CVE-2023-26293 — Improper Input Validation in Siemens Totally Integrated Automation Portal V15

CWE-20 — Improper Input ValidationCWE-22 — Path Traversal3 documents3 sources
Severity
7.8HIGHNVD
CNA7.3
EPSS
0.1%
top 82.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Siemens Totally Integrated Automation Portal V15Siemens Totally Integrated Automation Portal V16Siemens Totally Integrated Automation Portal V17+2 more
Timeline
PublishedApr 11

Description

A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineerin…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶NVDsiemens/tia_portal4 versions+3

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-pfr5-cpm3-g35v: A vulnerability has been identified in TIA Portal V15 (All versions), TIA Portal V16 (All versions), TIA Portal V17 (All versions), TIA Portal V18 (Al↗2023-04-11
▶
CVEList
CVE-2023-26293: A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA↗2023-04-11
▶
CVE-2023-26293 — Improper Input Validation in Siemens | cvebase