Riskcovery

CVE-2023-30757

State
Published
Severity
6.2 Medium
Published
Jun 13, 2023
Updated
Dec 10, 2024
Reserved
Apr 14, 2023

Read the record on cve.org

Description

A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions), Totally Integrated Automation Portal (TIA Portal) V20 (All versions). The know-how protection feature in affected products does not properly update the encryption of existing program blocks when a project file is updated.

This could allow attackers with access to the project file to recover previous - yet unprotected - versions of the project without the knowledge of the know-how protection password.

Scores

CVSSScoreVectorSource
3.16.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:T/RC:Csiemens

Weaknesses

  • CWE-693 Protection Mechanism Failure

Affected Products

ProductVersions
Totally Integrated Automation Portal (TIA Portal) V14Siemens
  • all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V15Siemens
  • all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V15.1Siemens
  • all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V16Siemens
  • all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V17Siemens
  • all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V18Siemens
  • all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V19Siemens
  • all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V20Siemens
  • all versionsAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.