Security Flaw in QMS Automotive Application from Siemens

CVE-2023-40729

What is CVE-2023-40729?

A security control weakness has been discovered in QMS Automotive versions prior to V12.39, allowing unencrypted communication to occur without the protection of HTTPS. This flaw makes the application susceptible to machine-in-the-middle attacks, where an attacker could intercept, manipulate, or steal sensitive data being transmitted. The absence of proper encryption safeguards significantly increases the risk to confidential information handled by the application.

References