CVE-2023-38380

siemens 6gk7243-8rx30-0xe0 firmware, siemens 6gk7543-1ax00-0xe0 firmware, siemens 6ag1543-1ax00-2xe0 firmware +6 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-38380

Katalog CVE

CVSS 7.5 · High EPSS 0,96%

Kerentanan Missing Release of Memory after Effective Lifetime pada siemens 6gk7243-8rx30-0xe0 firmware, siemens 6gk7543-1ax00-0xe0 firmware +7 lainnya. Skor CVSS 3.1 7.5 (High) menurut siemens.com.

Deskripsi (NVD)

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) (All versions < V3.0.37), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SINAMICS S210 (6SL5...) (All versions >= V6.1 < V6.1 HF2), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) (All versions < V3.0.37). The webserver implementation of the affected products does not correctly release allocated memory after it has been used. An attacker with network access could use this vulnerability to cause a denial-of-service condition in the webserver of the affected product.

Rincian

Terbit di NVD
12 Desember 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber siemens.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-401: Missing Release of Memory after Effective Lifetime
EPSS (30 hari)
0,96% peluang dieksploitasi; lebih tinggi dari 60,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
siemens 6gk7243-8rx30-0xe0 firmware Semua versi
siemens 6gk7543-1ax00-0xe0 firmware Semua versi
siemens 6ag1543-1ax00-2xe0 firmware Semua versi
siemens simatic cp 1242-7 v2 firmware Semua versi
siemens simatic cp 1243-1 firmware Semua versi
siemens simatic cp 1243-1 dnp3 firmware Semua versi
siemens simatic cp 1243-1 iec firmware Semua versi
siemens simatic cp 1243-7 lte firmware Semua versi
siemens sinamics s210 firmware Versi 5.1
siemens sinamics s210 firmware Versi 5.1 sp1
siemens sinamics s210 firmware Versi 5.1 sp1_hotfix8
siemens sinamics s210 firmware Versi 5.2
siemens sinamics s210 firmware Versi 5.2 hotfix2
siemens sinamics s210 firmware Versi 5.2 hotfix5
siemens sinamics s210 firmware Versi 5.2 hotfix6
siemens sinamics s210 firmware Versi 5.2 hotfix7
siemens sinamics s210 firmware Versi 5.2 sp3
siemens sinamics s210 firmware Versi 5.2 sp3_hotfix3
siemens sinamics s210 firmware Versi 5.2 sp3_hotfix5
siemens sinamics s210 firmware Versi 5.2 sp3_hotfix6
siemens sinamics s210 firmware Versi 5.2 sp3_hotfix9
siemens sinamics s210 firmware Versi 6.1
siemens sinamics s210 firmware Versi 6.1 hotfix1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.