CVE-2023-38558: siemens simatic_pcs_neo
Vulnerability summary
CVE-2023-38558 is a medium (CVSS 5.5) vulnerability in siemens simatic_pcs_neo. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.6% of scored vulnerabilities.
Timeline
- 14-09-2023PublishedVulnerability first disclosed.
- 27-02-2025Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
0.00 pp
From 0.18% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-538Insertion of Sensitive Information into Externally-Accessible File or DirectoryThe product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Siemens3 products
- simatic_pcs_neo4.0 | 4.0:update_1
- simatic pcs neo (administration console) v4.0All versions (No fix recorded)
- simatic pcs neo (administration console) v4.0 update 1All versions (No fix recorded)
1 vendor · 3 products