CVE-2023-46281: High severity siemens opcenter quality vulnerability
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46281?
CVE-2023-46281 is classified as a high severity vulnerability due to the potential impact on affected software.
How do I fix CVE-2023-46281?
To fix CVE-2023-46281, update affected Siemens software to the latest versions as specified in security advisories.
What versions are affected by CVE-2023-46281?
CVE-2023-46281 affects all versions of Siemens Opcenter Execution Foundation (versions < V2407), Opcenter Quality (versions < V2312), SIMATIC PCS neo (versions < V4.1), and TIA Portal (all versions including V14 and subsequent versions up to V18).
What are the potential risks of CVE-2023-46281?
The potential risks of CVE-2023-46281 include unauthorized access and control over operational technology systems, which could lead to operational disruptions.
Is there a patch available for CVE-2023-46281?
Yes, Siemens has released patches for CVE-2023-46281 that users should apply to mitigate the vulnerability.