Sign-up

ID

VAR-202401-0196


CVE

CVE-2023-49251


TITLE

Siemens SIMATIC CN 4100 Authorization Bypass Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-01397

DESCRIPTION

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up. SIMATIC CN 4100 is a communication node that can connect to third-party systems

Trust: 1.44

sources: NVD: CVE-2023-49251 // CNVD: CNVD-2024-01397

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-01397

AFFECTED PRODUCTS

vendor:siemensmodel:simatic cn 4100scope:ltversion:2.7

Trust: 1.0

vendor:siemensmodel:simatic cnscope:eqversion:4100<2.7

Trust: 0.6

sources: CNVD: CNVD-2024-01397 // NVD: CVE-2023-49251

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-49251
value: CRITICAL

Trust: 1.0

productcert@siemens.com: CVE-2023-49251
value: HIGH

Trust: 1.0

CNVD: CNVD-2024-01397
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-01397
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-49251
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2023-49251
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-01397 // NVD: CVE-2023-49251 // NVD: CVE-2023-49251

PROBLEMTYPE DATA

problemtype:CWE-639

Trust: 1.0

sources: NVD: CVE-2023-49251

PATCH

title:Patch for Siemens SIMATIC CN 4100 Authorization Bypass Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/514121

Trust: 0.6

sources: CNVD: CNVD-2024-01397

EXTERNAL IDS

db:SIEMENSid:SSA-777015

Trust: 1.6

db:NVDid:CVE-2023-49251

Trust: 1.6

db:CNVDid:CNVD-2024-01397

Trust: 0.6

sources: CNVD: CNVD-2024-01397 // NVD: CVE-2023-49251

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf

Trust: 1.0

url:https://cert-portal.siemens.com/productcert/html/ssa-777015.html

Trust: 0.6

sources: CNVD: CNVD-2024-01397 // NVD: CVE-2023-49251

SOURCES

db:CNVDid:CNVD-2024-01397
db:NVDid:CVE-2023-49251

LAST UPDATE DATE

2025-03-14T22:46:16.852000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-01397date:2024-01-10T00:00:00
db:NVDid:CVE-2023-49251date:2024-01-12T15:37:49.740

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-01397date:2024-01-10T00:00:00
db:NVDid:CVE-2023-49251date:2024-01-09T10:15:19.910