CVE-2023-46283
Reported by siemens · Published December 12, 2023
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). The affected application contains an out of bounds write past the end of an allocated buffer when handling specific requests on port 4002/tcp. This could allow an attacker to crash the application. The corresponding service is auto-restarted after the crash.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Totally Integrated Automation Portal (TIA Portal) V18 | Siemens | V18 Update 3 |
| SINEC NMS | Siemens | V2.0 SP1 |
| simatic_pcs_neo | siemens | 4.1 |
| SIMATIC PCS neo | Siemens | V4.1, 4.1 |
| totally_integrated_automation_portal | siemens | 18, 17, 16, 15 |
| Opcenter Quality | Siemens | V2312, 2312 |
| Opcenter Execution Foundation | Siemens | 2407 |
| Totally Integrated Automation Portal (TIA Portal) V17 | Siemens | V17 Update 8 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Opcenter Execution Foundation | 0 |
| Siemens | Opcenter Quality | 0 |
| Siemens | SIMATIC PCS neo | 0 |
| Siemens | SINEC NMS | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V14 | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V15.1 | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V16 | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V17 | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V18 | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V18 | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V16 | 0 |
| Siemens | SINEC NMS | 0 |
| Siemens | SIMATIC PCS neo | 0 |
| Siemens | Opcenter Quality | 0 |
| Siemens | Opcenter Execution Foundation | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V15.1 | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V17 | 0 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V14 | 0 |
Timeline
- Dec 11, 2023 CVE Published
- Dec 13, 2023 EPSS Score (30 in total, the first dated here)
- Mar 30, 2026 Security Advisory
- Aug 1, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-46283
vulnetix vdb fixes CVE-2023-46283Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-46283/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart