CVE-2023-46285: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…

high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an improper input validation vulnerability that could allow an attacker to bring the service into a Denial-of-Service state by sending a specifically crafted message to 4004/tcp. The corresponding service is auto-restarted after the crash is detected by a watchdog.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
siemens	opcenter_execution_foundation	< V2407	V2407
siemens	opcenter_quality	< V2312	V2312
siemens	simatic_pcs_neo	< V4.1	V4.1
siemens	simatic_pcs_neo	< 4.1	4.1
siemens	sinec_nms	< V2.0 SP1	V2.0 SP1
siemens	totally_integrated_automation_portal	—	—
siemens	totally_integrated_automation_portal	>= 14.0 < 15	15
siemens	totally_integrated_automation_portal	>= 15 < 16	16
siemens	totally_integrated_automation_portal	>= 16 < 17	17
siemens	totally_integrated_automation_portal	>= 17 < 18	18
siemens	totally_integrated_automation_portal_v14	< *	*
siemens	totally_integrated_automation_portal_v15.1	< *	*
siemens	totally_integrated_automation_portal_v16	< *	*
siemens	totally_integrated_automation_portal_v17	< V17 Update 8	V17 Update 8
siemens	totally_integrated_automation_portal_v18	< V18 Update 3	V18 Update 3