Non-Unique TLS Certificate Vulnerability in SIMATIC IPC Products by Siemens

CVE-2023-23588

What is CVE-2023-23588?

A significant vulnerability exists in the SIMATIC IPC series, specifically affecting devices with the Adaptec Maxview application. The issue stems from the use of a non-unique TLS certificate across installations, which could allow a local attacker to intercept and decrypt traffic between the browser and the application. This vulnerability can lead to man-in-the-middle attacks, enabling the modification of in-transit data, posing serious risks to data integrity and confidentiality.

References