CVE-2023-28829

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-477

Affected software

Vendor	Product	Versions
Siemens	SIMATIC NET PC Software V14	All versions
Siemens	SIMATIC NET PC Software V15	All versions
Siemens	SIMATIC PCS 7 V8.2	All versions
Siemens	SIMATIC PCS 7 V9.0	All versions
Siemens	SIMATIC PCS 7 V9.1	All versions
Siemens	SIMATIC WinCC	All versions < V8.0
Siemens	SINAUT Software ST7sc	All versions

References

https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdfPatch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdfPatch, Vendor Advisory

Timeline

Published: Jun 13, 2023
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-28838.8Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass. This iss CVE-2023-288307.8A vulnerability has been identified in JT2Go (All versions < V14.2.0.5), Solid Edge SE2022 (All versions < V222.0 Update 13), Solid Edge SE2 CVE-2023-288317.5The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application CVE-2023-288327.2A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versi CVE-2023-288338.8Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favico CVE-2023-288344.3Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud CVE-2023-288357.5Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was CVE-2023-288365.4Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored CVE-2023-288374.9Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wa CVE-2023-288388.1GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection v CVE-2023-288399.8Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data. The module Shoppingfeed for PrestaShop is vul CVE-2023-28849.8Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allow