CVE-2023-27407

CRITICAL

9.9

Description

A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as the root user.

CVE Details

CVSS v3.1 Score9.9

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published5/9/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

siemens:scalance_lpe9403siemens:scalance_lpe9403_firmware

Weaknesses (CWE)

CWE-77CWE-78

References

https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf(productcert@siemens.com)

https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.