Description
A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIMATIC PCS neo | All versions < V4.1 | — |
Advisories 2
- ICSA-23-320-06 Siemens SIMATIC PCS neo CISA ICS & IT advisories · Nov 14, 2023
- SSA-456933 SSA-456933: Multiple Vulnerabilities in SIMATIC PCS neo before V4.1 Siemens ProductCERT · Nov 14, 2023