CVE-2023-29106 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2023-29106

Analyzed

More Info Official Page

Source-productcert@siemens.com

Published At-09 May, 2023 | 13:15

Updated At-15 May, 2023 | 18:34

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CPE Matches

>>6gk1411-1ac00_firmware>>2.0

cpe:2.3:o:siemens:6gk1411-1ac00_firmware:2.0:*:*:*:*:*:*:*

>>6gk1411-1ac00>>-

cpe:2.3:h:siemens:6gk1411-1ac00:-:*:*:*:*:*:*:*

>>6gk1411-5ac00_firmware>>2.0

cpe:2.3:o:siemens:6gk1411-5ac00_firmware:2.0:*:*:*:*:*:*:*

>>6gk1411-5ac00>>-

cpe:2.3:h:siemens:6gk1411-5ac00:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	productcert@siemens.com

CWE ID: CWE-200

Type: Primary

Source: productcert@siemens.com

References

Hyperlink	Source	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf	productcert@siemens.com	Patch Vendor Advisory

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf

Source: productcert@siemens.com

Resource:

Patch

Vendor Advisory