CVE-2023-26293: Input Validation
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.
Other sources
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26293?
CVE-2023-26293 is classified as a medium severity vulnerability in Siemens TIA Portal.
How do I fix CVE-2023-26293?
To mitigate CVE-2023-26293, update to TIA Portal Version 16 Update 7, Version 17 Update 6, or the latest available version.
What products are affected by CVE-2023-26293?
CVE-2023-26293 affects Siemens TIA Portal versions 15, 16 (all versions before Update 7), and 17 (all versions before Update 6).
Can CVE-2023-26293 be exploited remotely?
Yes, CVE-2023-26293 may allow an attacker to exploit the vulnerability remotely under certain conditions.
What type of vulnerability is CVE-2023-26293?
CVE-2023-26293 is a vulnerability related to insufficient authentication, leading to potential unauthorized access.