Critical ICSA-23-320-12 13 CVEs

Siemens PNI

Published Nov 14, 2023 · Updated Nov 14, 2023

Vendor: Siemens Product: SINEC PNI

Summary

SINEC PNI before V2.0 is affected by multiple vulnerabilities.

Siemens has released an update for SINEC PNI and recommends to update to the latest version.

Vulnerabilities 13

Critical 9.8

CVE-2022-37434 Public exploit EPSS 19%

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…

openjpeg2 rsync fltk crash Debian Ubuntu Azure Linux Alpine Wolfi

Aug 5, 2022
High 7.8

CVE-2022-41032 Public exploit

NuGet Client Elevation of Privilege Vulnerability

NuGet Client Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.2 .NET 6.0 Ubuntu Alpine NuGet

Oct 11, 2022
High 7.8

CVE-2023-21808

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Feb 14, 2023
High 7.8

CVE-2023-24895

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Jun 14, 2023
High 7.8

CVE-2023-24897

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Jun 14, 2023
High 7.8

CVE-2023-28260

.NET DLL Hijacking Remote Code Execution Vulnerability

.NET DLL Hijacking Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 .NET 6.0 Ubuntu Alpine NuGet

Apr 11, 2023
High 7.5

CVE-2023-24936

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-29331

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.3

CVE-2023-33126

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine NuGet

Jun 13, 2023
High 7.3

CVE-2023-33128

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Jun 13, 2023
High 7.3

CVE-2023-33135

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine

Jun 13, 2023
Medium 6.5

CVE-2023-32032

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine

Jun 13, 2023
Medium 5.5

CVE-2022-30184

.NET and Visual Studio Information Disclosure Vulnerability

.NET and Visual Studio Information Disclosure Vulnerability

Microsoft Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.2 .NET 6.0 Alpine NuGet

Jun 15, 2022

Revision history

2023-11-14 #1
Publication Date

References

SSA-150063: Multiple Vulnerabilities in SINEC PNI before V2.0 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-150063.html
SSA-150063: Multiple Vulnerabilities in SINEC PNI before V2.0 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-150063.pdf
SSA-150063: Multiple Vulnerabilities in SINEC PNI before V2.0 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-150063.txt
ICS Advisory ICSA-23-320-12 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-12
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B