CVE-2023-27407: OS Command Injection

Q: What is the severity of CVE-2023-27407?

The severity of CVE-2023-27407 is critical with a severity value of 9.9.

Q: What is the affected software of CVE-2023-27407?

The affected software of CVE-2023-27407 is SCALANCE LPE9403 firmware versions below 2.1.

Q: What is the vulnerability type of CVE-2023-27407?

The vulnerability type of CVE-2023-27407 is command injection.

Q: How does CVE-2023-27407 affect the device?

CVE-2023-27407 allows an authenticated remote attacker to access the underlying operating system of the affected device.

Q: Is SCALANCE LPE9403 version 2.1 vulnerable to CVE-2023-27407?

No, SCALANCE LPE9403 version 2.1 is not vulnerable to CVE-2023-27407.

Published May 9, 2023

Updated

A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as the root user.

Affected Software

4 affected components

Siemens Scalance Lpe9403 Firmware<2.1

Siemens SCALANCE LPE9403

All of the following

Siemens Scalance Lpe9403 Firmware<2.1

Siemens SCALANCE LPE9403

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SCALANCE LPE9403 to a version that resolves this vulnerability.
Fixed in V2.1

Event History

May 9, 2023

CVE Published

via MITRE·11:51 AM

Data Sourced

via MITRE·11:51 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-27407?

The severity of CVE-2023-27407 is critical with a severity value of 9.9.

What is the affected software of CVE-2023-27407?