CVE-2023-46281

CVSS 3.1 Score 7.1 of 10 (high)

Details

Published Dec 12, 2023
Updated: Feb 13, 2024
CWE ID 942

Summary

CVE-2023-46281 is a vulnerability that affects multiple Siemens products, including Opcenter Quality, SIMATIC PCS neo, SINEC NMS, SINUMERIK Integrate RunMyHMI Automotive, and Totally Integrated Automation Portal (TIA Portal) versions 14 to 18. The vulnerability arises from an overly permissive CORS (Cross-Origin Resource Sharing) policy used by the UMC Web-UI in these products. This vulnerability could be exploited by an attacker to deceive a legitimate user into triggering undesired actions. The severity of this vulnerability is rated as high, with a CVSS score of 7.1 out of 10. It requires network access and user interaction but does not require any privileges. Remediation for this vulnerability involves updating the affected products to versions V2312 (Opcenter Quality), V4.1 (SIMATIC PCS neo), V2.0 SP1 (SINEC NMS), V17 Update 7 (TIA Portal), or V18 Update 3 (TIA Portal). Organizations using these Siemens products should take immediate action to mitigate the potential risks posed by this vulnerability.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-46281 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options