NULL Pointer DereferenceWeakness · CWE-476

CVE-2023-28827

MEDIUM · 5.9 CVSS v3.1 Published 2024-09-10

Mitigation only

No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.

See remediation →

68/100

Remediation priority · Elevated

Remotely reachable No privileges Zero-click

Official description

NVD · unedited

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-7 LTE (All versions < V3.5.20), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.5.20), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMATIC WinCC Runtime Advanced (All versions), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of the affected devices do not properly handle certain requests, causing a timeout in the watchdog, which could lead to the clean up of pointers. This could allow a remote attacker to cause a denial of service condition in the system.

Technical summary

dbcve analysis · high confidence

The web server in affected Siemens SIMATIC devices (CP 1242-7, CP 1243-1 variants, HMI Comfort Panels, IPCs, WinCC Runtime, TIM 1531 IRC) does not properly handle certain requests, causing a watchdog timeout that leads to cleanup of pointers. This results in a denial of service condition exploitable remotely by an attacker without authentication.

MitigationUpdate affected devices to vendor-supplied firmware versions V3.5.20 (for CP devices) or V2.4.8 (for TIM 1531 IRC). For HMI/IPC/WinCC products listed as 'All versions,' contact Siemens for specific patch guidance. Network segmentation can limit exposure to the web server interface.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown

From the vector

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Am I affected?

dbcve checks

Work through these to decide whether this CVE applies to you.

Identify the device model

Locate the physical device or check the device inventory to determine if it is one of: CP 1242-7, CP 1243-1 (or variants), HMI Comfort Panel, IPC, WinCC Runtime, or TIM 1531 IRC. Consult device documentation or management interface for exact model number.

Affected if The device model matches one of the affected products listed in the CVE.
Determine the firmware version

Access the device web interface, management console, or use Siemens management tools (e.g., TIA Portal, Web Navigator) to retrieve the current firmware version. For CP devices, look for firmware version in device properties. For TIM 1531 IRC, check the firmware version in the device configuration.

Affected if For CP 1242-7/CP 1243-1 devices: version is earlier than V3.5.20. For TIM 1531 IRC: version is earlier than V2.4.8. For HMI Comfort Panels, IPCs, or WinCC Runtime: all versions are affected.
Verify web server is enabled

Check the device configuration or web server settings through the management interface. Look for HTTP/HTTPS server settings, web-based management (WBM), or remote access configuration. Confirm that the web server interface is active and accessible.

Affected if The web server interface is enabled and accessible on the network. The vulnerability is exploitable only against the web server component.
Assess network exposure

Review network segmentation and firewall rules to determine if the web server interface (typically ports 80/443 or custom ports) is reachable from untrusted networks or the internet.

Affected if The web server interface is reachable from outside the trusted network without additional filtering or authentication barriers.

You are affected if your device is one of the listed models, the firmware version is below the fixed release (or any version for HMI/IPC/WinCC), and the web server is enabled and network-accessible.

Generated from the published advisory. Verify against your own configuration.

Remediation

dbcve · scoped

Mitigation available No clean upgrade yet — mitigate in the meantime

Mitigation

Update affected devices to vendor-supplied firmware versions V3.5.20 (for CP devices) or V2.4.8 (for TIM 1531 IRC). For HMI/IPC/WinCC products listed as 'All versions,' contact Siemens for specific patch guidance. Network segmentation can limit exposure to the web server interface.

Recommended fix High confidence

SIMATIC CP 124x series: V3.5.20; TIM 1531 IRC: V2.4.8; Others: Contact Siemens for specific fixes

1. Identify the exact model number and current firmware version of the affected SIMATIC device
2. For SIMATIC CP 1242-7 V2, CP 1243-1, CP 1243-1 DNP3, CP 1243-1 IEC, CP 1243-7 LTE, CP 1243-8 IRC devices: Obtain and install firmware version V3.5.20 or later from Siemens support portal
3. For TIM 1531 IRC and SIPLUS TIM 1531 IRC devices: Obtain and install firmware version V2.4.8 or later from Siemens support portal
4. For SIMATIC HMI Comfort Panels, SIMATIC IPC DiagBase, SIMATIC IPC DiagMonitor, and SIMATIC WinCC Runtime Advanced: Contact Siemens for specific patch/firmware updates as the advisory notes these are 'All versions' affected
5. After upgrade, verify web server functionality and confirm the vulnerability is remediated
6. Implement network segmentation and firewall rules to limit web server exposure to untrusted networks as a defensive measure

Caveat Firmware updates on industrial devices may require configuration backup and potentially impact running processes - test in non-production environment first

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory

Consultation8.0 h
Implementation24.0 h
Testing12.0 h
Review / QA8.0 h

52.0 hours of engineering $9,160

Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $14,656.

Scan for this in your stack

Free · runs locally

dbcve dependency scanner

Check whether your project pulls in CVE-2023-28827 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References

Primary sources

cert-portal.siemens.com
nvd.nist.govNVD record

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-28827 in production — separate from our analysis above.

Notes0 Guidelines

Know something about CVE-2023-28827?

The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.

The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here

Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data

At a glance

A fix existsA vendor remedy is published

Severity 5.9 Medium

Exploit likelihood EPSS, next 30 days 0.5%

Remediation

Need this fixed?

Have this fixed 52 hrs · Moderate

Typical engagement from $9,160

Get a fix See the full breakdown ↓

We specialise in CVE remediation. Send your environment and we’ll scope CVE-2023-28827 and return a fixed quote.

You’ll deal with our team directly and deploy the reviewed fix to staging first — never straight to production.

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

Check your environment

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

Scan for this in your stack

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Practitioner notes

No notes yet

Official description

Technical summary

CVSS breakdown

Am I affected?

Remediation

References