CVE-2023-33921: Medium severity Siemens Cpci85 Firmware vulnerability
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devices contain an exposed UART console login interface. An attacker with direct physical access could try to bruteforce or crack the root password to login to the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CP-8031 MASTER MODULEto a version that resolves this vulnerability.Fixed in CPCI85 V05 - Upgrade
Upgrade
CP-8050 MASTER MODULEto a version that resolves this vulnerability.Fixed in CPCI85 V05 - Compensating control
Mitigate direct physical access risk by disabling/locking down the exposed UART console login interface so it cannot be used for brute-force/cracking of the root password.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-33921?
CVE-2023-33921 is considered high severity due to the potential for unauthorized access via an exposed UART console.
How do I fix CVE-2023-33921?
To mitigate CVE-2023-33921, update the affected devices to the CPCI85 V05 firmware or later.
Which devices are affected by CVE-2023-33921?
CVE-2023-33921 affects all versions of the CP-8031 MASTER MODULE and CP-8050 MASTER MODULE prior to CPCI85 V05.
What can an attacker do with CVE-2023-33921?
An attacker with physical access can exploit CVE-2023-33921 to brute force or crack the root password using the exposed UART console.
Is there a workaround for CVE-2023-33921 if immediate patching is not possible?
If immediate patching is not feasible for CVE-2023-33921, restrict physical access to the affected devices to prevent exploitation.