CVE-2023-38558

MEDIUM

SIMATIC PCS neo Administration Console V4.0 and V4.0 Update 1 - Credential Leak via Windows Admin Credential Exposure

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems.

References (1)

Core 1

Scores

CVSS v3 5.5
EPSS 0.0017
EPSS Percentile 6.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-538 CWE-668
Status published
Products (1)
siemens/simatic_pcs_neo 4.0 (2 CPE variants)
Published Sep 14, 2023
Tracked Since Feb 18, 2026