Critical severity · published Jul 11, 2023
CVE-2023-29130
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5)
10.0
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper access controls in the configuration files that leads to privilege escalation. An attacker could gain admin access with this vulnerability leading to complete device control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Simatic CN 4100 Firmware · Siemens
before 2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29130
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29130
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-313488.pdf
More from Simatic CN 4100 Firmware
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
10.0
CVE-2024-32741
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0)
10.0
CVE-2023-29131
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5)
9.8
CVE-2025-40938
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1)