CVE-2023-28829: simatic net pc software 14.0, 15.0; +10 more affected products

Affected technology

simatic net pc software · 14.0
siemens

simatic net pc software · 15.0
siemens

simatic pcs 7 · 8.2
siemens

simatic pcs 7 · 9.0
siemens

simatic pcs 7 · 9.1
siemens

simatic wincc · before 8.0 (exclusive)
siemens

sinaut st7sc · Exact affected versions not specified by the source
siemens

SIMATIC NET PC Software V14 · All versions
Siemens

SIMATIC NET PC Software V15 · All versions
Siemens

SIMATIC PCS 7 V8.2 · All versions
Siemens

SIMATIC PCS 7 V9.0 · All versions
Siemens

SIMATIC PCS 7 V9.1 · All versions
Siemens

SIMATIC WinCC · All versions < V8.0
Siemens

SINAUT Software ST7sc · All versions
Siemens

Description’s affected range: versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (Al

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Adjacent network · High privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 3.9/10) rates confidentiality, integrity and availability impact as low. NVD’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.