CVE-2023-29104
MediumCVSS 6.0Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A vulnerability in SIMATIC Cloud Connect 7 CC712 (versions >= V2.0 < V2.1) and CC716 (versions >= V2.0 < V2.1) involves a path traversal flaw in the upload feature of the web-based management. An authenticated privileged remote attacker could overwrite or download any file the Linux user 'ccuser' has write or read-only access to, respectively.
Risk Assessment
This could lead to unauthorized modification or disclosure of files, posing a risk to system integrity and confidentiality.
Recommendation
Update SIMATIC Cloud Connect 7 to version V2.1 or later.
Other vulnerabilities in SIMATIC Cloud Connect 7
See all- CVE-2023-29128Low
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1) and CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file with the extension `.db`.
- CVE-2023-29107Medium
In SIMATIC Cloud Connect 7 CC712 (versions >= V2.0 < V2.1) and CC716 (versions >= V2.0 < V2.1), the export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources.
- CVE-2023-29106Medium
The export endpoint in SIMATIC Cloud Connect 7 is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download files available via the endpoint.
- CVE-2023-29105Medium
SIMATIC Cloud Connect 7 devices (CC712 and CC716) in versions prior to V2.1 are vulnerable to a denial of service when parsing a random non-JSON MQTT payload. An attacker able to manipulate communication between the MQTT broker and the device can cause a denial of service.
Original NVD description (English source)
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to overwrite any file the Linux user `ccuser` has write access to, or to download any file the Linux user `ccuser` has read-only access to.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS