CVE-2023-52891

mediumpriority · track · 0EPSS 0.005 · 40 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.46% (40th) EPSS

CVSS 5.3 · medium

Is it mine?

29 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMIT V10 (All versions), SIMIT V11 (All versions < V11.1). Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in Siemens products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the server.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSIMATIC Energy Manager Basicsiemens_psirt
Update to V7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827289/
FixedSIMATIC Energy Manager PROsiemens_psirt
Update to V7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827289/
FixedSIMIT V11siemens_psirt
Update to V11.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820441/
FixedSIMATIC Energy Manager Basiccisa_csaf_ot
Update to V7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827289/
FixedSIMATIC Energy Manager PROcisa_csaf_ot
Update to V7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827289/
FixedSIMIT V11cisa_csaf_ot
Update to V11.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820441/
MitigationSIMATIC Energy Manager Basicsiemens_psirt
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMATIC Energy Manager PROsiemens_psirt
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMATIC IPC DiagBasesiemens_psirt
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMATIC IPC DiagMonitorsiemens_psirt
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMIT V10siemens_psirt
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMIT V11siemens_psirt
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMATIC Energy Manager Basiccisa_csaf_ot
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMATIC Energy Manager PROcisa_csaf_ot
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMATIC IPC DiagBasecisa_csaf_ot
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMATIC IPC DiagMonitorcisa_csaf_ot
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMIT V10cisa_csaf_ot
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
MitigationSIMIT V11cisa_csaf_ot
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
No fix plannedSIMATIC IPC DiagBasesiemens_psirt
Currently no fix is planned
No fix plannedSIMATIC IPC DiagMonitorsiemens_psirt
Currently no fix is planned
No fix plannedSIMIT V10siemens_psirt
Currently no fix is planned
No fix plannedSIMATIC IPC DiagBasecisa_csaf_ot
Currently no fix is planned
No fix plannedSIMATIC IPC DiagMonitorcisa_csaf_ot
Currently no fix is planned
No fix plannedSIMIT V10cisa_csaf_ot
Currently no fix is planned

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · CISA US

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · productcert@siemens.com DEexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Siemens ProductCERT DE

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1325USCWE-1325USCWE-1325USCWE-1325USCWE-1325US

affected products (29)

Products and version ranges known to be affected.

SIMATIC Energy Manager Basicall versionscisa_csaf_otUS
SIMATIC Energy Manager PROall versionscisa_csaf_otUS
SIMATIC IPC DiagBaseall versionscisa_csaf_otUS
SIMATIC IPC DiagMonitorall versionscisa_csaf_otUS
SIMIT V10all versionscisa_csaf_otUS
SIMIT V11all versionscisa_csaf_otUS
Siemens SIMATIC Energy Manager Basic< V7.5cisa_csaf_otUS
Siemens SIMATIC Energy Manager PRO< V7.5cisa_csaf_otUS
Siemens SIMATIC IPC DiagBase≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC IPC DiagMonitor≤ vers:all/*cisa_csaf_otUS
Siemens SIMIT V10≤ vers:all/*cisa_csaf_otUS
Siemens SIMIT V11< V11.1cisa_csaf_otUS
Siemens SIMATIC Energy Manager Basic0 → V7.5enisa_euvdEU
Siemens SIMATIC Energy Manager PRO0 → V7.5enisa_euvdEU
Siemens SIMATIC IPC DiagBase0 → *enisa_euvdEU
Siemens SIMATIC IPC DiagMonitor0 → *enisa_euvdEU
Siemens SIMIT V100 → *enisa_euvdEU
Siemens SIMIT V110 → V11.1enisa_euvdEU
Siemens AG SIMATIC Energy Manager Basic≤ 7.5fstec_bduRU
Siemens AG SIMATIC Energy Manager PRO≤ 7.5fstec_bduRU

showing 20 of 29

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2024-0282Kwetsbaarheden verholpen in Siemens ProductenNL2024-07-09csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDOM, SIMATIC, SINEMA, SIPROTEC en de Engineering Platforms voor diverse systemen.
SSA-088132SSA-088132: Denial of Service Vulnerability in the OPC UA Server Implementations of Several Industrial Products2024-07-09csaf · siemens_psirtDE
Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in several industrial products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the OPC UA server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.
ICSA-24-193-07Siemens SIMATIC and SIMIT2024-07-09icsa · cisa_csaf_otUS
Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in several industrial products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the OPC UA server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2024-07-09modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan