Details of VAR-202309-0636

ID

VAR-202309-0636

CVE

CVE-2023-28831

TITLE

Siemens SIMATIC product ANSI C OPC UA SDK denial of service vulnerability

Trust: 0.6

sources: CNVD: CNVD-2023-69803

DESCRIPTION

The ANSI C OPC UA SDK contains an integer overflow vulnerability that could cause the application to run into an infinite loop during certificate validation. This could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate. SIMATIC Cloud Connect 7 is an IoT gateway for connecting programmable logic controllers to cloud services and allows field devices to interface with OPC UA servers as OPC UA clients. SIMATIC Drive Controllers are designed for the automation of production machines and combine the functions of the SIMATIC S7-1500 CPU and the SINAMICS S120 drive control. The SIMATIC ET 200SP Open Controller is a PC-based version of the SIMATIC S7-1500 controller and includes optional visualization combined with central I/O in a compact device. SIMATIC S7-1200 CPU products are designed for discrete and continuous control in industrial environments such as global manufacturing, food and beverage, and chemical industries. SIMATIC S7-1500 CPU products are designed for discrete and continuous control in industrial environments such as global manufacturing, food and beverage, and chemical industries. SIMATIC S7-1500 ODK CPUs offer the functionality of a standard S7-1500 CPU, but also offer the possibility to run C/C++ code within the CPU runtime to execute your own functions/algorithms implemented in C/C++. They are designed for discrete and continuous control in industrial environments such as the manufacturing, food and beverage, and chemical industries around the world. SIMATIC S7-1500 Software Controller is the SIMATIC software controller for PC-based automation solutions. SIMATIC S7-PLCSIM Advanced simulates S7-1200, S7-1500 and some other PLC derivatives. Includes full network access to simulated PLCs, even in virtualized environments. Siemens SIMATIC product ANSI C OPC UA SDK has a denial of service vulnerability

Trust: 1.53

sources: NVD: CVE-2023-28831 // CNVD: CNVD-2023-69803 // VULMON: CVE-2023-28831

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2023-69803

AFFECTED PRODUCTS

vendor:	siemens	model:	siplus s7-1500 cpu pn	scope:	eq	version:	1511-1<v2.9.7	Trust: 1.8
vendor:	siemens	model:	simatic s7-1500 cpu pn	scope:	eq	version:	1511-1<v2.9.7	Trust: 1.2
vendor:	siemens	model:	simatic s7-1500 cpu 1511c-1 pn	scope:	lt	version:	v2.9.7	Trust: 1.2
vendor:	siemens	model:	simatic s7-1500 cpu 1511f-1 pn	scope:	lt	version:	v2.9.7	Trust: 1.2
vendor:	siemens	model:	simatic s7-1500 cpu 1515-2 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1513-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus et 200sp cpu 1512sp-1 pn rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518t-4 pn\/dp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1517h-3 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1516-3 pn\/dp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1514sp f-2 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 et 200pro	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1515t-2 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1517-3 pn\/dp	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic s7-1200 cpu	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1518-4 pn\/dp mfp	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic s7-plcsim advanced	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1518-4 pn\/dp	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1513r-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1518hf-4 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1511-1 pn t1 rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu s7-1518f-4 pn\/dp odk	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus et 200sp cpu 1512sp-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1511tf-1 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1516f-3 pn\/dp rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus et 200sp cpu 1510sp f-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1516f-3 pn\/dp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1516f-3 pn\/dp	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic drive controller cpu 1504d tf	scope:	lt	version:	2.2	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1511f-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1511t-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1516-3 pn\/dp rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1516-3 pn\/dp tx rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1511c-1 pn	scope:	lt	version:	30.0.0	Trust: 1.0
vendor:	siemens	model:	simatic drive controller cpu 1507d tf	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic et 200sp open controller cpu	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus et 200sp cpu 1510sp-1 pn rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus et 200sp cpu 1510sp-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1512c-1 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1516t-3 pn\/dp	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus et 200sp cpu 1510sp f-1 pn rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1515f-2 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1510sp-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1514sp-2 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus et 200sp cpu 1512sp f-1 pn rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518tf-4 pn\/dp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1515r-2 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1518f-4 pn\/dp	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic cloud connect 7 cc716	scope:	lt	version:	2.2	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1514spt-2 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1514spt f-2 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1515f-2 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518-4 pn\/dp	scope:	lt	version:	21.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518f-4 pn\/dp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1516-3 pn\/dp	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1511-1 pn	scope:	lt	version:	21.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu s7-1518-4 pn\/dp odk	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1516tf-3 pn\/dp	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1515r-2 pn tx rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1511-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1511f-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1517h-3 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1517t-3 pn\/dp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1512sp-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 software controller	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1515r-2 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1517tf-3 pn\/dp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1517f-3 pn\/dp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518-4 pn\/dp mfp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus et 200sp cpu 1512sp f-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1513f-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1515f-2 pn t2 rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1515tf-2 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	simatic cloud connect 7 cc712	scope:	lt	version:	2.2	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1512sp f-1 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1513-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1513f-1 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1510sp f-1 pn	scope:	lt	version:	3.0.3	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1515f-2 pn rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518f-4 pn\/dp mfp	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	siplus s7-1500 cpu 1511-1 pn tx rail	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-1500 cpu 1518hf-4 pn	scope:	lt	version:	2.9.7	Trust: 1.0
vendor:	siemens	model:	simatic s7-plcsim advanced	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic s7-1200 cpu family	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	simatic cloud connect cc712	scope:	eq	version:	7<v2.2	Trust: 0.6
vendor:	siemens	model:	simatic cloud connect cc716	scope:	eq	version:	7<v2.2	Trust: 0.6
vendor:	siemens	model:	simatic drive controller cpu 1504d tf	scope:	lt	version:	v2.9.7	Trust: 0.6
vendor:	siemens	model:	simatic drive controller cpu 1504d tf	scope:	gte	version:	v3.0.1,<v3.0.3	Trust: 0.6
vendor:	siemens	model:	simatic drive controller cpu 1507d tf	scope:	lt	version:	v2.9.7	Trust: 0.6
vendor:	siemens	model:	simatic drive controller cpu 1507d tf	scope:	gte	version:	v3.0.1,<v3.0.3	Trust: 0.6
vendor:	siemens	model:	simatic et 200sp open controller cpu 1515sp pc2	scope:	lt	version:	v21.9.7	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 cpu 1510sp f-1 pn	scope:	lt	version:	v2.9.7	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 cpu 1510sp f-1 pn	scope:	lt	version:	v3.0.3	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 cpu 1510sp-1 pn	scope:	lt	version:	v2.9.7	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 cpu 1510sp-1 pn	scope:	lt	version:	v3.0.3	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 cpu pn	scope:	eq	version:	1511-1<v3.0.3	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 cpu 1511f-1 pn	scope:	lt	version:	v3.0.3	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 cpu 1511t-1 pn	scope:	lt	version:	v2.9.7	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 cpu 1511t-1 pn	scope:	lt	version:	v3.0.3	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 software controller	scope:	eq	version:	v2<v21.9.7	Trust: 0.6
vendor:	siemens	model:	simatic s7-1500 software controller	scope:	eq	version:	v3	Trust: 0.6
vendor:	siemens	model:	siplus et 200sp cpu 1510sp f-1 pn	scope:	lt	version:	v2.9.7	Trust: 0.6
vendor:	siemens	model:	siplus et 200sp cpu 1510sp f-1 pn rail	scope:	lt	version:	v2.9.7	Trust: 0.6
vendor:	siemens	model:	siplus et 200sp cpu 1510sp-1 pn	scope:	lt	version:	v2.9.7	Trust: 0.6
vendor:	siemens	model:	siplus s7-1500 cpu 1518hf-4 pn	scope:	lt	version:	v3.0.3	Trust: 0.6

sources: CNVD: CNVD-2023-69803 // NVD: CVE-2023-28831

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2023-28831
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2023-69803
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2023-69803
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

NVD:	CVE-2023-28831
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2023-69803 // NVD: CVE-2023-28831

PROBLEMTYPE DATA

problemtype:

CWE-190

Trust: 1.0

sources: NVD: CVE-2023-28831

CONFIGURATIONS

sources: NVD: CVE-2023-28831

PATCH

title:

Patch for Siemens SIMATIC product ANSI C OPC UA SDK denial of service vulnerability

url:

https://www.cnvd.org.cn/patchinfo/show/460891

Trust: 0.6

sources: CNVD: CNVD-2023-69803

EXTERNAL IDS

db:	NVD	id:	CVE-2023-28831	Trust: 1.7
db:	SIEMENS	id:	SSA-711309	Trust: 1.7
db:	CNVD	id:	CNVD-2023-69803	Trust: 0.6
db:	VULMON	id:	CVE-2023-28831	Trust: 0.1

sources: CNVD: CNVD-2023-69803 // VULMON: CVE-2023-28831 // NVD: CVE-2023-28831

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-711309.pdf	Trust: 1.1
url:	https://cert-portal.siemens.com/productcert/html/ssa-711309.html	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/190.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2023-69803 // VULMON: CVE-2023-28831 // NVD: CVE-2023-28831

SOURCES

db:	CNVD	id:	CNVD-2023-69803
db:	VULMON	id:	CVE-2023-28831
db:	NVD	id:	CVE-2023-28831

LAST UPDATE DATE

2023-09-21T22:47:29.517000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2023-69803	date:	2023-09-15T00:00:00
db:	VULMON	id:	CVE-2023-28831	date:	2023-09-12T00:00:00
db:	NVD	id:	CVE-2023-28831	date:	2023-09-20T14:03:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2023-69803	date:	2023-09-14T00:00:00
db:	VULMON	id:	CVE-2023-28831	date:	2023-09-12T00:00:00
db:	NVD	id:	CVE-2023-28831	date:	2023-09-12T10:15:00