CVE-2023-33919highCWE-77

CVE-2023-33919: high-severity vulnerability in Siemens CP-8031 MASTER MODULE

Published · Updated

Follow this CVE+ Monitor CP-8031 MASTER MODULE+ Monitor CP-8050 MASTER MODULE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 48%
In short

A web interface flaw in CP-8031 and CP-8050 devices allows an authenticated administrator to run malicious commands with full system access by sending specially crafted input. This gives attackers complete control over the affected device.

Technical detail

The web interface fails to sanitize user input on the server side, enabling command injection attacks. An authenticated attacker with administrative privileges can inject arbitrary OS commands that execute with root-level access, leading to complete system compromise.

Summary generated and translated by AI from the official description.
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Affected products
Siemens · CP-8031 MASTER MODULESiemens · CP-8050 MASTER MODULE
Related CVEs — Siemens CP-8031 MASTER MODULE

In the same product, most dangerous first.

CVE-2023-28489CRITICALCVE-2023-28489EPSS 2.8%CVE-2023-42796HIGHCVE-2023-42796EPSS 1.0%CVE-2023-42797MEDIUMCVE-2023-42797EPSS 0.5%CVE-2023-36380CRITICALCVE-2023-36380EPSS 0.4%CVE-2023-33921MEDIUMCVE-2023-33921EPSS 0.4%CVE-2023-33920MEDIUMCVE-2023-33920EPSS 0.4%