CVE-2023-51438

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish® server is configured for remote system management, a vulnerability has been identified that can provide unauthorized access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
SiemensSIMATIC IPC1047EAll versions with maxView Storage Manager < V4.14.00.26068 on Windows
SiemensSIMATIC IPC647EAll versions with maxView Storage Manager < V4.14.00.26068 on Windows
SiemensSIMATIC IPC847EAll versions with maxView Storage Manager < V4.14.00.26068 on Windows

References

Timeline

Published
Jan 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-514397.8A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), TeamcenCVE-2023-51448.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231.CVE-2023-514407.5A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (AllCVE-2023-514417.2** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perCVE-2023-514428.6Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsCVE-2023-514435.9FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementCVE-2023-514447.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file upload vuCVE-2023-514454.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scriptiCVE-2023-514468.1GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to CVE-2023-514475.4Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload CVE-2023-514488.8Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability withiCVE-2023-514497.5Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or
CVE-2023-51438: Critical severity, CVSS 9.8 | Vulnix