CVE-2023-23588

Name of the Vulnerable Software and Affected Versions SIMATIC IPC1047 versions prior to 4.09.00.25611 SIMATIC IPC1047E versions prior to 4.09.00.25611 SIMATIC IPC647D versions prior to 4.09.00.25611 SIMATIC IPC647E versions prior to 4.09.00.25611 SIMATIC IPC847D versions prior to 4.09.00.25611 SIMATIC IPC847E versions prior to 4.09.00.25611

Description The issue is related to the use of a non-unique TLS certificate in the Adaptec Maxview application on affected devices. This could allow a local attacker to decrypt intercepted local traffic between the browser and the application and perform a man-in-the-middle attack to modify data in transit.

Recommendations For SIMATIC IPC1047, update maxView Storage Manager to version 4.09.00.25611 or later. For SIMATIC IPC1047E, update maxView Storage Manager to version 4.09.00.25611 or later. For SIMATIC IPC647D, update maxView Storage Manager to version 4.09.00.25611 or later. For SIMATIC IPC647E, update maxView Storage Manager to version 4.09.00.25611 or later. For SIMATIC IPC847D, update maxView Storage Manager to version 4.09.00.25611 or later. For SIMATIC IPC847E, update maxView Storage Manager to version 4.09.00.25611 or later.