Vulnerabilities > CVE-2023-44374 - Unsynchronized Access to Shared Data in a Multithreaded Context vulnerability in Siemens products

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
siemens
CWE-567
NVD
Published: 2023-11-14
Updated: 2024-06-11

Summary

Affected devices allow to change the password, but insufficiently check which password is to be changed. With this an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user allowing her to escalate her privileges.

Vulnerable Configurations

Part Description Count
OS
Siemens
72
Hardware
Siemens
71

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Forced Deadlock
    This attack attempts to trigger and exploit a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock condition are not easy to detect.

References