CVE-2023-46098 Other in SIMATIC PCS neo

Q: Is CVE-2023-46098 being exploited?

There is no known exploitation of CVE-2023-46098 in the wild and no public exploit code.

Q: How do I fix CVE-2023-46098?

No fix has been published for CVE-2023-46098 yet. Limit exposure of the affected software until one is available.

High 8.0 Published 14 Nov 2023 Updated 8 Jan 2025

An overly permissive CORS policy in SIMATIC PCS neo allows attackers to trick users into triggering unwanted behavior.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-46098?

CVE-2023-46098 is a high-severity vulnerability in Siemens SIMATIC PCS neo, published on 14 Nov 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.

Weakness: CWE-942

Which versions are affected by CVE-2023-46098?

It affects 1 product.

Products include Siemens Simatic Pcs Neo.

How do I fix CVE-2023-46098?

No fix has been published for CVE-2023-46098 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-46098 being exploited?

There is no known exploitation of CVE-2023-46098 in the wild and no public exploit code.

Sources

Also known as GHSA-qgvx-gh8h-gmqj.