PatchTheCEVCVE-2023-28829: A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15
19
Routine
LOW 3.9DOWNGRADEDOWNGRADEUPGRADE
CVE-2023-28829 is a low-severity flaw (CVSS 3.9) affecting simatic net pc software, simatic pcs 7, simatic wincc. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used p
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.9 (Low) |
| Attack vector | Adjacent network |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 79%) |
| CISA exploited list | No |
| Weakness | CWE-477 |
| Published | 2023-06-13 |
| Last modified | 2026-10-23 |
Publisher (CNA): Siemens AG · Vendor: siemens
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
siemens simatic net pc software DOWNGRADE
Affected: 14.0 · 15.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 14.0
1. Check installed version
apt-cache policy simatic-net-pc-software || rpm -q simatic-net-pc-software || simatic-net-pc-software --version
2. No fixed release: DOWNGRADE to a release before 14.0 (Debian / Ubuntu)
apt-cache madison simatic-net-pc-software
sudo apt install simatic-net-pc-software=<VERSION_BEFORE_14.0>
sudo apt-mark hold simatic-net-pc-software
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list simatic-net-pc-software
sudo dnf downgrade simatic-net-pc-software-<VERSION_BEFORE_14.0>
sudo dnf versionlock add simatic-net-pc-software
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
siemens simatic pcs 7 DOWNGRADE
Affected: 8.2 · 9.0 · 9.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.2
1. Check installed version
apt-cache policy simatic-pcs-7 || rpm -q simatic-pcs-7 || simatic-pcs-7 --version
2. No fixed release: DOWNGRADE to a release before 8.2 (Debian / Ubuntu)
apt-cache madison simatic-pcs-7
sudo apt install simatic-pcs-7=<VERSION_BEFORE_8.2>
sudo apt-mark hold simatic-pcs-7
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list simatic-pcs-7
sudo dnf downgrade simatic-pcs-7-<VERSION_BEFORE_8.2>
sudo dnf versionlock add simatic-pcs-7
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
siemens simatic wincc UPGRADE
Affected: < 8.0
Fixed in: 8.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy simatic-wincc || rpm -q simatic-wincc || simatic-wincc --version
2. UPGRADE to 8.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade simatic-wincc
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade simatic-wincc
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
siemens sinaut st7sc MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy sinaut-st7sc || rpm -q sinaut-st7sc || sinaut-st7sc --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.