CVE-2023-49251CWE-639

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7)

High · published January 9, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00528 · 43.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-01-09T10:00Z
EPSS history
Timeline
  • 09 JAN 10:00Z
    A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7)
    cvelistv5