CVE-2023-46281

高 8.8CVE-2023-46281 · 12/12/2023 公開 · 17/06/2026 更新

要点

CVE-2023-46281 は simatic pcs neo (siemens), totally integrated automation portal (siemens) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.94%（全脆弱性の 60.9% より高い）。
対処：4.1, 15, 16, 17 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
simatic pcs neo siemens	`< 4.1`	`4.1`
totally integrated automation portal siemens	`= 18≥ 14.0, < 15≥ 15, < 16≥ 16, < 17≥ 17, < 18`	`15161718`

概要

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.