Veille CVE

Semaine du 8 mai au 14 mai 2023

3 CVE sur 18

Critique 2 Élevée 9 Moyenne 4 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2023-29128 2.7 Faible

    Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Cloud Connect 7 CC716 · Siemens 6gk1411-1ac00 firmware · Siemens 6gk1411-5ac00 firmware

    A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file with the extension `.db`.

  2. CVE-2023-27409 3.3 Faible

    Siemens SCALANCE LPE9403 · Siemens scalance lpe9403 firmware

    A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A path traversal vulnerability was found in the `deviceinfo` binary via the `mac` parameter. This could allow an authenticated attacker with access to the SSH interface on the affected device to read the contents of any file named `address`.

  3. CVE-2023-27408 3.3 Faible

    Siemens SCALANCE LPE9403 · Siemens scalance lpe9403 firmware

    A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The `i2c` mutex file is created with the permissions bits of `-rw-rw-rw-`. This file is used as a mutex for multiple applications interacting with i2c. This could allow an authenticated attacker with access to the SSH interface on the affected device to interfere with the integrity of the mutex and the data it protects.