CVE-2023-38558 — Insertion of Sensitive Information into Externally-Accessible File or Directory in Siemens Simatic PCS NEO V4.0

CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or DirectoryCWE-668 — Resource Exposure3 documents3 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 92.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Siemens Simatic PCS NEO V4.0Siemens Simatic PCS NEO V4.0 Update 1Siemens Simatic PCS NEO
Timeline
PublishedSep 14

Description

A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5siemens/simatic_pcs_neo_v4.0All versions

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
CVEList
CVE-2023-38558: A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4↗2023-09-14
▶
GHSA
GHSA-mwjc-697v-r7m7: A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4↗2023-09-14
▶
CVE-2023-38558 — Siemens vulnerability | cvebase