Medium severity · published Feb 13, 2024
CVE-2023-48363
A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1…
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 Update 4). The implementation of the RPC (Remote Procedure call)
communication protocol in the affected products do not
properly handle certain unorganized RPC messages. An
attacker could use this vulnerability to cause a denial of service
condition in the RPC server.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
O7
Openpcs 7 · Siemens
through 9.1 · source: NVD
SB
Simatic Batch · Siemens
through 9.1 · source: NVD
SP
Simatic Pcs 7 · Siemens
through 9.1 · source: NVD
SR
Simatic Route Control · Siemens
through 9.1 · source: NVD
SW
Simatic Wincc · Siemens
7.4; 7.5; 8.0 · source: NVD
SW
Simatic Wincc Runtime Professional · Siemens
through 18; 19 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-48363
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-48363
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-753746.html
More from Openpcs 7
7.5
CVE-2019-19282
A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd3), SIMATIC BATCH V8.1 (All versions),…
7.5
CVE-2018-4832
A vulnerability has been identified in OpenPCS 7 V7.1 and earlier (All versions), OpenPCS 7 V8.0 (All versions), OpenPCS 7 V8.1 (All versions < V8.1 Upd5), OpenPCS 7 V8.2 (All…
6.5
CVE-2023-48364
A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1…