CVE-2023-28832

Katalog CVE

CVSS 7.2 · High EPSS 1,5%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada siemens 6gk1411-1ac00 firmware, siemens 6gk1411-5ac00 firmware. Skor CVSS 3.1 7.2 (High) menurut siemens.com.

Deskripsi (NVD)

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Rincian

Terbit di NVD

9 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber siemens.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf patch · advisory vendor