CVE-2023-46281 — Permissive Cross-domain Security Policy with Untrusted Domains in Siemens Opcenter Execution Foundation

CWE-942 — Permissive Cross-domain Security Policy with Untrusted Domains3 documents3 sources

Severity

8.8HIGHNVD

CNA7.1

EPSS

0.1%

top 70.55%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Siemens Opcenter Execution Foundation Siemens Opcenter Quality Siemens Simatic PCS NEO +7 more

Timeline

PublishedDec 12

Description

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Upda…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages11 packages

▶NVDsiemens/totally_integrated_automation_portal14.0 — 15+4

▶CVEListV5siemens/totally_integrated_automation_portal_v14< *

▶CVEListV5siemens/totally_integrated_automation_portal_v16< *

▶CVEListV5siemens/totally_integrated_automation_portal_v17< V17 Update 8

▶CVEListV5siemens/totally_integrated_automation_portal_v18< V18 Update 3

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

GHSA

GHSA-9qvw-gvq6-g569: A vulnerability has been identified in Opcenter Quality (All versions), SIMATIC PCS neo (All versions < V4↗2023-12-12

▶

CVEList

CVE-2023-46281: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo↗2023-12-12

▶