PatchSiren cyber security CVE debrief

CVE-2023-36558 Siemens CVE debrief

CVE-2023-36558 is a security feature bypass vulnerability in ASP.NET Core affecting Siemens ST7 ScadaConnect (6NH7997-5DA10-0AA0). Published on June 11, 2024, this vulnerability carries a CVSS 3.1 score of 6.2 (MEDIUM severity) with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C. The local attack vector with low attack complexity and no required privileges indicates that an attacker with local access could bypass security features to achieve high confidentiality impact. Siemens has released a vendor fix: update to version 1.1 or later. CISA published advisory ICSA-24-165-04 on the same date as the CVE publication, coordinating disclosure through the CSAF format. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor: Siemens
Product: ST7 ScadaConnect (6NH7997-5DA10-0AA0)
CVSS: MEDIUM 6.2
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-06-11
Original CVE updated: 2024-06-11
Advisory published: 2024-06-11
Advisory updated: 2024-06-11

Who should care

Organizations operating Siemens ST7 ScadaConnect industrial control systems, particularly in critical infrastructure sectors. Security teams responsible for OT/ICS environments, SCADA system administrators, and compliance officers tracking CISA ICS advisories should prioritize this update.

Technical summary

A security feature bypass vulnerability exists in ASP.NET Core as implemented in Siemens ST7 ScadaConnect. The vulnerability allows local attackers to bypass security controls without authentication, resulting in high confidentiality impact. The attack requires local access but no user interaction or privileges. Siemens has addressed this in version 1.1.

Defensive priority

medium

Recommended defensive actions

Update Siemens ST7 ScadaConnect to version 1.1 or later per vendor guidance
Verify current installed version of ST7 ScadaConnect against vendor security advisory
Apply defense-in-depth controls for industrial control systems as recommended by CISA
Monitor for additional vendor security advisories from Siemens CERT portal
Review network segmentation for SCADA systems to limit local attack surface

Evidence notes

CVE published 2024-06-11; CISA advisory ICSA-24-165-04 published same date. Siemens SSA-341067 provides vendor remediation guidance. CVSS vector confirms local attack vector with high confidentiality impact.

Sources and references

Verified primary and authoritative sources

CVE-2023-36558 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2023-36558

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2023-36558 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-36558

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-341067.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-341067.html

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/pdf/ssa-341067.pdf

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/txt/ssa-341067.txt

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.