High severity · published Jan 9, 2024
CVE-2023-42797
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20)
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network configuration service of affected devices contains a flaw in the conversion of ipv4 addresses that could lead to an uninitialized variable being used in succeeding validation steps.
By uploading specially crafted network configuration, an authenticated remote attacker could be able to inject commands that are executed on the device with root privileges during device startup.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sicam A8000 Cp-8031 Firmware · Siemens
before 05.20 · source: NVD
SA
Sicam A8000 Cp-8050 Firmware · Siemens
before 05.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-42797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-42797
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-583634.pdf
More from Sicam A8000 Cp-8031 Firmware
7.5
CVE-2022-27480
A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80)
