CVE-2023-29107: Medium severity siemens 6gk1411-1ac00 firmware vulnerability

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2023-29107.

Q: What is the severity of CVE-2023-29107?

The severity of CVE-2023-29107 is medium with a severity value of 5.3.

Q: Which software versions are affected by CVE-2023-29107?

CVE-2023-29107 affects SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1) and SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1).

Q: How can an attacker exploit CVE-2023-29107?

An unauthenticated remote attacker can exploit CVE-2023-29107 by gaining access to additional undocumented files through the export endpoint.

Q: Is there a fix available for CVE-2023-29107?

Siemens has provided a security advisory with mitigations for CVE-2023-29107. Please refer to the reference link for more information.

Published May 9, 2023

Updated

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources.

Affected Software

4 affected components

Siemens 6gk1411-1ac00 Firmware=2.0

Siemens 6gk1411-1ac00

Siemens 6gk1411-5ac00 Firmware=2.0

Siemens 6gk1411-5ac00

Remediation

Patch Available

https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Event History

May 9, 2023

CVE Published

via MITRE·11:51 AM

Data Sourced

via MITRE·11:51 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2023-29107.

What is the severity of CVE-2023-29107?

The severity of CVE-2023-29107 is medium with a severity value of 5.3.

Which software versions are affected by CVE-2023-29107?