CVE-2023-36380

State: Published
Severity: 9.8 Critical
Published: Oct 10, 2023
Updated: Feb 27, 2025
Reserved: Jun 21, 2023

Description

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)). The affected devices contain a hard-coded ID in the SSH `authorized_keys` configuration file. An attacker with knowledge of the corresponding private key could login to the device via SSH. Only devices with activated debug support are affected.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
CP-8031 MASTER MODULESiemens	All versions < CPCI85 V05.11 (only with activated debug support)Affected
CP-8050 MASTER MODULESiemens	All versions < CPCI85 V05.11 (only with activated debug support)Affected

References

https://cert-portal.siemens.com/productcert/pdf/ssa-134651.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.