CVE-2023-38533

A vulnerability has been identified in TIA Administrator (All versions < V3 SP2). The affected component creates temporary download files in a directory with insecure permissions. This could allow any authenticated attacker on Windows to disrupt the update process.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-319319.html	Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-319319.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:tia_administrator::::::::
	cpe:2.3:a:siemens:tia_administrator:3.0:-::::::
	cpe:2.3:a:siemens:tia_administrator:3.0:sp1::::::

History

21 Aug 2025, 16:14

Type	Values Removed	Values Added
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-319319.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-319319.html - Vendor Advisory
First Time		Siemens Siemens tia Administrator
CPE		cpe:2.3:a:siemens:tia_administrator:::::::: cpe:2.3:a:siemens:tia_administrator:3.0:sp1:::::: cpe:2.3:a:siemens:tia_administrator:3.0:-::::::

21 Nov 2024, 08:13

Type	Values Removed	Values Added
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-319319.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-319319.html -
Summary		(es) Se ha identificado una vulnerabilidad en TIA Administrator (Todas las versiones < V3 SP2). El componente afectado crea archivos de descarga temporales en un directorio con permisos inseguros. Esto podría permitir que cualquier atacante autenticado en Windows interrumpa el proceso de actualización.

11 Jun 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-11 12:15

Updated : 2025-08-21 16:14

NVD link : CVE-2023-38533

Mitre link : CVE-2023-38533

CVE.ORG link : CVE-2023-38533

JSON object : View

Products Affected

siemens

tia_administrator

CWE

CWE-379

Creation of Temporary File in Directory with Insecure Permissions

{"id": "CVE-2023-38533", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-06-11T12:15:12.297", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-319319.html", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-319319.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-379"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in TIA Administrator (All versions < V3 SP2). The affected component creates temporary download files in a directory with insecure permissions. This could allow any authenticated attacker on Windows to disrupt the update process."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en TIA Administrator (Todas las versiones < V3 SP2). El componente afectado crea archivos de descarga temporales en un directorio con permisos inseguros. Esto podr\u00eda permitir que cualquier atacante autenticado en Windows interrumpa el proceso de actualizaci\u00f3n."}], "lastModified": "2025-08-21T16:14:43.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:tia_administrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B97EEECD-CF90-4D12-9369-2087911A65FF", "versionEndExcluding": "3.0"}, {"criteria": "cpe:2.3:a:siemens:tia_administrator:3.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6641E5DC-8613-44F7-BECE-3B029D9E1633"}, {"criteria": "cpe:2.3:a:siemens:tia_administrator:3.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55CA3EB4-384A-4151-9A9B-66E77C99C268"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}