CVE-2023-44373

CRITICAL

Siemens 6GK5205 and 6GK5208 and 6GK5213 Firmware < 4.5 - Authenticated Remote Code Execution via Input Field Injection

Title source: llm
STIX 2.1

Description

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.

References (8)

Core 8

Scores

CVSS v3 9.1
EPSS 0.0053
EPSS Percentile 67.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-74
Status published
Products (50)
siemens/6ag1206-2bb00-7ac2_firmware < 4.5
siemens/6ag1206-2bs00-7ac2_firmware < 4.5
siemens/6ag1208-0ba00-7ac2_firmware < 4.5
siemens/6ag1216-4bs00-7ac2_firmware < 4.5
siemens/6gk5204-0ba00-2gf2_firmware < 4.5
siemens/6gk5204-0ba00-2yf2_firmware < 4.5
siemens/6gk5204-2aa00-2gf2_firmware < 4.5
siemens/6gk5204-2aa00-2yf2_firmware < 4.5
siemens/6gk5205-3bb00-2ab2_firmware < 4.5
siemens/6gk5205-3bb00-2tb2_firmware < 4.5
... and 40 more
Published Nov 14, 2023
Tracked Since Feb 18, 2026