PatchSiren cyber security CVE debrief

CVE-2023-35391 Microsoft CVE debrief

CVE-2023-35391 is an information disclosure vulnerability affecting ASP.NET Core SignalR and Visual Studio, with confirmed impact on Siemens ST7 ScadaConnect (6NH7997-5DA10-0AA0). Published June 11, 2024, this vulnerability carries a CVSS 3.1 score of 6.2 (MEDIUM severity). The underlying ASP.NET Core SignalR flaw can expose sensitive information to unauthorized actors. Siemens has identified this vulnerability in their ST7 ScadaConnect product and released a vendor fix. The vulnerability requires local attack vector access with low attack complexity, no privileges required, and no user interaction needed. Successful exploitation results in high confidentiality impact with no integrity or availability impact.

Vendor: Microsoft
Product: ST7 ScadaConnect (6NH7997-5DA10-0AA0)
CVSS: MEDIUM 6.2
CISA KEV: Not listed in stored evidence
Original CVE published: 2023-08-08
Original CVE updated: 2026-08-10
Advisory published: 2023-08-08
Advisory updated: 2026-08-10

Who should care

Organizations operating Siemens ST7 ScadaConnect (6NH7997-5DA10-0AA0) in industrial control environments, critical infrastructure operators using Siemens SCADA systems, security teams managing ASP.NET Core SignalR deployments, and OT/ICS security practitioners responsible for patch management in manufacturing, energy, and utility sectors.

Technical summary

This vulnerability exists in ASP.NET Core SignalR and Visual Studio, affecting Siemens ST7 ScadaConnect industrial control product. The flaw allows information disclosure with local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). Exploitation yields high confidentiality impact (C:H) with no integrity or availability effects. The vulnerability has proof-of-concept exploit availability (E:P) with official vendor fix released (RL:O). Siemens remediation requires updating to ST7 ScadaConnect V1.1 or later.

Defensive priority

medium

Recommended defensive actions

Update Siemens ST7 ScadaConnect to V1.1 or later version per vendor guidance
Review and apply CISA ICS recommended practices for defense-in-depth security
Monitor Siemens CERT portal for additional security advisories related to ST7 ScadaConnect
Assess environment for other ASP.NET Core SignalR implementations that may require patching
Implement network segmentation for industrial control systems per CISA guidance

Evidence notes

CVE published 2024-06-11. CISA CSAF advisory ICSA-24-165-04 published same date. Siemens SSA-341067 advisory confirms affected product and remediation. CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C.

Sources and references

Verified primary and authoritative sources

CVE-2023-35391 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2023-35391

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2023-35391 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-35391

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-341067.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-341067.html

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/pdf/ssa-341067.pdf

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/txt/ssa-341067.txt

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.