We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-28766



Description

A vulnerability has been identified in SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 6MD86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 6MD89 (CP300) (All versions >= V7.80 < V9.64), SIPROTEC 5 6MU85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7KE85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SA82 (CP100) (All versions), SIPROTEC 5 7SA82 (CP150) (All versions < V9.40), SIPROTEC 5 7SA86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SA87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SD82 (CP100) (All versions), SIPROTEC 5 7SD82 (CP150) (All versions < V9.40), SIPROTEC 5 7SD86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SD87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SJ81 (CP100) (All versions < V8.89), SIPROTEC 5 7SJ81 (CP150) (All versions < V9.40), SIPROTEC 5 7SJ82 (CP100) (All versions < V8.89), SIPROTEC 5 7SJ82 (CP150) (All versions < V9.40), SIPROTEC 5 7SJ85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SJ86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SK82 (CP100) (All versions < V8.89), SIPROTEC 5 7SK82 (CP150) (All versions < V9.40), SIPROTEC 5 7SK85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SL82 (CP100) (All versions), SIPROTEC 5 7SL82 (CP150) (All versions < V9.40), SIPROTEC 5 7SL86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SL87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SS85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7ST85 (CP300) (All versions >= V7.80 < V9.64), SIPROTEC 5 7ST86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SX82 (CP150) (All versions < V9.40), SIPROTEC 5 7SX85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7UM85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7UT82 (CP100) (All versions), SIPROTEC 5 7UT82 (CP150) (All versions < V9.40), SIPROTEC 5 7UT85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7UT86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7UT87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7VE85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7VK87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7VU85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 Communication Module ETH-BA-2EL (All versions < V9.40 installed on CP150 and CP300 devices), SIPROTEC 5 Communication Module ETH-BA-2EL (All versions < V8.89 installed on CP100 devices), SIPROTEC 5 Communication Module ETH-BB-2FO (All versions < V9.40 installed on CP150 and CP300 devices), SIPROTEC 5 Communication Module ETH-BB-2FO (All versions < V8.89 installed on CP100 devices), SIPROTEC 5 Communication Module ETH-BD-2FO (All versions < V9.40), SIPROTEC 5 Compact 7SX800 (CP050) (All versions < V9.40). Affected devices lack proper validation of http request parameters of the hosted web service. An unauthenticated remote attacker could send specially crafted packets that could cause denial of service condition of the target device.

Reserved 2023-03-23 | Published 2023-04-11 | Updated 2024-08-02 | Assigner siemens


HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

Problem types

CWE-476: NULL Pointer Dereference

Product status

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.64
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before *
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before *
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before *
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.64
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before *
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

Any version before V9.40
affected

References

cert-portal.siemens.com/productcert/pdf/ssa-322980.pdf

cert-portal.siemens.com/productcert/html/ssa-322980.html

cve.org (CVE-2023-28766)

nvd.nist.gov (CVE-2023-28766)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2023-28766

Support options

Helpdesk Chat, Email, Knowledgebase