High ICSA-23-257-03 10 CVEs

Siemans QMS Automotive

Published Sep 12, 2023 · Updated May 6, 2025 · Revision 2

Vendor: Siemens Product: QMS Automotive

Summary

QMS Automotive before V12.39 contains multiple vulnerabilities that could allow an attacker to perform malicious code injection, information disclosure or lead to a denial of service condition.

Siemens has released an update for QMS Automotive and recommends to update to the latest version.

Vulnerabilities 10

High 8.8

CVE-2023-40726

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds…

Siemens QMS Automotive ICS / OT

Sep 12, 2023
High 7.8

CVE-2023-40727

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected ap…

Siemens QMS Automotive ICS / OT

Sep 12, 2023
High 7.6

CVE-2022-43958

A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). …

Siemens QMS Automotive ICS / OT

Nov 8, 2022
High 7.3

CVE-2023-40724

A vulnerability has been identified in QMS Automotive (All versions < V12.39). User credentials are found in memory as …

Siemens QMS Automotive ICS / OT

Sep 12, 2023
High 7.3

CVE-2023-40728

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected ap…

Siemens QMS Automotive ICS / OT

Sep 12, 2023
High 7.3

CVE-2023-40729

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security …

Siemens QMS Automotive ICS / OT

Sep 12, 2023
High 7.1

CVE-2023-40730

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected ap…

Siemens QMS Automotive ICS / OT

Sep 12, 2023
Medium 5.7

CVE-2023-40731

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to…

Siemens QMS Automotive ICS / OT

Sep 12, 2023
Medium 4.0

CVE-2023-40725

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsi…

Siemens QMS Automotive ICS / OT

Sep 12, 2023
Low 3.9

CVE-2023-40732

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected ap…

Siemens QMS Automotive ICS / OT

Sep 12, 2023

Revision history

2025-05-06 #2
Revision - Fixing typos
2023-09-12 #1
Publication Date

References

SSA-147266: Multiple Vulnerabilities in QMS Automotive before V12.39 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-147266.html
SSA-147266: Multiple Vulnerabilities in QMS Automotive before V12.39 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
SSA-147266: Multiple Vulnerabilities in QMS Automotive before V12.39 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-147266.txt
ICS Advisory ICSA-23-257-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-257-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B