{"id":"CVE-2023-38641","aliases":["EUVD-2023-42440","GHSA-4xvg-w7mc-26r3"],"status":"published","title":"A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected...","description":"A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application's database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00191,"percentile":0.08792,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-250"],"published":"2023-08-08T09:20:43Z","modified":"2026-06-17T06:10:52Z","products":[{"vendor":"siemens","product":"sicam toolbox ii"},{"vendor":"siemens","product":"sicam_toolbox_ii"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38641"},{"url":"https://github.com/advisories/GHSA-4xvg-w7mc-26r3"}],"sources":{"cve":[{"id":"CVE-2023-38641","description":"A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application's database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges.","status":"published","published":"2023-08-08T09:20:43.085Z","modified":"2025-02-27T21:09:35.1Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-42440","description":"A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application's database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges.","status":"published","published":"2023-08-08T09:20:43Z","modified":"2025-02-27T21:09:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T20:53:20.548403Z"}],"ghsa":[{"id":"GHSA-4xvg-w7mc-26r3","title":"A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected...","description":"A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application's database service is executed as `NT AUTHORITY\\SYSTEM`.\nThis could allow a local attacker to execute operating system commands with elevated privileges.","status":"published","published":"2023-08-08T12:30:20Z","modified":"2024-04-04T06:38:55Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:56:44.329928Z"}],"nvd":[{"id":"CVE-2023-38641","description":"A vulnerability has been identified in SICAM TOOLBOX II (All versions \u003c V07.10). The affected application's database service is executed as `NT AUTHORITY\\SYSTEM`.\r\nThis could allow a local attacker to execute operating system commands with elevated privileges.","status":"published","published":"2023-08-08T10:15:16.493Z","modified":"2026-06-17T06:10:52.71Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:08:20.798312Z"}]}}