Riskcovery

CVE-2023-28489

State
Published
Severity
9.8 Critical
Published
Apr 11, 2023
Updated
Feb 13, 2025
Reserved
Mar 16, 2023

Read the record on cve.org

Description

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter “Remote Operation” is enabled. The parameter is disabled by default. The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csiemens

Weaknesses

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

ProductVersions
CP-8031 MASTER MODULESiemens
  • All versions < CPCI85 V05Affected
CP-8050 MASTER MODULESiemens
  • All versions < CPCI85 V05Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.