CVE-2023-23588
Description
A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC647D (All versions), SIMATIC IPC647E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC847D (All versions), SIMATIC IPC847E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows). The Adaptec Maxview application on affected devices is using a non-unique TLS certificate across installations to protect the communication from the local browser to the local application. A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.
Affected products
11All versions+ 2 more
- (no CPE)range: All versions
- (no CPE)range: All versions
- (no CPE)range: All versions with maxView Storage Manager < 4.09.00.25611 on Windows
All versions+ 1 more
- (no CPE)range: All versions
- cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:*
- (no CPE)range: All versions
- cpe:2.3:o:siemens:simatic_ipc1047_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:microchip:maxview_storage_manager:*:*:*:*:*:windows:*:*Range: <4.09.00.25611
All versions with maxView Storage Manager < 4.09.00.25611 on Windows+ 1 more
- (no CPE)range: All versions with maxView Storage Manager < 4.09.00.25611 on Windows
- (no CPE)range: All versions with maxView Storage Manager < 4.09.00.25611 on Windows
Patches
Vulnerability mechanics
References
1- cert-portal.siemens.com/productcert/pdf/ssa-511182.pdfnvdVendor Advisory
News mentions
0No linked articles in our index yet.