CVE-2023-26293

A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-116924.html
https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:tia_portal:15:::::::*
	cpe:2.3:a:siemens:tia_portal:16:::::::*
	cpe:2.3:a:siemens:tia_portal:17:-::::::
	cpe:2.3:a:siemens:tia_portal:17:update1::::::
	cpe:2.3:a:siemens:tia_portal:17:update2::::::
	cpe:2.3:a:siemens:tia_portal:17:update3::::::
	cpe:2.3:a:siemens:tia_portal:17:update4::::::
	cpe:2.3:a:siemens:tia_portal:17:update5::::::
	cpe:2.3:a:siemens:tia_portal:18:-::::::

History

13 Aug 2024, 08:15

Type	Values Removed	Values Added
References		() https://cert-portal.siemens.com/productcert/html/ssa-116924.html -
Summary	(en) A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.	(en) A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.

01 Feb 2024, 15:19

Type	Values Removed	Values Added
References	~~(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf - Vendor Advisory~~	(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf - Patch, Vendor Advisory
CPE	cpe:2.3:a:siemens:tia_portal:17:::::::*	cpe:2.3:a:siemens:tia_portal:17:update3:::::: cpe:2.3:a:siemens:tia_portal:17:-:::::: cpe:2.3:a:siemens:tia_portal:17:update4:::::: cpe:2.3:a:siemens:tia_portal:17:update1:::::: cpe:2.3:a:siemens:tia_portal:17:update5:::::: cpe:2.3:a:siemens:tia_portal:17:update2::::::

Information

Published : 2023-04-11 10:15

Updated : 2024-08-13 08:15

NVD link : CVE-2023-26293

Mitre link : CVE-2023-26293

CVE.ORG link : CVE-2023-26293

JSON object : View

Products Affected

siemens

tia_portal

CWE

CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

7.3 /10