack techniques, an attacker could exploit this vulnerability to obtain local traffic information, and use this information to launch further attacks against the affected system.

CVE-2023-1709 CVSS:7.8

Siemens Teamcenter Visualization and JT2Go are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by APDFL.dll. By persuading a victim to open a specially crafted PDF file, a remote attacker could overflow a buffer and execute arbitrary code in the context of the current process.