CVE-2023-28831

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-12 · updated 2026-06-17
Weakness: CWE-190

Description

The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an infinite loop during certificate validation. This could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate.

Affected products

Siemens Simatic Cloud Connect 7 Cc712 Firmware: before 2.2 — fixed in 2.2
Siemens Simatic Cloud Connect 7 Cc716 Firmware: before 2.2 — fixed in 2.2
Siemens Simatic Drive Controller Cpu 1504D Tf Firmware: before 2.2 — fixed in 2.2
Siemens Simatic Drive Controller Cpu 1507D Tf Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic Et 200Sp Open Controller Cpu Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1200 Cpu Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1510Sp-1 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1510Sp F-1 Pn Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1511-1 Pn Firmware: before 21.9.7 — fixed in 21.9.7
Siemens Simatic S7-1500 Cpu 1511C-1 Pn Firmware: before 30.0.0 — fixed in 30.0.0
Siemens Simatic S7-1500 Cpu 1511F-1 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1511T-1 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1511Tf-1 Pn Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1512C-1 Pn Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1512Sp-1 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1512Sp F-1 Pn Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1513-1 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1513F-1 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1513R-1 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1514Sp-2 Pn Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1514Sp F-2 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1514Spt-2 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1514Spt F-2 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1515-2 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1515F-2 Pn Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1515R-2 Pn Firmware: before 2.9.7 — fixed in 2.9.7
Siemens Simatic S7-1500 Cpu 1515T-2 Pn Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1515Tf-2 Pn Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1516-3 Pn/Dp Firmware: before 3.0.3 — fixed in 3.0.3
Siemens Simatic S7-1500 Cpu 1516F-3 Pn/Dp Firmware: before 3.0.3 — fixed in 3.0.3

How to fix

Upgrade to a fixed version: Siemens Simatic Cloud Connect 7 Cc712 Firmware 2.2; Siemens Simatic Cloud Connect 7 Cc716 Firmware 2.2; Siemens Simatic Drive Controller Cpu 1504D Tf Firmware 2.2; Siemens Simatic Drive Controller Cpu 1507D Tf Firmware 2.9.7; Siemens Simatic Et 200Sp Open Controller Cpu Firmware 2.9.7; Siemens Simatic S7-1200 Cpu Firmware 3.0.3; Siemens Simatic S7-1500 Cpu 1510Sp-1 Pn Firmware 2.9.7; Siemens Simatic S7-1500 Cpu 1510Sp F-1 Pn Firmware 3.0.3; Siemens Simatic S7-1500 Cpu 1511-1 Pn Firmware 21.9.7; Siemens Simatic S7-1500 Cpu 1511C-1 Pn Firmware 30.0.0; Siemens Simatic S7-1500 Cpu 1511F-1 Pn Firmware 2.9.7; Siemens Simatic S7-1500 Cpu 1511T-1 Pn Firmware 2.9.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-28831 or the next vulnerability affects your stack