CVE-2023-46097 | Vulnetix

CVE-2023-46097 PUBLISHED CVSS 6.3 MEDIUM

Reported by siemens · Published November 14, 2023

A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly neutralize user provided inputs. This could allow an authenticated adjacent attacker to execute SQL statements in the underlying database.

Risk scores

CVSS 3.1

6.3

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C

Affected products

Vendor	Product	Versions
Siemens	SIMATIC PCS neo	All versions < V4.1
Siemens	SIMATIC PCS neo	*

Timeline

Nov 14, 2023 CVE Published
Nov 15, 2023 EPSS Score (30 in total, the first dated here)
Jun 2, 2026 Security Advisory
Aug 1, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-46097
vulnetix vdb fixes CVE-2023-46097

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-46097/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →