Siemens COMOS
COMOS before V10.5 is affected by two local code execution vulnerabilities in the integrated Open Design Alliance Drawings SDK. Siemens has released a new version for COMOS and recommends to update to the latest version.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-5180US | high7.8 | Exploit | ||
An issue was discovered in Open Design Alliance
Drawings SDK before 2024.12. A corrupted value of number
of sectors used by the Fat structure in a crafted DGN file leads to an
out-… | ||||
| CVE-2023-26495US | high7.8 | — | ||
An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage th… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-659443: Local Code Execution Vulnerabilities in COMOS Before V10.5 - CSAF Versionself
- SSA-659443: Local Code Execution Vulnerabilities in COMOS Before V10.5 - HTML Versionself
- ICS Advisory ICSA-24-228-08 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-228-08 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (4)
- MitigationCOMOS
CVE-2023-5180, CVE-2023-26495: Ensure all files imported into the affected product originate from a trusted source and are transmitted over secure channels
- MitigationCOMOS
CVE-2023-5180, CVE-2023-26495: Ensure all files imported into the affected product originate from a trusted source and are transmitted over secure channels
- BehobenCOMOS
Update to V10.5 or later version
- BehobenCOMOS
Update to V10.5 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan