We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Ok

THREATINT
PUBLISHED

CVE-2023-28766

Reserved:2023-03-23
Published:2023-04-11
Updated:2024-05-15

Description

A vulnerability has been identified in SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 6MD86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 6MD89 (CP300) (All versions >= V7.80 < V9.64), SIPROTEC 5 6MU85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7KE85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SA82 (CP100) (All versions), SIPROTEC 5 7SA82 (CP150) (All versions < V9.40), SIPROTEC 5 7SA86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SA87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SD82 (CP100) (All versions), SIPROTEC 5 7SD82 (CP150) (All versions < V9.40), SIPROTEC 5 7SD86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SD87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SJ81 (CP100) (All versions < V8.89), SIPROTEC 5 7SJ81 (CP150) (All versions < V9.40), SIPROTEC 5 7SJ82 (CP100) (All versions < V8.89), SIPROTEC 5 7SJ82 (CP150) (All versions < V9.40), SIPROTEC 5 7SJ85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SJ86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SK82 (CP100) (All versions < V8.89), SIPROTEC 5 7SK82 (CP150) (All versions < V9.40), SIPROTEC 5 7SK85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SL82 (CP100) (All versions), SIPROTEC 5 7SL82 (CP150) (All versions < V9.40), SIPROTEC 5 7SL86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SL87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SS85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7ST85 (CP300) (All versions >= V7.80 < V9.64), SIPROTEC 5 7ST86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7SX82 (CP150) (All versions < V9.40), SIPROTEC 5 7SX85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7UM85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7UT82 (CP100) (All versions), SIPROTEC 5 7UT82 (CP150) (All versions < V9.40), SIPROTEC 5 7UT85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7UT86 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7UT87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7VE85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7VK87 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 7VU85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 Communication Module ETH-BA-2EL (All versions < V9.40 installed on CP150 and CP300 devices), SIPROTEC 5 Communication Module ETH-BA-2EL (All versions < V8.89 installed on CP100 devices), SIPROTEC 5 Communication Module ETH-BB-2FO (All versions < V9.40 installed on CP150 and CP300 devices), SIPROTEC 5 Communication Module ETH-BB-2FO (All versions < V8.89 installed on CP100 devices), SIPROTEC 5 Communication Module ETH-BD-2FO (All versions < V9.40), SIPROTEC 5 Compact 7SX800 (CP050) (All versions < V9.40). Affected devices lack proper validation of http request parameters of the hosted web service. An unauthenticated remote attacker could send specially crafted packets that could cause denial of service condition of the target device.



HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

Problem types

CWE-476: NULL Pointer Dereference

Product status

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.64
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before *
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before *
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before *
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.64
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before *
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

V7.80 before V9.40
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

Any version before V8.89
affected

Default status
unknown

Any version before V9.40
affected

Default status
unknown

Any version before V9.40
affected

References

https://cert-portal.siemens.com/productcert/pdf/ssa-322980.pdf

https://cert-portal.siemens.com/productcert/html/ssa-322980.html

cve.org CVE-2023-28766

nvd.nist.gov CVE-2023-28766

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-28766