Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-23588

A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC647D (All versions), SIMATIC IPC647E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC847D (All versions), SIMATIC IPC847E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows). The Adaptec Maxview application on affected devices is using a non-unique TLS certificate across installations to protect the communication from the local browser to the local application. A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.

Published

2023-04-11T10:15:18.097

Last Modified

2024-11-21T07:46:29.217

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.2 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-200
  • Type: Primary
    CWE-295
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System siemens simatic_ipc647d_firmware * Yes
Hardware siemens simatic_ipc647d - No
Operating System siemens simatic_ipc847d_firmware * Yes
Hardware siemens simatic_ipc847d - No
Operating System siemens simatic_ipc1047_firmware * Yes
Hardware siemens simatic_ipc1047 - No
Application microchip maxview_storage_manager < 4.09.00.25611 Yes
Hardware siemens simatic_ipc1047e - No
Hardware siemens simatic_ipc647e - No
Hardware siemens simatic_ipc847e - No
References