{"id":"CVE-2023-40727","aliases":["EUVD-2023-45281","GHSA-32xp-f3ph-fppf"],"status":"published","title":"A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile...","description":"A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an attacker to tamper the application code.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00132,"percentile":0.0283,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2023-09-12T09:32:27Z","modified":"2026-06-17T06:19:16Z","products":[{"vendor":"siemens","product":"qms automotive"},{"vendor":"siemens","product":"qms_automotive"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40727"},{"url":"https://github.com/advisories/GHSA-32xp-f3ph-fppf"}],"sources":{"cve":[{"id":"CVE-2023-40727","description":"A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an attacker to tamper the application code.","status":"published","published":"2023-09-12T09:32:27.559Z","modified":"2025-02-27T20:55:51.804Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:35:21.971258Z"}],"euvd":[{"id":"EUVD-2023-45281","description":"A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an attacker to tamper the application code.","status":"published","published":"2023-09-12T09:32:27Z","modified":"2025-02-27T20:55:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T20:53:21.01879Z"}],"ghsa":[{"id":"GHSA-32xp-f3ph-fppf","title":"A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile...","description":"A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an attacker to tamper the application code.","status":"published","published":"2023-09-14T18:32:40Z","modified":"2024-04-04T07:40:32Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:56:53.773376Z"}],"nvd":[{"id":"CVE-2023-40727","description":"A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an attacker to tamper the application code.","status":"published","published":"2023-09-12T10:15:29.12Z","modified":"2026-06-17T06:19:16.603Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:08:28.268644Z"}]}}