Riskcovery

CVE-2023-23588

State
Published
Severity
6.2 Medium
Published
Apr 11, 2023
Updated
Oct 15, 2024
Reserved
Jan 13, 2023

Read the record on cve.org

Description

A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC647D (All versions), SIMATIC IPC647E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC847D (All versions), SIMATIC IPC847E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows). The Adaptec Maxview application on affected devices is using a non-unique TLS certificate across installations to protect the communication from the local browser to the local application. A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.

Scores

CVSSScoreVectorSource
3.16.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csiemens

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
SIMATIC IPC1047Siemens
  • All versionsAffected
SIMATIC IPC1047ESiemens
  • All versions with maxView Storage Manager < 4.09.00.25611 on WindowsAffected
SIMATIC IPC647DSiemens
  • All versionsAffected
SIMATIC IPC647ESiemens
  • All versions with maxView Storage Manager < 4.09.00.25611 on WindowsAffected
SIMATIC IPC847DSiemens
  • All versionsAffected
SIMATIC IPC847ESiemens
  • All versions with maxView Storage Manager < 4.09.00.25611 on WindowsAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.