Vulnerability Details CVE-2023-23588
A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC647D (All versions), SIMATIC IPC647E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows), SIMATIC IPC847D (All versions), SIMATIC IPC847E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows). The Adaptec Maxview application on affected devices is using a non-unique TLS certificate across installations to protect the communication from the local browser to the local application.
A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 8.9%
CVSS Severity
CVSS v3 Score 6.2
References
Products affected by CVE-2023-23588
-
cpe:2.3:a:microchip:maxview_storage_manager:-
-
cpe:2.3:h:siemens:simatic_ipc1047:-
-
cpe:2.3:h:siemens:simatic_ipc1047e:-
-
cpe:2.3:h:siemens:simatic_ipc647d:-
-
cpe:2.3:h:siemens:simatic_ipc647e:-
-
cpe:2.3:h:siemens:simatic_ipc847d:-
-
cpe:2.3:h:siemens:simatic_ipc847e:-
-
cpe:2.3:o:siemens:simatic_ipc1047_firmware:*
-
cpe:2.3:o:siemens:simatic_ipc647d_firmware:19.01.07
-
cpe:2.3:o:siemens:simatic_ipc647d_firmware:19.01.10
-
cpe:2.3:o:siemens:simatic_ipc647d_firmware:19.01.14
-
cpe:2.3:o:siemens:simatic_ipc847d_firmware:19.01.07
-
cpe:2.3:o:siemens:simatic_ipc847d_firmware:19.01.10
-
cpe:2.3:o:siemens:simatic_ipc847d_firmware:19.01.14