{"id":"CVE-2023-28829","aliases":["EUVD-2023-32461","GHSA-cgxq-vv5m-p85q"],"status":"published","title":"A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC...","description":"A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions \u003c V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms \u0026 Events)) were used per default. These\r\nservices were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00291,"percentile":0.21783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-477"],"published":"2023-06-13T08:17:07Z","modified":"2026-10-23T23:10:00Z","products":[{"vendor":"siemens","product":"simatic net pc software v14"},{"vendor":"siemens","product":"simatic net pc software v15"},{"vendor":"siemens","product":"simatic pcs 7 v8.2"},{"vendor":"siemens","product":"simatic pcs 7 v9.0"},{"vendor":"siemens","product":"simatic pcs 7 v9.1"},{"vendor":"siemens","product":"simatic wincc"},{"vendor":"siemens","product":"simatic_net_pc_software"},{"vendor":"siemens","product":"simatic_pcs_7"},{"vendor":"siemens","product":"simatic_wincc"},{"vendor":"siemens","product":"sinaut software st7sc"},{"vendor":"siemens","product":"sinaut_st7sc"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdf","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28829"},{"url":"https://github.com/advisories/GHSA-cgxq-vv5m-p85q"}],"sources":{"cve":[{"id":"CVE-2023-28829","description":"A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions \u003c V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms \u0026 Events)) were used per default. These\r\nservices were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.","status":"published","published":"2023-06-13T08:17:07.989Z","modified":"2025-01-03T01:52:55.603Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"low","assessor":"cna"}],"cwes":["CWE-477"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-32461","description":"A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions \u003c V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms \u0026 Events)) were used per default. These\r\nservices were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.","status":"published","published":"2023-06-13T08:17:07Z","modified":"2025-01-03T01:52:55Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"low"}],"updated_at":"2026-11-03T00:04:27.013318Z"}],"ghsa":[{"id":"GHSA-cgxq-vv5m-p85q","title":"A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC...","description":"A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions \u003c V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms \u0026 Events)) were used per default. These\nservices were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.","status":"published","published":"2023-06-13T09:30:19Z","modified":"2024-04-04T04:45:46Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-477"],"updated_at":"2026-11-02T14:56:26.754135Z"}],"nvd":[{"id":"CVE-2023-28829","description":"A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions \u003c V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms \u0026 Events)) were used per default. These\r\nservices were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.","status":"published","published":"2023-06-13T09:15:16.707Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-477"],"updated_at":"2026-11-02T14:08:06.335469Z"}]}}