What is the CVSS score of CVE-2023-49621?

CVE-2023-49621 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Simatic Cn 4100 Firmware are affected by CVE-2023-49621?

Organizations using A vulnerability face critical risk from CVE-2023-49621 rated CVSS 9.8.. A patch is available.

How to fix or mitigate CVE-2023-49621?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Simatic Cn 4100 Firmware CVE-2023-49621

CRITICAL

Use of Default Credentials (CWE-1392)

2024-01-09 productcert@siemens.com

Information Disclosure Simatic Cn 4100 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:34 vuln.today

Patch released

Mar 28, 2026 - 19:34 nvd

Patch available

CVE Published

Jan 09, 2024 - 10:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control of the affected device.

AnalysisAI

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Default Credentials vulnerability could allow attackers to gain access using factory-default usernames and passwords.

Technical ContextAI

This vulnerability is classified as Use of Default Credentials (CWE-1392), which allows attackers to gain access using factory-default usernames and passwords. A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control of the affected device. Affected products include: Siemens Simatic Cn 4100 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Force credential change on first use, remove default accounts, document required credential changes.