CVE-2023-33919

Vulnerability

The web interface of Siemens CP-8031 MASTER MODULE (all versions < CPCI85 V05) and CP-8050 MASTER MODULE (all versions < CPCI85 V05) is vulnerable to command injection due to missing server-side input sanitization [1]. This allows an authenticated privileged remote attacker to inject arbitrary commands.

Exploitation

An attacker with authenticated privileged access to the web interface can send specially crafted requests that bypass input validation, leading to command injection. No user interaction is required beyond the initial authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges, resulting in full compromise of the device's confidentiality, integrity, and availability.

Mitigation

Siemens has released firmware version CPCI85 V05 to address this vulnerability. Users should update to CPCI85 V05 or later. No workarounds are documented in the available references [1].