CVE Feed

    Dashboard / CVE / CVE-2023-30897

    CVE-2023-30897

    A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set proper access rights for their installation folder if a non-default installation path was chosen during installation. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.

    Published:Jun 13, 2023
    Last Modified:Jan 3, 2025
    EPS:Jun 13, 2023
    EPSS Score:0.00058
    CVSS Score:7.8

    Affected Products

    Vendor
    Siemens
    Product
    Wincc

    Exploits

    No exploit reference

    Related CVEs

    CVE-2017-12069 (CVSS 8.2) — An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Dis…
    CVE-2015-2822 (CVSS 4.3) — Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced be…
    CVE-2015-2823 (CVSS 6.8) — Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Pan…
    CVE-2015-1358 (CVSS 5) — The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in…
    CVE-2014-4686 (CVSS 6.8) — The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products…
    CVE-2014-4682 (CVSS 5) — The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote…
    CVE-2014-4685 (CVSS 4.6) — Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by…
    CVE-2014-4683 (CVSS 4.9) — The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote…
    CVE-2014-4684 (CVSS 6) — The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote aut…
    CVE-2013-4911 (CVSS 6.8) — Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High