Input Validation Flaw in SIMATIC PCS 7 and WinCC Runtime Products by Siemens
CVE-2023-50821

6.9MEDIUM

Key Information:

Vendor
Siemens
Status
Simatic Pcs 7 V9.1
Simatic Wincc Runtime Professional V17
Simatic Wincc Runtime Professional V18
Simatic Wincc Runtime Professional V19
Vendor
CVE Published:
9 April 2024

Summary

An input validation flaw in various Siemens SIMATIC PCS 7 and WinCC Runtime products could be exploited by attackers. This vulnerability arises from improper handling of user inputs within the login dialog box, allowing for a potential persistent denial of service condition. Users are advised to review and update the affected products to mitigate the risk associated with this vulnerability.

Affected Version(s)

SIMATIC PCS 7 V9.1 0

SIMATIC WinCC Runtime Professional V17 0

SIMATIC WinCC Runtime Professional V18 0

References

https://cert-portal.siemens.com/productcert/html/ssa-7304...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.