CVE record · CVE-2023-46280

Out-of-bounds read in Siemens Security Configuration Tool (SCT) and others

CVSS 8.2 HighEPSS 0.0026 · 17th percentile

Published by the CVE Program (CNA: siemens) at 14 May 2024, 10:01 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Siemens	Security Configuration Tool (SCT)	affected before * custom Other versions: unknown
Siemens	SIMATIC Automation Tool	affected before V5.0 SP2 custom Other versions: unknown
Siemens	SIMATIC BATCH V9.1	affected before V9.1 SP2 Upd5 custom Other versions: unknown
Siemens	SIMATIC NET PC Software V16	affected before V16 Update 8 custom Other versions: unknown
Siemens	SIMATIC NET PC Software V17	affected before * custom Other versions: unknown
Siemens	SIMATIC NET PC Software V18	affected before V18 SP1 custom Other versions: unknown
Siemens	SIMATIC NET PC Software V19	affected before V19 Update 2 custom Other versions: unknown
Siemens	SIMATIC PCS 7 V9.1	affected before V9.1 SP2 UC05 custom Other versions: unknown
Siemens	SIMATIC PDM V9.2	affected before V9.2 SP2 Upd3 custom Other versions: unknown
Siemens	SIMATIC Route Control V9.1	affected before V9.1 SP2 Upd3 custom Other versions: unknown
Siemens	SIMATIC S7-PCT	affected before V3.5 SP3 Update 6 custom Other versions: unknown
Siemens	SIMATIC STEP 7 V5	affected before V5.7 SP3 custom Other versions: unknown
Siemens	SIMATIC WinCC OA V3.17	affected before * custom Other versions: unknown
Siemens	SIMATIC WinCC OA V3.18	affected before V3.18 P025 custom Other versions: unknown
Siemens	SIMATIC WinCC OA V3.19	affected before V3.19 P010 custom Other versions: unknown
Siemens	SIMATIC WinCC Runtime Advanced	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIMATIC WinCC Runtime Professional V16	affected before V16 Update 6 custom Other versions: unknown
Siemens	SIMATIC WinCC Runtime Professional V17	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIMATIC WinCC Runtime Professional V18	affected before V18 Update 4 custom Other versions: unknown
Siemens	SIMATIC WinCC Runtime Professional V19	affected before V19 Update 2 custom Other versions: unknown
Siemens	SIMATIC WinCC V7.4	affected before * custom Other versions: unknown
Siemens	SIMATIC WinCC V7.5	affected before V7.5 SP2 Update 17 custom Other versions: unknown
Siemens	SIMATIC WinCC V8.0	affected before V8.0 Update 5 custom Other versions: unknown
Siemens	SINAMICS Startdrive	affected before V19 SP1 custom Other versions: unknown
Siemens	SINEC NMS	affected before V3.0 custom Other versions: unknown
Siemens	SINUMERIK ONE virtual	affected before V6.23 custom Other versions: unknown
Siemens	SINUMERIK PLC Programming Tool	affected before V3.3.12 custom Other versions: unknown
Siemens	TIA Portal Cloud Connector	affected before V2.0 custom Other versions: unknown
Siemens	Totally Integrated Automation Portal (TIA Portal) V15.1	affected before * custom Other versions: unknown
Siemens	Totally Integrated Automation Portal (TIA Portal) V16	affected before * custom Other versions: unknown
Siemens	Totally Integrated Automation Portal (TIA Portal) V17	affected before V17 Update 8 custom Other versions: unknown
Siemens	Totally Integrated Automation Portal (TIA Portal) V18	affected before V18 Update 4 custom Other versions: unknown
Siemens	Totally Integrated Automation Portal (TIA Portal) V19	affected before V19 Update 2 custom Other versions: unknown
Siemens	SINEC NMS	affected before V3.0 SP1 custom Other versions: unknown

Identifiers: CVE-2023-46280
CNA: siemens
Weakness (CWE): CWE-125
Tags: Siemens Security Configuration Tool (SCT)
Siemens SIMATIC Automation Tool
Siemens SIMATIC BATCH V9.1
Siemens SIMATIC NET PC Software V16
Siemens SIMATIC NET PC Software V17
Siemens SIMATIC NET PC Software V18
Siemens SIMATIC NET PC Software V19
Siemens SIMATIC PCS 7 V9.1
Memory corruption
Published: 14 May 2024
Updated: 9 Jun 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
6.5	Medium	3.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C	CNA (siemens)
8.2	High	4.0	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H	CNA (siemens)Used for this record

CISA KEV Not listed.
EPSS 0.0026, the 17th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 14 May 2024. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.