CVE-2023-52891

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-09 · updated 2026-06-17
Weakness: CWE-1325

Description

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMIT V10 (All versions), SIMIT V11 (All versions < V11.1). Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in Siemens products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the server.

Affected products

Siemens SIMATIC Energy Manager Basic: before V7.5 — fixed in V7.5
Siemens SIMATIC Energy Manager PRO: before V7.5 — fixed in V7.5
Siemens SIMATIC IPC DiagBase: all versions
Siemens SIMATIC IPC DiagMonitor: all versions
Siemens SIMIT V10: all versions
Siemens SIMIT V11: before V11.1 — fixed in V11.1

How to fix

Upgrade to a fixed version: Siemens SIMATIC Energy Manager Basic V7.5; Siemens SIMATIC Energy Manager PRO V7.5; Siemens SIMIT V11 V11.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-52891 or the next vulnerability affects your stack