Skip to content
Fencer Vulns
medium 6.5

CVE-2023-48364 json

A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SI…

published 2024-02-13 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-52418

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 Update 4). The implementation of the RPC (Remote Procedure call) communication protocol in the affected products do not properly handle certain malformed RPC messages. An attacker could use this vulnerability to cause a denial of service condition in the RPC server.

Patch / fix

  • Siemens SIMATIC PCS 7 V9.1 V9.1 SP2 UC05
  • Siemens SIMATIC WinCC Runtime Professional V18 V18 Update 4
  • Siemens SIMATIC WinCC Runtime Professional V19 V19 Update 2
  • Siemens SIMATIC WinCC V7.5 V7.5 SP2 Update 15
  • Siemens SIMATIC WinCC V8.0 V8.0 Update 4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-046-12 updated cvss 6.5

Siemens SIMATIC WinCC, OpenPCS

  • Siemens OpenPCS 7 V9.1 <V9.1_SP2_UC05 Siemens SIMATIC BATCH V9.1 <V9.1_SP2_UC05
    affected: vendor fix, workaround
  • Siemens SIMATIC PCS 7 V9.1 <V9.1_SP2_UC05
    affected: fixed in V9.1, workaround support.industry.siemens.com
  • Siemens SIMATIC Route Control V9.1 <V9.1_SP2_UC05
    affected: vendor fix, workaround
  • Siemens SIMATIC WinCC Runtime Professional V18 <V18_Update_4
    affected: fixed in V18, workaround
  • Siemens SIMATIC WinCC Runtime Professional V19 <V19_Update_2
    affected: fixed in V19, workaround
  • Siemens SIMATIC WinCC V7.4
    affected: workaround, no fix planned
  • Siemens SIMATIC WinCC V7.5 <V7.5_SP2_Update_15
    affected: fixed in V7.5, workaround support.industry.siemens.com
  • Siemens SIMATIC WinCC V8.0 <V8.0_Update_4
    affected: fixed in V8.0, workaround

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CNA 4.0 7.1 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 7.1 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Siemens OpenPCS 7 V9.1
  • Siemens SIMATIC BATCH V9.1
  • Siemens SIMATIC PCS 7 V9.1
  • Siemens SIMATIC Route Control V9.1
  • Siemens SIMATIC WinCC Runtime Professional V18
  • Siemens SIMATIC WinCC Runtime Professional V19
  • Siemens SIMATIC WinCC V7.4
  • Siemens SIMATIC WinCC V7.5
  • Siemens SIMATIC WinCC V8.0

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.