# Out-of-bounds read in Siemens Security Configuration Tool (SCT) and others CVE record · `CVE-2023-46280` - **Identifiers:** `CVE-2023-46280` - **State:** Confirmed - **Severity:** CVSS 8.2 High - **Critical:** No - **CNA:** siemens - **Weakness (CWE):** [CWE-125](https://cwe.mitre.org/data/definitions/125.html) - **Tags:** [Memory corruption](https://agentprime.io/advisories/tag/memory-corruption.md) - **Technologies:** [Siemens Security Configuration Tool (SCT)](https://agentprime.io/advisories/technology/siemens-security-configuration-tool-sct.md) · [Siemens SIMATIC Automation Tool](https://agentprime.io/advisories/technology/siemens-simatic-automation-tool.md) · [Siemens SIMATIC BATCH V9.1](https://agentprime.io/advisories/technology/siemens-simatic-batch-v9-1.md) · [Siemens SIMATIC NET PC Software V16](https://agentprime.io/advisories/technology/siemens-simatic-net-pc-software-v16.md) · [Siemens SIMATIC NET PC Software V17](https://agentprime.io/advisories/technology/siemens-simatic-net-pc-software-v17.md) · [Siemens SIMATIC NET PC Software V18](https://agentprime.io/advisories/technology/siemens-simatic-net-pc-software-v18.md) · [Siemens SIMATIC NET PC Software V19](https://agentprime.io/advisories/technology/siemens-simatic-net-pc-software-v19.md) · [Siemens SIMATIC PCS 7 V9.1](https://agentprime.io/advisories/technology/siemens-simatic-pcs-7-v9-1.md) · [Siemens SIMATIC PDM V9.2](https://agentprime.io/advisories/technology/siemens-simatic-pdm-v9-2.md) · [Siemens SIMATIC Route Control V9.1](https://agentprime.io/advisories/technology/siemens-simatic-route-control-v9-1.md) · [Siemens SIMATIC S7-PCT](https://agentprime.io/advisories/technology/siemens-simatic-s7-pct.md) · [Siemens SIMATIC STEP 7 V5](https://agentprime.io/advisories/technology/siemens-simatic-step-7-v5.md) · [Siemens SIMATIC WinCC OA V3.17](https://agentprime.io/advisories/technology/siemens-simatic-wincc-oa-v3-17.md) · [Siemens SIMATIC WinCC OA V3.18](https://agentprime.io/advisories/technology/siemens-simatic-wincc-oa-v3-18.md) · [Siemens SIMATIC WinCC OA V3.19](https://agentprime.io/advisories/technology/siemens-simatic-wincc-oa-v3-19.md) · [Siemens SIMATIC WinCC Runtime Advanced](https://agentprime.io/advisories/technology/siemens-simatic-wincc-runtime-advanced.md) · [Siemens SIMATIC WinCC Runtime Professional V16](https://agentprime.io/advisories/technology/siemens-simatic-wincc-runtime-professional-v16.md) · [Siemens SIMATIC WinCC Runtime Professional V17](https://agentprime.io/advisories/technology/siemens-simatic-wincc-runtime-professional-v17.md) · [Siemens SIMATIC WinCC Runtime Professional V18](https://agentprime.io/advisories/technology/siemens-simatic-wincc-runtime-professional-v18.md) · [Siemens SIMATIC WinCC Runtime Professional V19](https://agentprime.io/advisories/technology/siemens-simatic-wincc-runtime-professional-v19.md) - **Published:** 14 May 2024 - **Updated:** 9 Jun 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: siemens) at 14 May 2024, 10:01 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: Siemens. Product: Security Configuration Tool (SCT). - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Automation Tool. - affected: `before V5.0 SP2` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC BATCH V9.1. - affected: `before V9.1 SP2 Upd5` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC NET PC Software V16. - affected: `before V16 Update 8` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC NET PC Software V17. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC NET PC Software V18. - affected: `before V18 SP1` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC NET PC Software V19. - affected: `before V19 Update 2` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC PCS 7 V9.1. - affected: `before V9.1 SP2 UC05` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC PDM V9.2. - affected: `before V9.2 SP2 Upd3` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Route Control V9.1. - affected: `before V9.1 SP2 Upd3` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC S7-PCT. - affected: `before V3.5 SP3 Update 6` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC STEP 7 V5. - affected: `before V5.7 SP3` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC OA V3.17. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC OA V3.18. - affected: `before V3.18 P025` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC OA V3.19. - affected: `before V3.19 P010` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC Runtime Advanced. - affected: `before V17 Update 8` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC Runtime Professional V16. - affected: `before V16 Update 6` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC Runtime Professional V17. - affected: `before V17 Update 8` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC Runtime Professional V18. - affected: `before V18 Update 4` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC Runtime Professional V19. - affected: `before V19 Update 2` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC V7.4. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC V7.5. - affected: `before V7.5 SP2 Update 17` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC WinCC V8.0. - affected: `before V8.0 Update 5` (custom) - Other versions: unknown - Vendor: Siemens. Product: SINAMICS Startdrive. - affected: `before V19 SP1` (custom) - Other versions: unknown - Vendor: Siemens. Product: SINEC NMS. - affected: `before V3.0` (custom) - Other versions: unknown - Vendor: Siemens. Product: SINUMERIK ONE virtual. - affected: `before V6.23` (custom) - Other versions: unknown - Vendor: Siemens. Product: SINUMERIK PLC Programming Tool. - affected: `before V3.3.12` (custom) - Other versions: unknown - Vendor: Siemens. Product: TIA Portal Cloud Connector. - affected: `before V2.0` (custom) - Other versions: unknown - Vendor: Siemens. Product: Totally Integrated Automation Portal (TIA Portal) V15.1. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: Totally Integrated Automation Portal (TIA Portal) V16. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: Totally Integrated Automation Portal (TIA Portal) V17. - affected: `before V17 Update 8` (custom) - Other versions: unknown - Vendor: Siemens. Product: Totally Integrated Automation Portal (TIA Portal) V18. - affected: `before V18 Update 4` (custom) - Other versions: unknown - Vendor: Siemens. Product: Totally Integrated Automation Portal (TIA Portal) V19. - affected: `before V19 Update 2` (custom) - Other versions: unknown - Vendor: Siemens. Product: SINEC NMS. - affected: `before V3.0 SP1` (custom) - Other versions: unknown ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation - 6.5 Medium, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C`, from CNA (siemens) - 8.2 High, CVSS 4.0: `CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H`, from CNA (siemens) (used for this record) - **CISA KEV:** Not listed. - **EPSS:** 0.0026, the 17th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 14 May 2024. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2023-46280](https://www.cve.org/CVERecord?id=CVE-2023-46280) - [NVD: CVE-2023-46280](https://nvd.nist.gov/vuln/detail/CVE-2023-46280) ### References from the CNA - - - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .