CVE-2023-46283

published 2023-12-12

CVE-2023-46283: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer when handling specific requests on port 4002/tcp. This could allow an attacker to crash the application. The corresponding service is auto-restarted after the crash.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
siemens	opcenter_execution_foundation	< V2407	V2407
siemens	opcenter_quality	< V2312	V2312
siemens	simatic_pcs_neo	< V4.1	V4.1
siemens	simatic_pcs_neo	< 4.1	4.1
siemens	sinec_nms	< V2.0 SP1	V2.0 SP1
siemens	totally_integrated_automation_portal	—	—
siemens	totally_integrated_automation_portal	>= 14.0 < 15	15
siemens	totally_integrated_automation_portal	>= 15 < 16	16
siemens	totally_integrated_automation_portal	>= 16 < 17	17
siemens	totally_integrated_automation_portal	>= 17 < 18	18
siemens	totally_integrated_automation_portal_v14	< *	*
siemens	totally_integrated_automation_portal_v15.1	< *	*
siemens	totally_integrated_automation_portal_v16	< *	*
siemens	totally_integrated_automation_portal_v17	< V17 Update 8	V17 Update 8
siemens	totally_integrated_automation_portal_v18	< V18 Update 3	V18 Update 3

CWE-120