SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application
The Adaptec Maxview application shipped with affected SIMATIC IPCs contains a hard coded, non-unique certificate to secure HTTPS connections between the browser and the local Maxview configuration application. A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit. Adaptec has released updates for the affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-23588US | medium6.3 | — | ||
A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC647D (All… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application - CSAF Versionself
- SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application - HTML Versionself
- SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application - PDF Versionself
- SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application - TXT Versionself
Behebungen (12)
- Kein Fix geplantSIMATIC IPC1047
Currently no fix is planned
- Kein Fix geplantSIMATIC IPC647D
Currently no fix is planned
- Kein Fix geplantSIMATIC IPC847D
Currently no fix is planned
- BehobenSIMATIC IPC1047E
Update maxView Storage Manager to 4.09.00.25611 or later version
https://storage.microsemi.com/en-us/support/raid/sas_raid/asr-3151-4i/ - BehobenSIMATIC IPC647E
Update maxView Storage Manager to 4.09.00.25611 or later version
https://storage.microsemi.com/en-us/support/raid/sas_raid/asr-3151-4i/ - BehobenSIMATIC IPC847E
Update maxView Storage Manager to 4.09.00.25611 or later version
https://storage.microsemi.com/en-us/support/raid/sas_raid/asr-3151-4i/ - WorkaroundSIMATIC IPC1047
Update the default self-signed device X.509 certificate with an own trusted certificate
- WorkaroundSIMATIC IPC1047E
Update the default self-signed device X.509 certificate with an own trusted certificate
- WorkaroundSIMATIC IPC647D
Update the default self-signed device X.509 certificate with an own trusted certificate
- WorkaroundSIMATIC IPC647E
Update the default self-signed device X.509 certificate with an own trusted certificate
- WorkaroundSIMATIC IPC847D
Update the default self-signed device X.509 certificate with an own trusted certificate
- WorkaroundSIMATIC IPC847E
Update the default self-signed device X.509 certificate with an own trusted certificate
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan