Siemens Desigo CC product family
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on the Desigo CC server, or create a denial of service condition. While all Desigo CC version lines V5.0, V5.1 and V6 are affected by all listed vulnerabilities, V7 is only affected by CVE-2023-3935. Siemens has released a patch to update the CodeMeter Runtime component and recommends to apply the patch on affected systems.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-3935US | — | — | ||
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of… | ||||
| CVE-2021-20094US | high7.5 | — | ||
A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to crash the CodeMeter Runtime Server… | ||||
| CVE-2021-20093US | critical9.1 | — | ||
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or cr… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-625850: Multiple WIBU Systems CodeMeter Vulnerabilities Affecting the Desigo CC Product Family and SENTRON powermanager - CSAF Versionself
- SSA-625850: Multiple WIBU Systems CodeMeter Vulnerabilities Affecting the Desigo CC Product Family and SENTRON powermanager - HTML Versionself
- ICS Advisory ICSA-23-320-03 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-320-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (13)
- BehobenDesigo CC family V5.0
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.0
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.0
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.1
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.1
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V5.1
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V6
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V6
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V6
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenDesigo CC family V7
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenSENTRON powermanager
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenSENTRON powermanager
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
- BehobenSENTRON powermanager
Install the patch (available at https://support.industry.siemens.com/cs/ww/en/view/109825787/), which can be applied to all released versions
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan