CVE-2023-48363

published 2024-02-13

CVE-2023-48363: A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1…

high 7.1 CVSS 4.0

AV A AC L AT N PR N UI N VC N VI N VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 Update 4). The implementation of the RPC (Remote Procedure call)
communication protocol in the affected products do not
properly handle certain unorganized RPC messages. An
attacker could use this vulnerability to cause a denial of service
condition in the RPC server.

Affected

18 ranges

Vendor	Product	Version range	Fixed in
siemens	openpcs_7	<= 9.1	—
siemens	openpcs_7_v9.1	—	—
siemens	simatic_batch	<= 9.1	—
siemens	simatic_batch_v9.1	—	—
siemens	simatic_pcs_7	<= 9.1	—
siemens	simatic_pcs_7_v9.1	< V9.1 SP2 UC05	V9.1 SP2 UC05
siemens	simatic_route_control	<= 9.1	—
siemens	simatic_route_control_v9.1	—	—
siemens	simatic_wincc	—	—
siemens	simatic_wincc	—	—
siemens	simatic_wincc	—	—
siemens	simatic_wincc_runtime_professional	<= 18	—
siemens	simatic_wincc_runtime_professional	—	—
siemens	simatic_wincc_runtime_professional_v18	< V18 Update 4	V18 Update 4
siemens	simatic_wincc_runtime_professional_v19	< V19 Update 2	V19 Update 2
siemens	simatic_wincc_v7.4	< *	*
siemens	simatic_wincc_v7.5	< V7.5 SP2 Update 15	V7.5 SP2 Update 15
siemens	simatic_wincc_v8.0	< V8.0 Update 4	V8.0 Update 4

CWE-476