cnvd - cnvd-2024-31238

cnvd-2024-31238

Vulnerability from cnvd

Title: Siemens多款工业产品OPC UA服务器拒绝服务漏洞

Description:

SIMATIC Energy Manager为用户提供了一个可扩展的、非特定行业的能源数据管理系统。SIMATIC IPC DiagBase诊断软件可早期识别SIMATIC工控机上的任何潜在故障，并有助于避免或减少系统停机时间。SIMATIC IPC DiagMonitor监视、报告、可视化并记录SIMATIC工控机的系统状态。它与其他系统通信，并在事件发生时作出反应。SIMIT Simluation Platform允许模拟工厂设置，以便在早期规划阶段预测故障。

Siemens多款工业产品OPC UA服务器存在拒绝服务漏洞，攻击者可利用该漏洞导致高负载情况和内存耗尽，并可能阻塞服务器。

Severity: 中

Patch Name: Siemens多款工业产品OPC UA服务器拒绝服务漏洞的补丁

Patch Description:

Siemens多款工业产品OPC UA服务器存在拒绝服务漏洞，攻击者可利用该漏洞导致高负载情况和内存耗尽，并可能阻塞服务器。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/html/ssa-088132.html

Reference: https://cert-portal.siemens.com/productcert/html/ssa-088132.html

Impacted products

Name
['Siemens SIMATIC IPC DiagMonitor', 'SIEMENS SIMATIC IPC DiagBase null', 'Siemens SIMATIC Energy Manager Basic < V7.5', 'Siemens SIMATIC Energy Manager PRO < V7.5', 'Siemens SIMIT V10', 'Siemens SIMIT V11 < V11.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-52891"
    }
  },
  "description": "SIMATIC Energy Manager\u4e3a\u7528\u6237\u63d0\u4f9b\u4e86\u4e00\u4e2a\u53ef\u6269\u5c55\u7684\u3001\u975e\u7279\u5b9a\u884c\u4e1a\u7684\u80fd\u6e90\u6570\u636e\u7ba1\u7406\u7cfb\u7edf\u3002SIMATIC IPC DiagBase\u8bca\u65ad\u8f6f\u4ef6\u53ef\u65e9\u671f\u8bc6\u522bSIMATIC\u5de5\u63a7\u673a\u4e0a\u7684\u4efb\u4f55\u6f5c\u5728\u6545\u969c\uff0c\u5e76\u6709\u52a9\u4e8e\u907f\u514d\u6216\u51cf\u5c11\u7cfb\u7edf\u505c\u673a\u65f6\u95f4\u3002SIMATIC IPC DiagMonitor\u76d1\u89c6\u3001\u62a5\u544a\u3001\u53ef\u89c6\u5316\u5e76\u8bb0\u5f55SIMATIC\u5de5\u63a7\u673a\u7684\u7cfb\u7edf\u72b6\u6001\u3002\u5b83\u4e0e\u5176\u4ed6\u7cfb\u7edf\u901a\u4fe1\uff0c\u5e76\u5728\u4e8b\u4ef6\u53d1\u751f\u65f6\u4f5c\u51fa\u53cd\u5e94\u3002SIMIT Simluation Platform\u5141\u8bb8\u6a21\u62df\u5de5\u5382\u8bbe\u7f6e\uff0c\u4ee5\u4fbf\u5728\u65e9\u671f\u89c4\u5212\u9636\u6bb5\u9884\u6d4b\u6545\u969c\u3002\n\nSiemens\u591a\u6b3e\u5de5\u4e1a\u4ea7\u54c1OPC UA\u670d\u52a1\u5668\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u9ad8\u8d1f\u8f7d\u60c5\u51b5\u548c\u5185\u5b58\u8017\u5c3d\uff0c\u5e76\u53ef\u80fd\u963b\u585e\u670d\u52a1\u5668\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-088132.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-31238",
  "openTime": "2024-07-10",
  "patchDescription": "SIMATIC Energy Manager\u4e3a\u7528\u6237\u63d0\u4f9b\u4e86\u4e00\u4e2a\u53ef\u6269\u5c55\u7684\u3001\u975e\u7279\u5b9a\u884c\u4e1a\u7684\u80fd\u6e90\u6570\u636e\u7ba1\u7406\u7cfb\u7edf\u3002SIMATIC IPC DiagBase\u8bca\u65ad\u8f6f\u4ef6\u53ef\u65e9\u671f\u8bc6\u522bSIMATIC\u5de5\u63a7\u673a\u4e0a\u7684\u4efb\u4f55\u6f5c\u5728\u6545\u969c\uff0c\u5e76\u6709\u52a9\u4e8e\u907f\u514d\u6216\u51cf\u5c11\u7cfb\u7edf\u505c\u673a\u65f6\u95f4\u3002SIMATIC IPC DiagMonitor\u76d1\u89c6\u3001\u62a5\u544a\u3001\u53ef\u89c6\u5316\u5e76\u8bb0\u5f55SIMATIC\u5de5\u63a7\u673a\u7684\u7cfb\u7edf\u72b6\u6001\u3002\u5b83\u4e0e\u5176\u4ed6\u7cfb\u7edf\u901a\u4fe1\uff0c\u5e76\u5728\u4e8b\u4ef6\u53d1\u751f\u65f6\u4f5c\u51fa\u53cd\u5e94\u3002SIMIT Simluation Platform\u5141\u8bb8\u6a21\u62df\u5de5\u5382\u8bbe\u7f6e\uff0c\u4ee5\u4fbf\u5728\u65e9\u671f\u89c4\u5212\u9636\u6bb5\u9884\u6d4b\u6545\u969c\u3002\r\n\r\nSiemens\u591a\u6b3e\u5de5\u4e1a\u4ea7\u54c1OPC UA\u670d\u52a1\u5668\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u9ad8\u8d1f\u8f7d\u60c5\u51b5\u548c\u5185\u5b58\u8017\u5c3d\uff0c\u5e76\u53ef\u80fd\u963b\u585e\u670d\u52a1\u5668\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens\u591a\u6b3e\u5de5\u4e1a\u4ea7\u54c1OPC UA\u670d\u52a1\u5668\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SIMATIC IPC DiagMonitor",
      "SIEMENS SIMATIC IPC DiagBase null",
      "Siemens SIMATIC Energy Manager Basic \u003c V7.5",
      "Siemens SIMATIC Energy Manager PRO \u003c V7.5",
      "Siemens SIMIT V10",
      "Siemens SIMIT V11 \u003c V11.1"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/html/ssa-088132.html",
  "serverity": "\u4e2d",
  "submitTime": "2024-07-10",
  "title": "Siemens\u591a\u6b3e\u5de5\u4e1a\u4ea7\u54c1OPC UA\u670d\u52a1\u5668\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2023-52891 (GCVE-0-2023-52891)

Vulnerability from cvelistv5

Published

2024-07-09 12:04

Modified

2025-08-27 20:42

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-1325 - Improperly Controlled Sequential Memory Allocation

Summary

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMIT V10 (All versions), SIMIT V11 (All versions < V11.1). Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in Siemens products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the server.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-088132.html

Impacted products

Vendor

Product

Version

▼

Siemens

SIMATIC Energy Manager Basic

Version: 0 < V7.5

Siemens	SIMATIC Energy Manager PRO	Version: 0 < V7.5
Siemens	SIMATIC IPC DiagBase	Version: 0 < *
Siemens	SIMATIC IPC DiagMonitor	Version: 0 < *
Siemens	SIMIT V10	Version: 0 < *
Siemens	SIMIT V11	Version: 0 < V11.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:siemens:simatic_energy_manager_basic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "simatic_energy_manager_basic",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "V7.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:siemens:simatic_energy_manager_pro:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "simatic_energy_manager_pro",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "V7.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:siemens:simatic_ipc_diagbase:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "simatic_ipc_diagbase",
            "vendor": "siemens",
            "versions": [
              {
                "lessThanOrEqual": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:siemens:simatic_ipc_diagmonitor:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "simatic_ipc_diagmonitor",
            "vendor": "siemens",
            "versions": [
              {
                "lessThanOrEqual": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:siemens:simit_v10:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "simit_v10",
            "vendor": "siemens",
            "versions": [
              {
                "lessThanOrEqual": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:siemens:simit_v11:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "simit_v11",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "V11.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52891",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-09T13:26:14.481281Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-27T20:42:53.094Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:18:41.378Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-088132.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC Energy Manager Basic",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V7.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC Energy Manager PRO",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V7.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC DiagBase",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC IPC DiagMonitor",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMIT V10",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SIMIT V11",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V11.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.5), SIMATIC Energy Manager PRO (All versions \u003c V7.5), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMIT V10 (All versions), SIMIT V11 (All versions \u003c V11.1). Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in Siemens products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325: Improperly Controlled Sequential Memory Allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-09T12:04:42.619Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-088132.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2023-52891",
    "datePublished": "2024-07-09T12:04:42.619Z",
    "dateReserved": "2024-06-21T15:06:40.772Z",
    "dateUpdated": "2025-08-27T20:42:53.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted