CVE-2023-30757: A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal...
Description
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions), Totally Integrated Automation Portal (TIA Portal) V20 (All versions). The know-how protection feature in affected products does not properly update the encryption of existing program blocks when a project file is updated.
This could allow attackers with access to the project file to recover previous - yet unprotected - versions of the project without the knowledge of the know-how protection password.
Classification
CVE ID: CVE-2023-30757
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.2
Affected Products
Vendor: Siemens
Product: Totally Integrated Automation Portal (TIA Portal) V14
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 14.88% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://cert-portal.siemens.com/productcert/pdf/ssa-042050.pdfhttps://cert-portal.siemens.com/productcert/html/ssa-042050.html