CVE-2023-29128
LowCVSS 3.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1) and CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file with the extension `.db`.
Risk Assessment
An attacker with privileges can write malicious files to the device, potentially leading to further escalation or disruption. This affects the integrity of the system.
Recommendation
Update SIMATIC Cloud Connect 7 to version V2.1 or later. Restrict access to the web interface and apply the principle of least privilege.
Other vulnerabilities in SIMATIC Cloud Connect 7
See all- CVE-2023-29107Medium
In SIMATIC Cloud Connect 7 CC712 (versions >= V2.0 < V2.1) and CC716 (versions >= V2.0 < V2.1), the export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources.
- CVE-2023-29106Medium
The export endpoint in SIMATIC Cloud Connect 7 is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download files available via the endpoint.
- CVE-2023-29105Medium
SIMATIC Cloud Connect 7 devices (CC712 and CC716) in versions prior to V2.1 are vulnerable to a denial of service when parsing a random non-JSON MQTT payload. An attacker able to manipulate communication between the MQTT broker and the device can cause a denial of service.
- CVE-2023-29104Medium
A vulnerability in SIMATIC Cloud Connect 7 CC712 (versions >= V2.0 < V2.1) and CC716 (versions >= V2.0 < V2.1) involves a path traversal flaw in the upload feature of the web-based management. An authenticated privileged remote attacker could overwrite or download any file the Linux user 'ccuser' has write or read-only access to, respectively.
Original NVD description (English source)
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacker to write any file with the extension `.db`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS