dbcve.org
Out-of-bounds ReadWeakness · CWE-125

CVE-2023-46280

MEDIUM · 6.5 CVSS v3.1 Published 2024-05-14
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
67/100
Remediation priority · Elevated
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 Upd5), SIMATIC NET PC Software V16 (All versions < V16 Update 8), SIMATIC NET PC Software V17 (All versions), SIMATIC NET PC Software V18 (All versions < V18 SP1), SIMATIC NET PC Software V19 (All versions < V19 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PDM V9.2 (All versions < V9.2 SP2 Upd3), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 Upd3), SIMATIC S7-PCT (All versions < V3.5 SP3 Update 6), SIMATIC STEP 7 V5 (All versions < V5.7 SP3), SIMATIC WinCC OA V3.17 (All versions), SIMATIC WinCC OA V3.18 (All versions < V3.18 P025), SIMATIC WinCC OA V3.19 (All versions < V3.19 P010), SIMATIC WinCC Runtime Advanced (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 6), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5), SINAMICS Startdrive (All versions < V19 SP1), SINEC NMS (All versions < V3.0), SINUMERIK ONE virtual (All versions < V6.23), SINUMERIK PLC Programming Tool (All versions < V3.3.12), TIA Portal Cloud Connector (All versions < V2.0), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 4), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 2), SINEC NMS (All versions < V3.0 SP1). The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

An out-of-bounds read vulnerability exists in multiple Siemens SIMATIC and TIA Portal industrial automation applications. This memory safety flaw allows an attacker to read memory outside allocated buffers, which can trigger a Blue Screen of Death crash of the Windows kernel, causing denial of service.

MitigationApply vendor-supplied updates to reach the specified patch versions for each affected product (e.g., TIA Portal V17 to Update 8, V18 to Update 4, WinCC V7.5 to SP2 Update 17). For products with no fixed version available, contact Siemens for alternative mitigations or compensatory controls.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed Siemens TIA Portal or SIMATIC products
    Open Windows Control Panel > Programs and Features, or check C:\Program Files\Siemens for TIA Portal or SIMATIC directories. Look for product names containing 'TIA Portal', 'SIMATIC', or 'WinCC'.
    Affected if Any Siemens industrial automation software from the TIA Portal or SIMATIC families is installed.
  2. Determine installed TIA Portal version
    Launch TIA Portal and go to 'Help' > 'About', or check the installation directory for version information files. Note the main version (e.g., V17, V18) and Update number.
    Affected if Version is TIA Portal V17 or V18 (or other TIA Portal versions) without the latest updates applied.
  3. Determine installed WinCC version
    Open Windows Control Panel > Programs and Features, or launch WinCC and check 'Help' > 'Information'. Note the version number and any Service Pack (SP) or Update level.
    Affected if WinCC V7.5 or other WinCC versions are installed without SP2 Update 17 or equivalent latest patches.
  4. Check for SIMATIC Manager or related SIMATIC components
    Look for SIMATIC Manager in the Start Menu or check C:\Program Files\Siemens\SIMATIC for installed components. Identify which SIMATIC software suites are present.
    Affected if SIMATIC industrial automation software is installed and running without vendor-supplied patches.
  5. Verify if project files or runtime connections are active
    Check Windows Task Manager for running Siemens processes such as 'TIAPortal.exe', 'WinCCRuntime.exe', or 'sematrix.exe'. Review active network ports commonly used by these applications.
    Affected if The Siemens software is actively running and processing project files or serving as a runtime, enabling the vulnerability to be triggered.

If any Siemens TIA Portal, WinCC, or SIMATIC product is installed and running without the vendor's latest security updates, the environment may be affected by this out-of-bounds read vulnerability.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply vendor-supplied updates to reach the specified patch versions for each affected product (e.g., TIA Portal V17 to Update 8, V18 to Update 4, WinCC V7.5 to SP2 Update 17). For products with no fixed version available, contact Siemens for alternative mitigations or compensatory controls.

Recommended fix High confidence

Upgrade to the specific minimum fixed version listed for each product (e.g., SIMATIC Automation Tool to V5.0 SP2, TIA Portal V17 to V17 Update 8, etc.)

  1. 1. Identify the specific Siemens SIMATIC or TIA Portal product installed from the list of affected products.
  2. 2. Navigate to Siemens Industry Online Support (support.industry.siemens.com) or the cert-portal.siemens.com to obtain the applicable update.
  3. 3. For SIMATIC Automation Tool: Upgrade to version V5.0 SP2 or later.
  4. 4. For SIMATIC BATCH V9.1: Upgrade to V9.1 SP2 Upd5 or later.
  5. 5. For SIMATIC NET PC Software V16: Upgrade to V16 Update 8 or later.
  6. 6. For SIMATIC NET PC Software V18: Upgrade to V18 SP1 or later.
  7. 7. For SIMATIC NET PC Software V19: Upgrade to V19 Update 2 or later.
  8. 8. For SIMATIC PCS 7 V9.1: Upgrade to V9.1 SP2 UC05 or later.
Caveat Upgrading industrial automation software may require project migration and compatibility checks with existing hardware configurations; test thoroughly in non-production first

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing10.0 h
  • Review / QA4.0 h
32.0 hours of engineering $5,580
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,928.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-46280 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-46280 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data