CVE-2023-29107 Information disclosure in SIMATIC Cloud Connect 7 CC712
An unauthenticated remote attacker can access undocumented files via the export endpoint, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29107?
CVE-2023-29107 is a medium-severity vulnerability in Siemens SIMATIC Cloud Connect 7 CC712, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources.
Weakness: CWE-552
Which versions are affected by CVE-2023-29107?
It affects 2 products.
Products include Siemens 6gk1411-1ac00 Firmware, Siemens 6gk1411-5ac00 Firmware.
How do I fix CVE-2023-29107?
No fix has been published for CVE-2023-29107 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-29107 being exploited?
There is no known exploitation of CVE-2023-29107 in the wild and no public exploit code.
Other vulnerabilities in Siemens SIMATIC Cloud Connect 7 CC712
- CVE-2023-28832 Command injection in SIMATIC Cloud Connect 7 CC712
- CVE-2023-29104 Path traversal in SIMATIC Cloud Connect 7 CC712
- CVE-2023-29105 Denial of service in SIMATIC Cloud Connect 7 CC712
- CVE-2023-29106 Missing authorization in SIMATIC Cloud Connect 7 CC712
- CVE-2023-29103 Hardcoded credentials in SIMATIC Cloud Connect 7 CC712
Sources
Also known as GHSA-f5jq-f6j5-w2c3.