CVE-2023-46280

mediumpriority · track · 0EPSS 0.003 · 17 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.26% (17th) EPSS

CVSS 6.5 · medium

Is it mine?

239 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-24

A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 Upd5), SIMATIC NET PC Software V16 (All versions < V16 Update 8), SIMATIC NET PC Software V17 (All versions), SIMATIC NET PC Software V18 (All versions < V18 SP1), SIMATIC NET PC Software V19 (All versions < V19 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PDM V9.2 (All versions < V9.2 SP2 Upd3), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 Upd3), SIMATIC S7-PCT (All versions < V3.5 SP3 Update 6), SIMATIC STEP 7 V5 (All versions < V5.7 SP3), SIMATIC WinCC OA V3.17 (All versions), SIMATIC WinCC OA V3.18 (All versions < V3.18 P025), SIMATIC WinCC OA V3.19 (All versions < V3.19 P010), SIMATIC WinCC Runtime Advanced (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 6), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5), SINAMICS Startdrive (All versions < V19 SP1), SINEC NMS (All versions < V3.0), SINUMERIK ONE virtual (All versions < V6.23), SINUMERIK PLC Programming Tool (All versions < V3.3.12), TIA Portal Cloud Connector (All versions < V2.0), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 4), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 2), SINEC NMS (All versions < V3.0 SP1). The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSINEC NMSsiemens_psirt
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/
FixedSINEC NMSsiemens_psirt
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109973059/
FixedSIMATIC Automation Toolsiemens_psirt
Update to V5.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/98161300/
FixedSIMATIC BATCH V9.1siemens_psirt
Update to V9.1 SP2 Upd5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
FixedSIMATIC NET PC Software V16siemens_psirt
Update to V16 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974091/
FixedSIMATIC NET PC Software V18siemens_psirt
Update to V18 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972655/
FixedSIMATIC NET PC Software V19siemens_psirt
Update to V19 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109975600/
FixedSIMATIC PCS 7 V9.1siemens_psirt
Update to V9.1 SP2 UC05 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
FixedSIMATIC PDM V9.2siemens_psirt
Update to V9.2 SP2 Upd3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
FixedSIMATIC Route Control V9.1siemens_psirt
Update to V9.1 SP2 Upd3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
FixedSIMATIC S7-PCTsiemens_psirt
Update to V3.5 SP3 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/32469496/
FixedSIMATIC STEP 7 V5siemens_psirt
Update to V5.7 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109973519/
FixedSIMATIC WinCC OA V3.18siemens_psirt
Update to V3.18 P025 or later version
https://www.winccoa.com/downloads/category/versions-patches.html
FixedSIMATIC WinCC OA V3.19siemens_psirt
Update to V3.19 P010 or later version
https://www.winccoa.com/downloads/category/versions-patches.html
FixedSIMATIC WinCC Runtime Advancedsiemens_psirt
Update to V17 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800912/
FixedSIMATIC WinCC Runtime Professional V16siemens_psirt
Update to V16 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/
FixedSIMATIC WinCC Runtime Professional V17siemens_psirt
Update to V17 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800913/
FixedSIMATIC WinCC Runtime Professional V18siemens_psirt
Update to V18 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807225/
FixedSIMATIC WinCC Runtime Professional V19siemens_psirt
Update to V19 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820999/
FixedSIMATIC WinCC V7.5siemens_psirt
Update to V7.5 SP2 Update 17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
FixedSIMATIC WinCC V8.0siemens_psirt
Update to V8.0 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818723/
FixedSINAMICS Startdrivesiemens_psirt
Update to V19 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109963196/
FixedSINUMERIK ONE virtualsiemens_psirt
Update to V6.23 or later version
FixedSINUMERIK PLC Programming Toolsiemens_psirt
Update to V3.3.12 or later version PLC Programming Tool V3.3.12 or later versions are integrated in SINUMERIK 828D Toolbox version V5.24 or later; Updated software version can be obtained from Siemens customer support or a local partner.
FixedTIA Portal Cloud Connectorsiemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780755/
FixedTotally Integrated Automation Portal (TIA Portal) V17siemens_psirt
Update to V17 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800912/
FixedTotally Integrated Automation Portal (TIA Portal) V18siemens_psirt
Update to V18 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817218/
FixedTotally Integrated Automation Portal (TIA Portal) V19siemens_psirt
Update to V19 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109925643/
FixedSIMATIC Automation Toolcisa_csaf_ot
Update to V5.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/98161300/
FixedSIMATIC BATCH V9.1cisa_csaf_ot
Update to V9.1 SP2 Upd5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
FixedSIMATIC NET PC Software V16cisa_csaf_ot
Update to V16 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974091/
FixedSIMATIC NET PC Software V18cisa_csaf_ot
Update to V18 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972655/
FixedSIMATIC NET PC Software V19cisa_csaf_ot
Update to V19 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109975600/
FixedSIMATIC PCS 7 V9.1cisa_csaf_ot
Update to V9.1 SP2 UC05 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
FixedSIMATIC PDM V9.2cisa_csaf_ot
Update to V9.2 SP2 Upd3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
FixedSIMATIC Route Control V9.1cisa_csaf_ot
Update to V9.1 SP2 Upd3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812242/
FixedSIMATIC S7-PCTcisa_csaf_ot
Update to V3.5 SP3 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/32469496/
FixedSIMATIC STEP 7 V5cisa_csaf_ot
Update to V5.7 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109973519/
FixedSIMATIC WinCC OA V3.18cisa_csaf_ot
Update to V3.18 P025 or later version
https://www.winccoa.com/downloads/category/versions-patches.html
FixedSIMATIC WinCC OA V3.19cisa_csaf_ot
Update to V3.19 P010 or later version
https://www.winccoa.com/downloads/category/versions-patches.html
FixedSIMATIC WinCC Runtime Advancedcisa_csaf_ot
Update to V17 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800912/
FixedSIMATIC WinCC Runtime Professional V16cisa_csaf_ot
Update to V16 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/
FixedSIMATIC WinCC Runtime Professional V17cisa_csaf_ot
Update to V17 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800913/
FixedSIMATIC WinCC Runtime Professional V18cisa_csaf_ot
Update to V18 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807225/
FixedSIMATIC WinCC Runtime Professional V19cisa_csaf_ot
Update to V19 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820999/
FixedSIMATIC WinCC V7.5cisa_csaf_ot
Update to V7.5 SP2 Update 17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
FixedSIMATIC WinCC V8.0cisa_csaf_ot
Update to V8.0 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818723/
FixedSINAMICS Startdrivecisa_csaf_ot
Update to V19 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109963196/
FixedSINUMERIK ONE virtualcisa_csaf_ot
Update to V6.23 or later version
FixedSINUMERIK PLC Programming Toolcisa_csaf_ot
Update to V3.3.12 or later version PLC Programming Tool V3.3.12 or later versions are integrated in SINUMERIK 828D Toolbox version V5.24 or later; Updated software version can be obtained from Siemens customer support or a local partner.
FixedTIA Portal Cloud Connectorcisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780755/
FixedTotally Integrated Automation Portal (TIA Portal) V17cisa_csaf_ot
Update to V17 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800912/
FixedTotally Integrated Automation Portal (TIA Portal) V18cisa_csaf_ot
Update to V18 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817218/
FixedTotally Integrated Automation Portal (TIA Portal) V19cisa_csaf_ot
Update to V19 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109925643/
FixedSINEC NMScisa_csaf_ot
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109973059/
FixedSINEC NMScisa_csaf_ot
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/
No fix plannedSIMATIC NET PC Software V17siemens_psirt
Currently no fix is planned
No fix plannedSIMATIC WinCC OA V3.17siemens_psirt
Currently no fix is planned
No fix plannedSIMATIC WinCC V7.4siemens_psirt
Currently no fix is planned
No fix plannedSecurity Configuration Tool (SCT)siemens_psirt
Currently no fix is planned
No fix plannedTotally Integrated Automation Portal (TIA Portal) V15.1siemens_psirt
Currently no fix is planned
No fix plannedTotally Integrated Automation Portal (TIA Portal) V16siemens_psirt
Currently no fix is planned
No fix plannedSIMATIC NET PC Software V17cisa_csaf_ot
Currently no fix is planned
No fix plannedSIMATIC WinCC OA V3.17cisa_csaf_ot
Currently no fix is planned
No fix plannedSIMATIC WinCC V7.4cisa_csaf_ot
Currently no fix is planned
No fix plannedSecurity Configuration Tool (SCT)cisa_csaf_ot
Currently no fix is planned
No fix plannedTotally Integrated Automation Portal (TIA Portal) V15.1cisa_csaf_ot
Currently no fix is planned
No fix plannedTotally Integrated Automation Portal (TIA Portal) V16cisa_csaf_ot
Currently no fix is planned

cvss

Technical severity, 0–10. One row per scoring source.

8.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.5–8.2

v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · NCSC-NL NL

v3.16.5mediumAV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · productcert@siemens.com DEexploitability 2 · impact 4

v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US

v4.08.2highCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Hsecondary · ENISA EU

v4.08.2highCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE

v4.05.5mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-125USCWE-125USCWE-125USCWE-125USCWE-125US

affected products (239)

Products and version ranges known to be affected.

Siemens SIMATIC WinCCall versionscert_bundDEcpe:/a:siemens:simatic_wincc:-
SIMATIC Automation Toolall versionscisa_csaf_otUS
SIMATIC BATCH V9.1all versionscisa_csaf_otUS
SIMATIC NET PC Software V16all versionscisa_csaf_otUS
SIMATIC NET PC Software V17all versionscisa_csaf_otUS
SIMATIC NET PC Software V18all versionscisa_csaf_otUS
SIMATIC NET PC Software V19all versionscisa_csaf_otUS
SIMATIC PCS 7 V9.1all versionscisa_csaf_otUS
SIMATIC PDM V9.2all versionscisa_csaf_otUS
SIMATIC Route Control V9.1all versionscisa_csaf_otUS
SIMATIC S7-PCTall versionscisa_csaf_otUS
SIMATIC STEP 7 V5all versionscisa_csaf_otUS
SIMATIC WinCC OA V3.17all versionscisa_csaf_otUS
SIMATIC WinCC OA V3.18all versionscisa_csaf_otUS
SIMATIC WinCC OA V3.19all versionscisa_csaf_otUS
SIMATIC WinCC Runtime Advancedall versionscisa_csaf_otUS
SIMATIC WinCC Runtime Professional V16all versionscisa_csaf_otUS
SIMATIC WinCC Runtime Professional V17all versionscisa_csaf_otUS
SIMATIC WinCC Runtime Professional V18all versionscisa_csaf_otUS
SIMATIC WinCC Runtime Professional V19all versionscisa_csaf_otUS

showing 20 of 239

advisories (9)

Vendor and ecosystem advisories describing this.

NCSC-2024-0332Kwetsbaarheden verholpen in Siemens productenNL2024-08-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als COMOS, INTRALOG, LOGO!, NX, SCALANCE, SINEC en Teamcenter.
NCSC-2024-0433Kwetsbaarheden verholpen in Siemens productenNL2024-11-12csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDCOM, SCALANCE, SIMATIC en SINEC.
SSA-331112SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP12024-11-12csaf · siemens_psirtDE
SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
SSA-784301SSA-784301: Multiple Vulnerabilities in SINEC NMS Before V3.02024-08-13csaf · siemens_psirtDE
SINEC NMS before V3.0 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
SSA-962515SSA-962515: Out of Bounds Read Vulnerability in Industrial Products2024-05-14csaf · siemens_psirtDE
Several industrial products contain an out of bounds read vulnerability that could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel, leading to denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
WID-SEC-W-2024-1104Siemens SIMATIC WinCC und TIA Portal: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-05-13csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Siemens SIMATIC WinCC und Siemens TIA Portal ausnutzen, um einen Denial of Service Angriff durchzuführen.
ICSA-24-137-13Siemens Industrial Products2024-05-14icsa · cisa_csaf_otUS
Several industrial products contain an out of bounds read vulnerability that could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel, leading to denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
ICSA-24-228-06Siemens SINEC NMS2024-08-13icsa · cisa_csaf_otUS
SINEC NMS before V3.0 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
ICSA-24-319-04Siemens SINEC NMS2024-11-12icsa · cisa_csaf_otUS
SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2024-05-14modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan