CVE-2023-23588

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC647D (All versions), SIMATIC IPC647E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC847D (All versions), SIMATIC IPC847E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows). The Adaptec Maxview application on affected devices is using a non-unique TLS certificate across installations to protect the communication from the local browser to the local application. A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-200CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Apr 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-235896.5The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protoCVE-2023-23598.8The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload CVE-2023-235907.5Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated CVE-2023-235914.9The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs CVE-2023-235927.5WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information.CVE-2023-235949.8An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remCVE-2023-235957.5BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, sCVE-2023-235968.8jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with CVE-2023-235976.5A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `fiCVE-2023-235986.5Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being drCVE-2023-235996.5When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow CVE-2023-23607.5Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) befor