Full Report
SIMATIC PCS neo before V4.1 is affected by multiple vulnerabilities. Siemens has released a new version for SIMATIC PCS neo and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Siemens SIMATIC PCS neo Before V4.1
## CVE Details
This advisory covers multiple vulnerabilities. The details for the four disclosed CVEs are summarized below:
| CVE ID | CVSS 3.1 Score | Severity | CWE |
| :--- | :--- | :--- | :--- |
| CVE-2023-46096 | 6.5 | Medium | CWE-306 (Missing Authentication for Critical Function) |
| CVE-2023-46097 | 6.3 | Medium | CWE-89 (SQL Injection) |
| CVE-2023-46098 | 8.0 | High | CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) |
| CVE-2023-46099 | 5.4 | Medium | CWE-79 (Cross-site Scripting) |
## Affected Systems
- **Products:** SIMATIC PCS neo
- **Versions:** All versions *before* V4.1
- **Configurations:** Not explicitly detailed beyond product type, but attack vectors suggest network/adjacent access may be relevant for some flaws.
## Vulnerability Description
The advisory covers four distinct vulnerabilities impacting SIMATIC PCS neo:
1. **CVE-2023-46096 (Improper Authentication):** The PUD Manager web service fails to properly authenticate users. This flaw could allow an unauthenticated adjacent attacker to generate a privileged token and upload unauthorized documents.
2. **CVE-2023-46097 (SQL Injection):** The PUD Manager does not properly neutralize user-provided inputs. This allows an authenticated adjacent attacker to potentially execute arbitrary SQL statements in the underlying database.
3. **CVE-2023-46098 (Permissive CORS Policy):** When accessing the Information Server, the product uses an overly permissive Cross-Origin Resource Sharing (CORS) policy. This could allow an attacker to exploit a legitimate user by tricking them into triggering unwanted behavior.
4. **CVE-2023-46099 (Stored XSS):** A stored Cross-Site Scripting (XSS) vulnerability exists in the Administration Console, allowing an attacker with high privileges to inject JavaScript code that is later executed by another legitimate user.
## Exploitation
- **Status:** Exploitation proof-of-concept (PoC) or active exploitation status is implied by the presence of the 'E:P' (Exploitability: Proof-of-Concept) component in the CVSS vectors (e.g., CVE-2023-46098: E:P/\*).
- **Complexity:** Low (AC:L listed across most relevant CVEs).
- **Attack Vector:** Primarily **Adjacent (AV:A)** for CVE-2023-46096, CVE-2023-46097, and CVE-2023-46098. CVE-2023-46099 requires a privileged user but still involves an 'A' (Adjacent) attack vector for initial context setup.
## Impact
The impact varies per CVE, but collectively affects unauthorized data access, database manipulation, arbitrary code execution via user interaction, and data theft/modification.
| CVE | Confidentiality | Integrity | Availability |
| :--- | :--- | :--- | :--- |
| CVE-2023-46096 | None (N) | High (H) | None (N) |
| CVE-2023-46097 | None (N) | High (H) | Low (L) |
| CVE-2023-46098 | High (H) | High (H) | High (H) |
| CVE-2023-46099 | Low (L) | Low (L) | Low (L) |
## Remediation
### Patches
- **Action:** Update to **V4.1 or a later version** of SIMATIC PCS neo.
### Workarounds
- Siemens recommends consulting product-specific remediations in the advisory or following **General Security Recommendations**, primarily surrounding network protection:
1. Protect network access to devices using appropriate mechanisms.
2. Configure environments according to Siemens' operational guidelines for Industrial Security.
## Detection
The advisory does not provide specific IOCs but implies detection should focus on:
- **CVE-2023-46096/46097:** Monitoring for unauthorized token generation or unexpected SQL command execution attempts against the PUD Manager service.
- **CVE-2023-46098:** Monitoring for unusual requests originating from external domains attempting interaction with the Information Server component, specifically focusing on cross-domain activity.
- **CVE-2023-46099:** Monitoring administrative actions for injected scripts or unexpected HTML content in configuration fields within the Administration Console.
## References
- Siemens Security Advisory SSA-456933: hxxps://cert-portal.siemens.com/productcert/html/ssa-456933.html
- Siemens Support for Download/Patch Information: hxxps://support.industry.siemens.com/cs/ww/en/view/109825230/
- CWE Classification: hxxps://cwe.mitre.org/
- CVSS v3.1 Specification: hxxps://www.first.org/cvss/