CVE-2023-33920: Medium severity Siemens Cpci85 Firmware vulnerability
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devices contain the hash of the root password in a hard-coded form, which could be exploited for UART console login to the device. An attacker with direct physical access could exploit this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CP-8031 MASTER MODULEto a version that resolves this vulnerability.Fixed in CPCI85 V05 - Upgrade
Upgrade
CP-8050 MASTER MODULEto a version that resolves this vulnerability.Fixed in CPCI85 V05 - Compensating control
Mitigate the UART console login risk from direct physical access by restricting/controlling physical access to the UART console interface on the affected devices until fixed versions (CPCI85 V05) are applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-33920?
CVE-2023-33920 has been evaluated as a high-severity vulnerability due to the exposure of the root password hash.
How can I mitigate CVE-2023-33920?
Mitigation for CVE-2023-33920 involves updating affected devices to versions equal to or greater than CPCI85 V05.
Which devices are affected by CVE-2023-33920?
CVE-2023-33920 affects the Siemens CP-8031 MASTER MODULE and CP-8050 MASTER MODULE models with versions prior to CPCI85 V05.
Can CVE-2023-33920 be exploited remotely?
CVE-2023-33920 may be exploited locally through UART console access, potentially allowing unauthorized access.
Is there a patch available for CVE-2023-33920?
Yes, Siemens has released a patch to address CVE-2023-33920, which requires updating to the fixed version CPCI85 V05.