CVE-2023-29106CWE-200information-disclosure

CVE-2023-29106

Medium · published May 9, 2023

CVSS v3.1

5.3

EPSS

Percentile

53.3

In the wild

Unconfirmed

What it is

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00718 · 53.3th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2023-05-09T17:15Z

Affected products (2)

Product	Versions	Fixed in
siemens/6gk1411-1ac00_firmware	all versions	—
siemens/6gk1411-5ac00_firmware	all versions	—

References (2)

https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · [email protected]https://cert-portal.siemens.com/productcert/pdf/ssa-555292.pdf · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

09 MAY 11:51Z
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1)
cvelistv5