by Kastro
Paper/Archive/CVE-2023-46601

CVE-2023-46601

Siemens COMOS — A vulnerability has been identified in COMOS (All versions).

EPSS 0.5%CVSS 9.6
critical.is priorityof 100
38
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 44.2.442 × 208.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to.

Affected

ProductAffectedFixed inSource
COMOSAll versions–CNA

Scores by source

siemens (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcert-portal.siemens.com/productcert/pdf/ssa-137900.pdf