Skip to content
fr Sign in
3.9 Low

CVE-2023-28829 A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All…

Description

A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.

Affected products and versions

Product Affected versions Fixed in
SIMATIC NET PC Software V14 Versions not published
SIMATIC NET PC Software V15 Versions not published
SIMATIC PCS 7 V8.2 Versions not published
SIMATIC PCS 7 V9.0 Versions not published
SIMATIC PCS 7 V9.1 Versions not published
SIMATIC WinCC Versions not published
SINAUT Software ST7sc Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of SIMATIC NET PC Software V14

The 9 CVEs of SIMATIC NET PC Software V14 →
CVE-2023-28831 The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could… 7.5 High CVE-2022-0778 The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for… Not rated CVE-2021-40359 A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS… 7.7 High CVE-2020-7580 A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All… Not rated
Track this CVE