Medium severity · published Dec 12, 2023
CVE-2023-46282
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC…
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected applications that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OQ
Opcenter Quality · Siemens
All versions, or not specified · source: NVD
SP
Simatic Pcs Neo · Siemens
before 4.1 · source: NVD
SI
Sinumerik Integrate Runmyhmi /automotive · Siemens
All versions, or not specified · source: NVD
TI
Totally Integrated Automation Portal · Siemens
14.0 before 15; 15 before 16; 16 before 17; 17 before 18; 18; 18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46282
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46282
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-999588.html
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf
More from Opcenter Quality
9.8
CVE-2024-33698
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1…
9.8
CVE-2021-27389
A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30)
8.8
CVE-2023-46281
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC…
8.2
CVE-2020-7587
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All…
8.0
CVE-2024-41979
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All…