{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The Adaptec Maxview application shipped with affected SIMATIC IPCs contains a hard coded, non-unique certificate to secure HTTPS connections between the browser and the local Maxview configuration application. A local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.\n\nAdaptec has released updates for the affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-511182.html"
      },
      {
        "category": "self",
        "summary": "SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-511182.json"
      },
      {
        "category": "self",
        "summary": "SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-511182.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-511182.txt"
      }
    ],
    "title": "SSA-511182: Use of Static TLS Certificate Known Hard Coded Private Keys in Adaptec Maxview Application",
    "tracking": {
      "current_release_date": "2023-04-11T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-511182",
      "initial_release_date": "2023-04-11T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-04-11T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC IPC1047",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC1047"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions with maxView Storage Manager \u003c 4.09.00.25611 on Windows",
                "product": {
                  "name": "SIMATIC IPC1047E",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC1047E"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC IPC647D",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC647D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions with maxView Storage Manager \u003c 4.09.00.25611 on Windows",
                "product": {
                  "name": "SIMATIC IPC647E",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC647E"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC IPC847D",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC847D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions with maxView Storage Manager \u003c 4.09.00.25611 on Windows",
                "product": {
                  "name": "SIMATIC IPC847E",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC847E"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-23588",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The Adaptec Maxview application on affected devices is using a non-unique TLS certificate across installations to protect the communication from the local browser to the local application.\r\nA local attacker may use this key to decrypt intercepted local traffic between the browser and the application and could perform a man-in-the-middle attack in order to modify data in transit.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "1",
            "3",
            "5"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update maxView Storage Manager to 4.09.00.25611 or later version",
          "product_ids": [
            "2",
            "4",
            "6"
          ],
          "url": "https://storage.microsemi.com/en-us/support/raid/sas_raid/asr-3151-4i/"
        },
        {
          "category": "workaround",
          "details": "Update the default self-signed device X.509 certificate with an own trusted certificate",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2023-23588"
    }
  ]
}