Siemens Industrial Products Web Server NULL Pointer Dereference Vulnerabilities (CVE-2023-28827/30755/30756)

Key Information Vulnerability Description Vulnerability ID: SSA-423808 Vulnerability Type: Multiple NULL pointer dereference vulnerabilities Affected Products: Multiple industrial products Impact: May lead to denial-of-service attacks Affected Scope Affected Versions: All versions of all affected products Remediation Recommendation: Update to the latest version or apply specific patches CVSS Scores CVSS v3.1 Base Score: 5.9 CVSS v4.0 Base score: 8.2 Workarounds and Mitigations Recommended Actions: Disable the web server on affected systems Product-specific Mitigations: Available in the specific solutions section for affected products General Security Recommendations Recommended Actions: Protect network access devices and configure environments in accordance with Siemens’ industrial security operating guidelines More Information: Available on Siemens’ industrial security website Product Description Product Type: Industrial products Product Series: Multiple product series Vulnerability Details Vulnerability ID: CVE-2023-28827 Description: The device’s web server does not properly handle certain requests, leading to watchdog timeout and potential pointer cleanup. Impact: May lead to denial-of-service attacks CVSS Score: 5.9 Vulnerability ID: CVE-2023-30755 Description: The device’s web server does not properly handle shutdown or restart requests, potentially causing resource cleanup. Impact: May lead to denial-of-service attacks CVSS Score: 4.4 Vulnerability ID: CVE-2023-30756 Description: The device’s web server does not properly handle errors, leading to NULL pointer dereference. Impact: May lead to denial-of-service attacks CVSS Score: 5.9 Additional Information Contact Information: For further inquiries regarding security vulnerabilities in Siemens products and solutions, contact Siemens ProductCERT. Historical Data: SSA-423808 was released on September 10, 2024. Terms of Use: Siemens Security Advisories are subject to Siemens’ license terms or other applicable agreements previously entered into with Siemens.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Industrial Products Web Server NULL Pointer Dereference Vulnerabilities (CVE-2023-28827/30755/30756)