Input Validation Flaw in SIMATIC PCS 7 and WinCC Runtime Products by Siemens
CVE-2023-50821

6.2MEDIUM

Key Information:

Vendor
Siemens
Status
Simatic Pcs 7 V9.1
Simatic Wincc Runtime Professional V17
Simatic Wincc Runtime Professional V18
Simatic Wincc Runtime Professional V19
Vendor
CVE Published:
9 April 2024

Summary

An input validation flaw in various Siemens SIMATIC PCS 7 and WinCC Runtime products could be exploited by attackers. This vulnerability arises from improper handling of user inputs within the login dialog box, allowing for a potential persistent denial of service condition. Users are advised to review and update the affected products to mitigate the risk associated with this vulnerability.

Affected Version(s)

SIMATIC PCS 7 V9.1 0

SIMATIC WinCC Runtime Professional V17 All versions

SIMATIC WinCC Runtime Professional V18 0

References

https://cert-portal.siemens.com/productcert/html/ssa-7304...

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.