CVE-2023-28829

A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents.

Scoring

Severity

LOW

CVSS base score

3.9

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

EPSS probability

0.08%

CWE

CWE-477

Published

2023-06-13

Last modified

2026-03-13

Affected products

• Siemens SIMATIC NET PC Software V14
• Siemens SIMATIC NET PC Software V15
• Siemens SIMATIC PCS 7 V8.2
• Siemens SIMATIC PCS 7 V9.0
• Siemens SIMATIC PCS 7 V9.1
• Siemens SIMATIC WinCC
• Siemens SINAUT Software ST7sc

Weakness type

• CWE-477

Related vulnerabilities

• CVE-2026-1693 — Use of vulnerable Resource Owner Password Credentials flow
• CVE-2025-49217 — An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could...
• CVE-2025-49216 — An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could...
• CVE-2025-49214 — An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could...
• CVE-2025-49213 — An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could...
• CVE-2025-49212 — An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could...
• CVE-2025-49220 — An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead...
• CVE-2025-49219 — An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could...

Markdown version · Browse all CVEs