PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-35391 Microsoft CVE debrief

CVE-2023-35391 is an information disclosure vulnerability affecting ASP.NET Core SignalR and Visual Studio, with confirmed impact on Siemens ST7 ScadaConnect (6NH7997-5DA10-0AA0). Published June 11, 2024, this vulnerability carries a CVSS 3.1 score of 6.2 (MEDIUM severity). The underlying ASP.NET Core SignalR flaw can expose sensitive information to unauthorized actors. Siemens has identified this vulnerability in their ST7 ScadaConnect product and released a vendor fix. The vulnerability requires local attack vector access with low attack complexity, no privileges required, and no user interaction needed. Successful exploitation results in high confidentiality impact with no integrity or availability impact.

Vendor
Microsoft
Product
ST7 ScadaConnect (6NH7997-5DA10-0AA0)
CVSS
MEDIUM 6.2
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-11
Original CVE updated
2024-06-11
Advisory published
2024-06-11
Advisory updated
2024-06-11

Who should care

Organizations operating Siemens ST7 ScadaConnect (6NH7997-5DA10-0AA0) in industrial control environments, critical infrastructure operators using Siemens SCADA systems, security teams managing ASP.NET Core SignalR deployments, and OT/ICS security practitioners responsible for patch management in manufacturing, energy, and utility sectors.

Technical summary

This vulnerability exists in ASP.NET Core SignalR and Visual Studio, affecting Siemens ST7 ScadaConnect industrial control product. The flaw allows information disclosure with local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). Exploitation yields high confidentiality impact (C:H) with no integrity or availability effects. The vulnerability has proof-of-concept exploit availability (E:P) with official vendor fix released (RL:O). Siemens remediation requires updating to ST7 ScadaConnect V1.1 or later.

Defensive priority

medium

Recommended defensive actions

  • Update Siemens ST7 ScadaConnect to V1.1 or later version per vendor guidance
  • Review and apply CISA ICS recommended practices for defense-in-depth security
  • Monitor Siemens CERT portal for additional security advisories related to ST7 ScadaConnect
  • Assess environment for other ASP.NET Core SignalR implementations that may require patching
  • Implement network segmentation for industrial control systems per CISA guidance

Evidence notes

CVE published 2024-06-11. CISA CSAF advisory ICSA-24-165-04 published same date. Siemens SSA-341067 advisory confirms affected product and remediation. CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C.

Official resources

2024-06-11