CVE-2023-29106
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
The export endpoint in SIMATIC Cloud Connect 7 is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download files available via the endpoint.
Risk Assessment
This could lead to unauthorized access to sensitive files and data, posing a significant risk to information confidentiality in industrial environments.
Recommendation
Update SIMATIC Cloud Connect 7 to version V2.1 or later to fix the vulnerability.
Other vulnerabilities in SIMATIC Cloud Connect 7
See all- CVE-2023-29128Low
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1) and CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file with the extension `.db`.
- CVE-2023-29107Medium
In SIMATIC Cloud Connect 7 CC712 (versions >= V2.0 < V2.1) and CC716 (versions >= V2.0 < V2.1), the export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources.
- CVE-2023-29105Medium
SIMATIC Cloud Connect 7 devices (CC712 and CC716) in versions prior to V2.1 are vulnerable to a denial of service when parsing a random non-JSON MQTT payload. An attacker able to manipulate communication between the MQTT broker and the device can cause a denial of service.
- CVE-2023-29104Medium
A vulnerability in SIMATIC Cloud Connect 7 CC712 (versions >= V2.0 < V2.1) and CC716 (versions >= V2.0 < V2.1) involves a path traversal flaw in the upload feature of the web-based management. An authenticated privileged remote attacker could overwrite or download any file the Linux user 'ccuser' has write or read-only access to, respectively.
Original NVD description (English source)
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS