CVE-2023-29105CWE-544

CVE-2023-29105

Medium · published May 9, 2023

CVSS v3.1
5.9
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions < V2.1). The affected device is vulnerable to a denial of service while parsing a random (non-JSON) MQTT payload. This could allow an attacker who can manipulate the communication between the MQTT broker and the affected device to cause a denial of service (DoS).

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00551 · 45.3th percentile
Weakness
CWE-544 · Missing Standardized Error Handling Mechanism
Published
2023-05-09T17:15Z
Affected products (2)
ProductVersionsFixed in
siemens/6gk1411-1ac00_firmware< 2.12.1
siemens/6gk1411-5ac00_firmware< 2.12.1
References (2)
https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · [email protected]https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 09 MAY 11:51Z
    A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1)…
    cvelistv5