What is the CVSS score of CVE-2023-27465?

CVE-2023-27465 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Simotion D425 2 Dp Firmware are affected by CVE-2023-27465?

A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 = V5.4 = V5.4 < V5.5 SP1),.. A patch is available.

Is there a patch available for CVE-2023-27465?

Yes, a patch is available for CVE-2023-27465. Update the affected software to the latest version immediately.

Simotion D425 2 Dp Firmware CVE-2023-27465

Q: Is there a patch available for CVE-2023-27465?

Yes, a patch is available for CVE-2023-27465. Update the affected software to the latest version immediately.

MEDIUM

Exposure of Sensitive Information Due to Incompatible Policies (CWE-213)

2023-06-13 productcert@siemens.com

Information Disclosure Simotion D425 2 Dp Firmware Simotion D425 2 Dp Pn Firmware Simotion D435 2 Dp Firmware Simotion D435 2 Dp Pn Firmware Simotion D445 2 Dp Pn 0Aa1 Firmware Simotion D445 2 Dp Pn 0Aa0 Firmware Simotion D455 2 Dp Pn Firmware Simotion P320 4 E Firmware Simotion P320 4 S Firmware Simotion D410 2 Dp Firmware Simotion D410 2 Dp Pn Firmware Simotion C240 Pn Firmware Simotion C240 Firmware

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jun 13, 2023 - 09:15 nvd

MEDIUM 4.6

DescriptionNVD

A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 < V5.5 SP1), SIMOTION C240 PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D425-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D425-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D435-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D435-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D445-2 DP/PN (All versions >= V5.4), SIMOTION D445-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D455-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION P320-4 E (All versions >= V5.4), SIMOTION P320-4 S (All versions >= V5.4). When operated with Security Level Low the device does not protect access to certain services relevant for debugging. This could allow an unauthenticated attacker to extract confidential technology object (TO) configuration from the device.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-213. A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 < V5.5 SP1), SIMOTION C240 PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D425-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D425-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D435-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D435-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D445-2 DP/PN (All versions >= V5.4), SIMOTION D445-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D455-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION P320-4 E (All versions >= V5.4), SIMOTION P320-4 S (All versions >= V5.4). When operated with Security Level Low the device does not protect access to certain services relevant for debugging. This could allow an unauthenticated attacker to extract confidential technology object (TO) configuration from the device. Affected products include: Siemens Simotion D425-2 Dp Firmware, Siemens Simotion D425-2 Dp\/Pn Firmware, Siemens Simotion D435-2 Dp Firmware, Siemens Simotion D435-2 Dp\/Pn Firmware, Siemens Simotion D445-2 Dp\/Pn \(0Aa1\) Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.