CVE-2023-35920: simatic mv540 h firmware before 3.3.4 (exclusive); +17 more affected products

Affected technology

simatic mv540 h firmware · before 3.3.4 (exclusive)
siemens

simatic mv540 s firmware · before 3.3.4 (exclusive)
siemens

simatic mv550 h firmware · before 3.3.4 (exclusive)
siemens

simatic mv550 s firmware · before 3.3.4 (exclusive)
siemens

simatic mv560 u firmware · before 3.3.4 (exclusive)
siemens

simatic mv560 x firmware · before 3.3.4 (exclusive)
siemens

SIMATIC MV540 H · All versions < V3.3.4
Siemens

SIMATIC MV540 S · All versions < V3.3.4
Siemens

SIMATIC MV550 H · All versions < V3.3.4
Siemens

SIMATIC MV550 S · All versions < V3.3.4
Siemens

SIMATIC MV560 U · All versions < V3.3.4
Siemens

SIMATIC MV560 X · All versions < V3.3.4
Siemens

simatic_mv540_h · 0 to before V3.3.4
siemens

simatic_mv540_s · 0 to before V3.3.4
siemens

simatic_mv550_h · 0 to before V3.3.4
siemens

simatic_mv550_s · 0 to before V3.3.4
siemens

simatic_mv560_u · 0 to before V3.3.4
siemens

simatic_mv560_x · 0 to before V3.3.4
siemens

Description’s affected range: versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker could cause a denial of service condition. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.