Siemens ProductCERT Patch Day — September 2023

Tuesday, 12 September 2023

Vulnerabilities: 22
Critical: 0
High: 18
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

All vulnerabilities 22

High18 Show

High 8.8
CVE-2023-40726 A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds with sensitive information about the se…
High 8.2
CVE-2023-38557 A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the update script. This …
High 7.8
CVE-2023-38070 A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V…
High 7.8
CVE-2023-38071 A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V…
High 7.8
CVE-2023-38072 A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V…
High 7.8
CVE-2023-38073 A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V…
High 7.8
CVE-2023-38074 A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V…
High 7.8
CVE-2023-38075 A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V…
High 7.8
CVE-2023-38076 A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V…
High 7.8
CVE-2023-40727 A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak outdated application…
High 7.8
CVE-2023-41032 A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.0.253), Parasolid V35.1 (All versions < …
High 7.8
CVE-2023-41033 A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.260), Parasolid V35.1 (All versions < V35.1.246), Parasolid V36.0 (All versions < …
High 7.8
CVE-2023-41846 A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0…
High 7.5
CVE-2023-28831 The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an infi…
EPSS 1.1%
High 7.3
CVE-2023-40724 A vulnerability has been identified in QMS Automotive (All versions < V12.39). User credentials are found in memory as plaintext. An attacker could perform a m…
High 7.3
CVE-2023-40728 A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensitive application d…
High 7.3
CVE-2023-40729 A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unencrypted communica…
High 7.1
CVE-2023-40730 A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks sufficient authorization…

Medium3 Show

Low1 Show

Low 3.9
CVE-2023-40732 A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the sessio…