CVE-2023-26293

HighCVSS 7.3/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-20CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Apr 11, 2023
Last modified
Oct 23, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-262947.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262959.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262968.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262978.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262988.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262997.0A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (systeCVE-2023-26304.8Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-263007.8A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privileCVE-2023-263019.8Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a laCVE-2023-263025.5Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid CVE-2023-263035.5Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially craftCVE-2023-263099.8A remote code execution vulnerability in the webview component of OnePlus Store app.