CVE-2023-37194

State: Published
Severity: 6.7 Medium
Published: Oct 10, 2023
Updated: Sep 19, 2024
Reserved: Jun 28, 2023

Description

A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 1628 (All versions). The kernel memory of affected devices is exposed to user-mode via direct memory access (DMA) which could allow a local attacker with administrative privileges to execute arbitrary code on the host system without any restrictions.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
SIMATIC CP 1604Siemens	All versionsAffected
SIMATIC CP 1616Siemens	All versionsAffected
SIMATIC CP 1623Siemens	All versionsAffected
SIMATIC CP 1626Siemens	All versionsAffected
SIMATIC CP 1628Siemens	All versionsAffected

References

https://cert-portal.siemens.com/productcert/pdf/ssa-784849.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.