CVE-2023-26293: tia portal 15, 16, 17 (+1 more affected versions); +4 more affected products

Affected technology

tia portal · 15
siemens

tia portal · 16
siemens

tia portal · 17
siemens

tia portal · 17 · update update1
siemens

tia portal · 17 · update update2
siemens

tia portal · 17 · update update3
siemens

tia portal · 17 · update update4
siemens

tia portal · 17 · update update5
siemens

tia portal · 18
siemens

Totally Integrated Automation Portal (TIA Portal) V15 · 0 to before *
Siemens

Totally Integrated Automation Portal (TIA Portal) V16 · 0 to before V16 Update 7
Siemens

Totally Integrated Automation Portal (TIA Portal) V17 · 0 to before V17 Update 6
Siemens

Totally Integrated Automation Portal (TIA Portal) V18 · 0 to before V18 Update 1
Siemens

Description’s affected range: versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automa

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

The source says if the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution. Vendor/CNA’s CVSS 3.1 assessment (base score 7.3/10) rates confidentiality and integrity impact as high; availability impact as low. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.