CVE-2023-25910

Vulnerability

The Siemens SIMATIC PCS 7 (all versions < V9.1 SP2 UC04), SIMATIC S7-PM (all versions < V5.7 SP1 HF1 and < V5.7 SP2 HF1), and SIMATIC STEP 7 V5 (all versions < V5.7) contain a database management system that permits remote users with low privileges to use embedded functions of the database, either locally or from a network share, affecting the server. This design flaw allows an attacker to interact with the database in unintended ways.

Exploitation

An attacker needs network access to the server network and low-privileged credentials to exploit this vulnerability. By leveraging the embedded functions of the database, the attacker can execute operations that escalate to running code with elevated privileges within the database management system's server. No user interaction is required beyond network connectivity.

Impact

Successful exploitation allows the attacker to execute arbitrary code with elevated privileges in the database management system's server. This can lead to full compromise of the affected system, including data confidentiality, integrity, and availability (CIA).

Mitigation

Siemens has released fixes: for SIMATIC PCS 7, version V9.1 SP2 UC04 or later; for SIMATIC S7-PM, versions V5.7 SP1 HF1 or V5.7 SP2 HF1; and for SIMATIC STEP 7 V5, version V5.7. Users should apply the latest updates as per the advisory [1]. No workarounds are documented, but network segmentation and restricting access can reduce risk.