PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-5868 Siemens CVE debrief

A memory disclosure vulnerability in PostgreSQL affects Siemens SINEC NMS. The issue stems from aggregate function calls handling 'unknown'-type arguments derived from string literals without explicit type designation, which can cause excessive data output and leak portions of system memory to remote authenticated users. CISA published advisory ICSA-24-228-06 on August 13, 2024, identifying this vulnerability in Siemens SINEC NMS with a CVSS 3.1 score of 4.3 (Medium). The vulnerability requires network access and low privileges, with no user interaction needed. Siemens has released a vendor fix in version 3.0 or later.

Vendor
Siemens
Product
SINEC NMS
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-08-13
Original CVE updated
2024-08-13
Advisory published
2024-08-13
Advisory updated
2024-08-13

Who should care

Organizations operating Siemens SINEC NMS for industrial network management, particularly those with externally accessible management interfaces or multi-tenant environments where database query access is shared among users with varying trust levels.

Technical summary

CVE-2023-5868 is a memory disclosure vulnerability in PostgreSQL that manifests when aggregate functions process 'unknown'-type arguments from untyped string literals. The vulnerability causes excessive data output that can leak arbitrary bytes from system memory. In the context of Siemens SINEC NMS, this vulnerability could allow remote authenticated attackers to read sensitive information. The CVSS 3.1 score of 4.3 reflects network attack vector, low attack complexity, low privileges required, and low confidentiality impact. Exploitation has been observed in the wild (E:P). Siemens has addressed this in SINEC NMS version 3.0 and later.

Defensive priority

medium

Recommended defensive actions

  • Update Siemens SINEC NMS to version 3.0 or later per vendor remediation guidance.
  • Apply network segmentation and access controls to limit exposure of SINEC NMS management interfaces.
  • Monitor for anomalous database query patterns involving aggregate functions with untyped string literals.
  • Review PostgreSQL query logs for unusual aggregate function usage that may indicate exploitation attempts.
  • Follow CISA ICS recommended practices for defense-in-depth strategies for industrial control systems.

Evidence notes

CISA CSAF advisory ICSA-24-228-06 published 2024-08-13 identifies CVE-2023-5868 in Siemens SINEC NMS. The underlying vulnerability is a PostgreSQL memory disclosure issue where aggregate functions with 'unknown'-type arguments can leak memory contents. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C.

Official resources

2024-08-13