CVE-2023-42796highCWE-22

CVE-2023-42796: high-severity vulnerability in Siemens CP-8031 MASTER MODULE

Published · Updated

Follow this CVE+ Monitor CP-8031 MASTER MODULE+ Monitor CP-8050 MASTER MODULE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11). The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint. This could allow an authenticated remote attacker to traverse directories on the system and download arbitrary files. By exploring active session IDs, the vulnerability could potentially be leveraged to escalate privileges to the administrator role.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Affected products
Siemens · CP-8031 MASTER MODULESiemens · CP-8050 MASTER MODULE
Related CVEs — Siemens CP-8031 MASTER MODULE

In the same product, most dangerous first.

CVE-2023-33919HIGHCVE-2023-33919EPSS 47.7%CVE-2023-28489CRITICALCVE-2023-28489EPSS 2.8%CVE-2023-42797MEDIUMCVE-2023-42797EPSS 0.5%CVE-2023-36380CRITICALCVE-2023-36380EPSS 0.4%CVE-2023-33921MEDIUMCVE-2023-33921EPSS 0.4%CVE-2023-33920MEDIUMCVE-2023-33920EPSS 0.4%