PatchSiren cyber security CVE debrief

CVE-2023-36799 Siemens CVE debrief

CVE-2023-36799 is a denial-of-service vulnerability affecting .NET Core and Visual Studio, with impact extended to Siemens ST7 ScadaConnect (6NH7997-5DA10-0AA0) as identified in CISA advisory ICSA-24-165-04 published June 11, 2024. The vulnerability carries a CVSS 3.1 score of 6.5 (MEDIUM severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating network-accessible attack vector, low attack complexity, no privileges required, user interaction required, and high availability impact. The underlying issue stems from .NET Core and Visual Studio components used within the Siemens product. Siemens has provided a vendor fix requiring update to version 1.1 or later. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor: Siemens
Product: ST7 ScadaConnect (6NH7997-5DA10-0AA0)
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-06-11
Original CVE updated: 2024-06-11
Advisory published: 2024-06-11
Advisory updated: 2024-06-11

Who should care

OT security teams operating Siemens ST7 ScadaConnect systems, industrial control system administrators, and organizations with .NET Core dependencies in critical infrastructure environments.

Technical summary

The vulnerability exists in .NET Core and Visual Studio components integrated into Siemens ST7 ScadaConnect. Attackers can trigger denial of service conditions remotely with user interaction. The CVSS 3.1 score of 6.5 reflects high availability impact with network accessibility. Siemens remediation requires updating affected products to version 1.1 or later.

Defensive priority

medium

Recommended defensive actions

Update Siemens ST7 ScadaConnect to version 1.1 or later per vendor guidance
Review .NET Core and Visual Studio runtime dependencies in OT environments for additional exposure
Apply network segmentation for SCADA systems per CISA ICS recommended practices
Monitor for anomalous network traffic targeting .NET Core applications
Validate update deployment through Siemens Industry Support portal

Evidence notes

CVE published and modified 2024-06-11 per source metadata. CISA CSAF advisory ICSA-24-165-04 published same date. Siemens SSA-341067 cross-referenced as primary vendor advisory. CVSS vector and remediation details sourced from CISA CSAF product tree and remediation sections.

Sources and references

Verified primary and authoritative sources

CVE-2023-36799 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2023-36799

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2023-36799 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-36799

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-341067.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-341067.html

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/pdf/ssa-341067.pdf

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/txt/ssa-341067.txt

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.