Siemens ProductCERT Patch Day — November 2023

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 4

• Critical 9.6
  CVE-2023-43504 A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is …
• Critical 9.6
  CVE-2023-43505 A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in SMB shares. This could allow an attacker …
• Critical 9.6
  CVE-2023-46601 A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This cou…
• Critical 9.1
  CVE-2023-44373 Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or sp…
  EPSS 1.3%

All vulnerabilities 18