CVE-2023-30755: Null Pointer Dereference
First published: Tue Sep 10 2024(Updated: )
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-7 LTE (All versions < V3.5.20), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.5.20), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMATIC WinCC Runtime Advanced (All versions), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of the affected devices do not properly handle the shutdown or reboot request, which could lead to the clean up of certain resources. This could allow a remote attacker with elevated privileges to cause a denial of service condition in the system.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens SIMATIC CP 1242-7 V2 firmware | <3.5.20 | |
| siemens simatic cp 1243-1 | <3.5.20 | |
| Siemens Simatic Net CP 1243-1 | <3.5.20 | |
| Siemens SIMATIC CP 1243-1 IEC Firmware | <3.5.20 | |
| Siemens SIMATIC CP 1243-7 LTE Firmware | <3.5.20 | |
| Siemens SIMATIC CP 1243-8 IRC Firmware | <3.5.20 | |
| Siemens SIMATIC HMI Comfort Panels Firmware | ||
| siemens SIMATIC IPC DiagBase | ||
| siemens SIMATIC IPC DiagMonitor | ||
| Siemens SIMATIC WinCC Runtime Advanced | ||
| siemens SIPLUS TIM 1531 IRC | <2.4.8 | |
| siemens tim 1531 irc | <2.4.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-30755?
CVE-2023-30755 is classified as a high-severity vulnerability that affects multiple Siemens SIMATIC devices.
How do I fix CVE-2023-30755?
To mitigate CVE-2023-30755, you should upgrade your affected Siemens SIMATIC devices to version 3.5.20 or higher.
Which Siemens products are affected by CVE-2023-30755?
CVE-2023-30755 impacts several products including SIMATIC CP 1242-7 V2, CP 1243-1, and CP 1243-1 DNP3, all prior to version 3.5.20.
Is there a patch available for CVE-2023-30755?
Yes, Siemens has released a firmware update that acts as a patch for CVE-2023-30755.
What are the risks of not addressing CVE-2023-30755?
Failure to address CVE-2023-30755 could lead to unauthorized access and control over the affected Siemens SIMATIC devices.
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/siemens
- canonical/siemens simatic cp 1242-7 v2 firmware
- canonical/siemens simatic cp 1243-1
- canonical/siemens simatic net cp 1243-1
- canonical/siemens simatic cp 1243-1 iec firmware
- canonical/siemens simatic cp 1243-7 lte firmware
- canonical/siemens simatic cp 1243-8 irc firmware
- canonical/siemens simatic hmi comfort panels firmware
- canonical/siemens simatic ipc diagbase
- canonical/siemens simatic ipc diagmonitor
- canonical/siemens simatic wincc runtime advanced
- canonical/siemens siplus tim 1531 irc
- canonical/siemens tim 1531 irc