{
  "GSD": {
    "alias": "CVE-2023-38641",
    "id": "GSD-2023-38641"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-38641"
      ],
      "details": "A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application\u0027s database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges.",
      "id": "GSD-2023-38641",
      "modified": "2023-12-13T01:20:35.654996Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "productcert@siemens.com",
        "ID": "CVE-2023-38641",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "SICAM TOOLBOX II",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V07.10"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Siemens"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application\u0027s database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-250",
                "lang": "eng",
                "value": "CWE-250: Execution with Unnecessary Privileges"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf",
            "refsource": "MISC",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:siemens:sicam_toolbox_ii:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "07.10",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2023-38641"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application\u0027s database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-08-15T19:40Z",
      "publishedDate": "2023-08-08T10:15Z"
    }
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:sicam_toolbox_ii:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B47D53C9-EEED-4AF2-BC20-826E0853CF36",
              "versionEndExcluding": "07.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application\u0027s database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en SICAM TOOLBOX II (Todas las versiones anteriores a V07.10). El servicio de base de datos de la aplicaci\u00f3n afectada se ejecuta como `NT AUTHORITY\\SYSTEM`.\nEsto podr\u00eda permitir a un atacante local ejecutar comandos del sistema operativo con privilegios elevados."
    }
  ],
  "id": "CVE-2023-38641",
  "lastModified": "2024-11-21T08:13:58.703",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "productcert@siemens.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-08-08T10:15:16.493",
  "references": [
    {
      "source": "productcert@siemens.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ],
      "source": "productcert@siemens.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-38641"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-250"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-08T10:15:16Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application\u0027s database service is executed as `NT AUTHORITY\\SYSTEM`.\nThis could allow a local attacker to execute operating system commands with elevated privileges.",
  "id": "GHSA-4xvg-w7mc-26r3",
  "modified": "2024-04-04T06:38:54Z",
  "published": "2023-08-08T12:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38641"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SICAM TOOLBOX II contains two vulnerabilities that could allow local attackers to execute code on the system with elevated privileges.\n\nSiemens has released an update for SICAM TOOLBOX II and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\n\nhttps://www.siemens.com/gridsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-975961.json"
      },
      {
        "category": "self",
        "summary": "SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-975961.html"
      },
      {
        "category": "self",
        "summary": "SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-975961.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-10 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-222-10.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-10 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-222-10"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SICAM TOOLBOX II",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-222-10",
      "initial_release_date": "2023-08-08T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-08-08T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "2",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV07.10",
                "product": {
                  "name": "SICAM TOOLBOX II",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SICAM TOOLBOX II"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-39062",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected applications do not properly set permissions for product folders. This could allow an authenticated attacker with low privileges to replace DLLs and conduct a privilege escalation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V07.10 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109822197/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-39062"
    },
    {
      "cve": "CVE-2023-38641",
      "cwe": {
        "id": "CWE-250",
        "name": "Execution with Unnecessary Privileges"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application\u0027s database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V07.10 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109822197/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38641"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SICAM TOOLBOX II contains two vulnerabilities that could allow local attackers to execute code on the system with elevated privileges.\n\nSiemens has released an update for SICAM TOOLBOX II and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\n\nhttps://www.siemens.com/gridsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-975961.json"
      },
      {
        "category": "self",
        "summary": "SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-975961.html"
      },
      {
        "category": "self",
        "summary": "SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-975961.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-10 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-222-10.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-10 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-222-10"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SICAM TOOLBOX II",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-222-10",
      "initial_release_date": "2023-08-08T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-08-08T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "2",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV07.10",
                "product": {
                  "name": "SICAM TOOLBOX II",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SICAM TOOLBOX II"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-39062",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected applications do not properly set permissions for product folders. This could allow an authenticated attacker with low privileges to replace DLLs and conduct a privilege escalation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V07.10 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109822197/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-39062"
    },
    {
      "cve": "CVE-2023-38641",
      "cwe": {
        "id": "CWE-250",
        "name": "Execution with Unnecessary Privileges"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application\u0027s database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V07.10 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109822197/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-38641"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eSICAM TOOLBOX II versions ant\u00e9rieures \u00e0 07.10\u003c/li\u003e \u003cli\u003eP\u00e9riph\u00e9riques RUGGEDCOM ROS versions ant\u00e9rieures \u00e0 4.3.8\u003c/li\u003e \u003cli\u003eSolid Edge SE2023 versions ant\u00e9rieures \u00e0 223.0 Update 7\u003c/li\u003e \u003cli\u003eRUGGEDCOM CROSSBOW versions ant\u00e9rieures \u00e0 5.4\u003c/li\u003e \u003cli\u003eParasolid versions 34.1.x ant\u00e9rieures \u00e0 34.1.258\u003c/li\u003e \u003cli\u003eParasolid versions 35.0.x ant\u00e9rieures \u00e0 35.0.254\u003c/li\u003e \u003cli\u003eParasolid versions 35.1.x ant\u00e9rieures \u00e0 35.1.197\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.1.x, se r\u00e9f\u00e9rer \u00e0 l\u0027avis \u00e9diteur pour plus d\u0027information sur les mesures de contournement\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.2.x ant\u00e9rieures \u00e0 14.2.0.6\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.3.x, se r\u00e9f\u00e9rer \u00e0 l\u0027avis \u00e9diteur pour plus d\u0027information sur les mesures de contournement\u003c/li\u003e \u003cli\u003eSIMATIC contr\u00f4leur de disque CPU 1504D versions ant\u00e9rieures \u00e0 3.0.3\u003c/li\u003e \u003cli\u003eSIMATIC contr\u00f4leur de disque CPU 1507D versions ant\u00e9rieures \u00e0 3.0.3\u003c/li\u003e \u003cli\u003eSIMATIC ET toutes versions\u003c/li\u003e \u003cli\u003eSIMATIC IPC toutes versions\u003c/li\u003e \u003cli\u003eSIMATIC S7 versions ant\u00e9rieures \u00e0 3.0.3\u003c/li\u003e \u003cli\u003eSIPLUS ET versions ant\u00e9rieures \u00e0 3.3.19\u003c/li\u003e \u003cli\u003eSIPLUS S7 versions ant\u00e9rieures \u00e0 3.0.3\u003c/li\u003e \u003cli\u003eSiemens Software Center versions ant\u00e9rieures \u00e0 3.0\u003c/li\u003e \u003cli\u003eAPOGEE PXC Compact versions ant\u00e9rieures \u00e0 3.5.5\u003c/li\u003e \u003cli\u003eAPOGEE PXC Compact (P2 Ethernet) versions ant\u00e9rieures \u00e0 2.8.20\u003c/li\u003e \u003cli\u003eAPOGEE PXC Modular (BACnet) versions ant\u00e9rieures \u00e0 3.5.5\u003c/li\u003e \u003cli\u003eAPOGEE PXC Modular (P2 Ethernet) versions ant\u00e9rieures \u00e0 2.8.20\u003c/li\u003e \u003cli\u003eTALON TC Compact versions ant\u00e9rieures \u00e0 3.5.5\u003c/li\u003e \u003cli\u003eTALON TC Modular (BACnet) versions ant\u00e9rieures \u00e0 3.5.5\u003c/li\u003e \u003cli\u003eJT2Go versions ant\u00e9rieures \u00e0 14.2.0.5\u003c/li\u003e \u003cli\u003eSolid Edge SE2022 versions ant\u00e9rieures \u00e0 222.0 Update 13\u003c/li\u003e \u003cli\u003eSolid Edge SE2023 versions ant\u00e9rieures \u00e0 223.0 Update 4\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 13.2.x ant\u00e9rieures \u00e0 13.2.0.15\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 13.3.x ant\u00e9rieures \u00e0 13.3.0.11\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.1.x ant\u00e9rieures \u00e0 14.1.0.11\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.2.x ant\u00e9rieures \u00e0 14.2.0.5\u003c/li\u003e \u003cli\u003eParasolid versions 35.0.x sans la proc\u00e9dure de r\u00e9installation\u003c/li\u003e \u003cli\u003eParasolid versions 35.1.x sans la proc\u00e9dure de r\u00e9installation\u003c/li\u003e \u003cli\u003eJT Open versions ant\u00e9rieures \u00e0 11.4\u003c/li\u003e \u003cli\u003eJT Utilities versions ant\u00e9rieures \u00e0 13.4\u003c/li\u003e \u003cli\u003eParasolid versions 34.0.x ant\u00e9rieures \u00e0 34.0.253\u003c/li\u003e \u003cli\u003eParasolid versions 34.1.x ant\u00e9rieures \u00e0 34.1.243\u003c/li\u003e \u003cli\u003eParasolid versions 35.0.x ant\u00e9rieures \u00e0 35.0.177\u003c/li\u003e \u003cli\u003eParasolid versions 35.1.x ant\u00e9rieures \u00e0 35.1.073\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eL\u0027\u00e9diteur ne propose pas de correctif pour certains produits RUGGEDCOM ROS, SIMATIC ou SIPLUS, se r\u00e9f\u00e9rer aux avis pour obtenir plus d\u0027informations sur les mesures de contournement.\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-27009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27009"
    },
    {
      "name": "CVE-2022-37971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37971"
    },
    {
      "name": "CVE-2023-27411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27411"
    },
    {
      "name": "CVE-2020-28388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28388"
    },
    {
      "name": "CVE-2023-24845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24845"
    },
    {
      "name": "CVE-2023-39419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39419"
    },
    {
      "name": "CVE-2023-39183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39183"
    },
    {
      "name": "CVE-2022-4304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
    },
    {
      "name": "CVE-2020-27736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27736"
    },
    {
      "name": "CVE-2023-39269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39269"
    },
    {
      "name": "CVE-2023-0286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
    },
    {
      "name": "CVE-2023-38526",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38526"
    },
    {
      "name": "CVE-2023-38641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38641"
    },
    {
      "name": "CVE-2023-39187",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39187"
    },
    {
      "name": "CVE-2023-39188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39188"
    },
    {
      "name": "CVE-2020-15795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15795"
    },
    {
      "name": "CVE-2023-39185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39185"
    },
    {
      "name": "CVE-2022-39062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39062"
    },
    {
      "name": "CVE-2023-28830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28830"
    },
    {
      "name": "CVE-2023-38531",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38531"
    },
    {
      "name": "CVE-2023-38524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38524"
    },
    {
      "name": "CVE-2023-39186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39186"
    },
    {
      "name": "CVE-2023-37372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37372"
    },
    {
      "name": "CVE-2021-41544",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41544"
    },
    {
      "name": "CVE-2022-25634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25634"
    },
    {
      "name": "CVE-2023-39182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39182"
    },
    {
      "name": "CVE-2021-31239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31239"
    },
    {
      "name": "CVE-2023-37373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37373"
    },
    {
      "name": "CVE-2023-39184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39184"
    },
    {
      "name": "CVE-2023-38525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38525"
    },
    {
      "name": "CVE-2020-27738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27738"
    },
    {
      "name": "CVE-2023-30795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30795"
    },
    {
      "name": "CVE-2023-38530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38530"
    },
    {
      "name": "CVE-2023-38527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38527"
    },
    {
      "name": "CVE-2022-45937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45937"
    },
    {
      "name": "CVE-2023-37378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37378"
    },
    {
      "name": "CVE-2023-38528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38528"
    },
    {
      "name": "CVE-2023-39181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39181"
    },
    {
      "name": "CVE-2023-4304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4304"
    },
    {
      "name": "CVE-2023-38682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38682"
    },
    {
      "name": "CVE-2023-38532",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38532"
    },
    {
      "name": "CVE-2023-30796",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30796"
    },
    {
      "name": "CVE-2023-38529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38529"
    },
    {
      "name": "CVE-2023-38683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38683"
    },
    {
      "name": "CVE-2020-27737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27737"
    },
    {
      "name": "CVE-2021-25677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25677"
    }
  ],
  "initial_release_date": "2023-08-08T00:00:00",
  "last_revision_date": "2023-08-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0633",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-08-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-472630 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-472630.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-264815 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-264815.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-770902 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-770902.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-975961 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-975961.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-908185 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-908185.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-131450 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-131450.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-407785 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-407785.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-180579 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-180579.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-811403 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-811403.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-264814 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-264814.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-116172 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-116172.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-188491 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-188491.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-001569 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-001569.html"
    }
  ]
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-38641"
    }
  },
  "description": "SICAM TOOLBOX II\u662f\u9002\u7528\u4e8e\u5404\u79cd\u89c4\u6a21\u7684\u5de5\u5382\u548c\u7cfb\u7edf\u7684\u5de5\u7a0b\u89e3\u51b3\u65b9\u6848\u3002\u5b83\u5141\u8bb8\u6570\u636e\u6536\u96c6\u3001\u6570\u636e\u5efa\u6a21\u3001\u914d\u7f6e\u548c\u53c2\u6570\u5316\u3002\u5b83\u7528\u4e8e\u81ea\u52a8\u5316\u548c\u4e2d\u592e\u63a7\u5236\u5ba4\u7cfb\u7edf\u7684\u8fc7\u7a0b\u4fe1\u606f\u5de5\u7a0b\u3002\n\nSiemens SICAM TOOLBOX II\u5b58\u5728\u4f7f\u7528\u4e0d\u5fc5\u8981\u7684\u7279\u6743\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u66ff\u6362dll\u5e76\u8fdb\u884c\u6743\u9650\u5347\u7ea7\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-975961.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-62029",
  "openTime": "2023-08-09",
  "patchDescription": "SICAM TOOLBOX II\u662f\u9002\u7528\u4e8e\u5404\u79cd\u89c4\u6a21\u7684\u5de5\u5382\u548c\u7cfb\u7edf\u7684\u5de5\u7a0b\u89e3\u51b3\u65b9\u6848\u3002\u5b83\u5141\u8bb8\u6570\u636e\u6536\u96c6\u3001\u6570\u636e\u5efa\u6a21\u3001\u914d\u7f6e\u548c\u53c2\u6570\u5316\u3002\u5b83\u7528\u4e8e\u81ea\u52a8\u5316\u548c\u4e2d\u592e\u63a7\u5236\u5ba4\u7cfb\u7edf\u7684\u8fc7\u7a0b\u4fe1\u606f\u5de5\u7a0b\u3002\r\n\r\nSiemens SICAM TOOLBOX II\u5b58\u5728\u4f7f\u7528\u4e0d\u5fc5\u8981\u7684\u7279\u6743\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u66ff\u6362dll\u5e76\u8fdb\u884c\u6743\u9650\u5347\u7ea7\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens SICAM TOOLBOX II\u4f7f\u7528\u4e0d\u5fc5\u8981\u7684\u7279\u6743\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Siemens SICAM TOOLBOX II \u003c07.10"
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/html/ssa-975961.html",
  "serverity": "\u9ad8",
  "submitTime": "2023-08-09",
  "title": "Siemens SICAM TOOLBOX II\u4f7f\u7528\u4e0d\u5fc5\u8981\u7684\u7279\u6743\u6267\u884c\u6f0f\u6d1e"
}