Republished vendor advisory. This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Credit: Siemens ProductCERT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2023-36038 | CWE-20 Improper Input Validation | 8.2 High |
CVE-2023-36038 ASP.NET Core Denial of Service Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-33127 | CWE-20 Improper Input Validation | 8.1 High |
CVE-2023-33127 .NET and Visual Studio Elevation of Privilege Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-33170 | CWE-20 Improper Input Validation | 8.1 High |
CVE-2023-33170 ASP.NET and Visual Studio Security Feature Bypass Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2022-40304 | CWE-415 Double Free | 7.8 High |
CVE-2022-40304 An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-21808 | CWE-20 Improper Input Validation | 7.8 High |
CVE-2023-21808 .NET and Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-24895 | CWE-20 Improper Input Validation | 7.8 High |
CVE-2023-24895 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-24897 | CWE-20 Improper Input Validation | 7.8 High |
CVE-2023-24897 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-28260 | CWE-20 Improper Input Validation | 7.8 High |
CVE-2023-28260 .NET DLL Hijacking Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-35390 | CWE-20 Improper Input Validation | 7.8 High |
CVE-2023-35390 .NET and Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-36792 | CWE-311 Missing Encryption of Sensitive Data | 7.8 High |
CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-36793 | CWE-311 Missing Encryption of Sensitive Data | 7.8 High |
CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-36794 | CWE-311 Missing Encryption of Sensitive Data | 7.8 High |
CVE-2023-36794 Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-36796 | CWE-311 Missing Encryption of Sensitive Data | 7.8 High |
CVE-2023-36796 Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-36049 | CWE-20 Improper Input Validation | 7.6 High |
CVE-2023-36049 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2022-40303 | CWE-190 Integer Overflow or Wraparound | 7.5 High |
CVE-2022-40303 An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-0464 | CWE-295 Improper Certificate Validation | 7.5 High |
CVE-2023-0464 A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy` argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()` function. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-24936 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-24936 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-29331 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-29331 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-36435 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-36435 Microsoft QUIC Denial of Service Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-38171 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-38171 Microsoft QUIC Denial of Service Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-38178 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-38178 .NET Core and Visual Studio Denial of Service Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-38180 KEV | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-38180 .NET and Visual Studio Denial of Service Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-44487 KEV | CWE-400 Uncontrolled Resource Consumption | 7.5 High |
CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-33126 | CWE-20 Improper Input Validation | 7.3 High |
CVE-2023-33126 .NET and Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-33128 | CWE-20 Improper Input Validation | 7.3 High |
CVE-2023-33128 .NET and Visual Studio Remote Code Execution Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-33135 | CWE-20 Improper Input Validation | 7.3 High |
CVE-2023-33135 .NET and Visual Studio Elevation of Privilege Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-28484 | CWE-476 NULL Pointer Dereference | 6.5 Medium |
CVE-2023-28484 In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-29469 | CWE-415 Double Free | 6.5 Medium |
CVE-2023-29469 An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value). Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-32032 | CWE-20 Improper Input Validation | 6.5 Medium |
CVE-2023-32032 .NET and Visual Studio Elevation of Privilege Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-36799 | CWE-20 Improper Input Validation | 6.5 Medium |
CVE-2023-36799 .NET Core and Visual Studio Denial of Service Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-39615 | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | 6.5 Medium |
CVE-2023-39615 Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-35391 | CWE-20 Improper Input Validation | 6.2 Medium |
CVE-2023-35391 ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-36558 | CWE-20 Improper Input Validation | 6.2 Medium |
CVE-2023-36558 ASP.NET Core - Security Feature Bypass Vulnerability Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-0465 | CWE-295 Improper Certificate Validation | 5.3 Medium |
CVE-2023-0465 Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy` argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()` function. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-0466 | CWE-295 Improper Certificate Validation | 5.3 Medium |
CVE-2023-0466 The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-3446 | CWE-1333 Inefficient Regular Expression Complexity | 5.3 Medium |
CVE-2023-3446 Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-5678 | CWE-754 Improper Check for Unusual or Exceptional Conditions | 5.3 Medium |
CVE-2023-5678 Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Vendor fix: Update to V1.1 or later version ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2023-36038 | 8.2 High | Microsoft ASP.NET Core 8.0 ASP.NET Core Denial of Service Vulnerability |
| CVE-2023-33127 | 8.1 High | Microsoft .NET 6.0 .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-33170 | 8.1 High | Microsoft Microsoft Visual Studio 2022 version 17.2 ASP.NET and Visual Studio Security Feature Bypass Vulnerability |
| CVE-2022-40304 | 7.8 High | n/a n/a An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequ… |
| CVE-2023-21808 | 7.8 High | Microsoft .NET 6.0 .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-24895 | 7.8 High | Microsoft .NET 7.0 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-24897 | 7.8 High | Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-28260 | 7.8 High | Microsoft .NET 6.0 .NET DLL Hijacking Remote Code Execution Vulnerability |
| CVE-2023-35390 | 7.8 High | Microsoft .NET 6.0 .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36792 | 7.8 High | Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36793 | 7.8 High | Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36794 | 7.8 High | Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36796 | 7.8 High | Microsoft Microsoft Visual Studio 2022 version 17.6 Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36049 | 7.6 High | Microsoft Microsoft Visual Studio 2022 version 17.2 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2022-40303 | 7.5 High | n/a n/a An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several i… |
| CVE-2023-0464 | 7.5 High | OpenSSL OpenSSL A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that inclu… |
| CVE-2023-24936 | 7.5 High | Microsoft Microsoft Visual Studio 2022 version 17.2 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-29331 | 7.5 High | Microsoft .NET 6.0 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2023-36435 | 7.5 High | Microsoft PowerShell 7.3 Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-38171 | 7.5 High | Microsoft Microsoft Visual Studio 2022 version 17.2 Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-38178 | 7.5 High | Microsoft .NET 6.0 .NET Core and Visual Studio Denial of Service Vulnerability |
| CVE-2023-38180 | 7.5 High | Microsoft .NET Core and Visual Studio Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS). |
| CVE-2023-44487 | 7.5 High | IETF HTTP/2 HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS). |
| CVE-2023-33126 | 7.3 High | Microsoft .NET 6.0 .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-33128 | 7.3 High | Microsoft .NET 6.0 .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-33135 | 7.3 High | Microsoft .NET 6.0 .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-28484 | 6.5 Medium | n/a n/a In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in x… |
| CVE-2023-29469 | 6.5 Medium | n/a n/a An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can prod… |
| CVE-2023-32032 | 6.5 Medium | Microsoft .NET 7.0 .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-36799 | 6.5 Medium | Microsoft .NET 6.0 .NET Core and Visual Studio Denial of Service Vulnerability |
| CVE-2023-35391 | 6.2 Medium | Microsoft .NET 6.0 ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability |
| CVE-2023-36558 | 6.2 Medium | Microsoft .NET 6.0 ASP.NET Core Security Feature Bypass Vulnerability |
| CVE-2023-0465 | 5.3 Medium | OpenSSL OpenSSL Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain check… |
| CVE-2023-0466 | 5.3 Medium | OpenSSL OpenSSL The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. How… |
| CVE-2023-3446 | 5.3 Medium | OpenSSL OpenSSL Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_… |
| CVE-2023-5678 | 5.3 Medium | OpenSSL OpenSSL Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: … |
| CVE-2023-39615 | — | n/a n/a Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.