{"id":"CVE-2023-46096","aliases":["EUVD-2023-50357","GHSA-rx8q-grjm-x4p7"],"status":"published","title":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). The PUD Manager of...","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00317,"percentile":0.24819,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2023-11-14T11:04:17Z","modified":"2026-06-17T06:30:09Z","products":[{"vendor":"siemens","product":"simatic pcs neo"},{"vendor":"siemens","product":"simatic_pcs_neo"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46096"},{"url":"https://github.com/advisories/GHSA-rx8q-grjm-x4p7"}],"sources":{"cve":[{"id":"CVE-2023-46096","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents.","status":"published","published":"2023-11-14T11:04:17.811Z","modified":"2025-01-08T16:38:00.498Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50357","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents.","status":"published","published":"2023-11-14T11:04:17Z","modified":"2025-01-08T16:38:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-03T00:04:23.880435Z"}],"ghsa":[{"id":"GHSA-rx8q-grjm-x4p7","title":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). The PUD Manager of...","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents.","status":"published","published":"2023-11-14T12:30:27Z","modified":"2023-11-14T12:30:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:55:00.635955Z"}],"nvd":[{"id":"CVE-2023-46096","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents.","status":"published","published":"2023-11-14T11:15:14.167Z","modified":"2026-06-17T06:30:09.387Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:08:46.647045Z"}]}}