Cyber Resilience

CVE-2023-27465

Info Disclosure in Siemens Simotion D425-2 Dp Firmware 5.4 – 5.5

Published
13 June 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 4.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0028 20th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2023-27465 is a medium-severity Exposure of Sensitive Information Due to Incompatible Policies (CWE-213) vulnerability in Siemens Simotion D425-2 Dp Firmware. Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Token Impersonation/Theft (T1134.001); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 < V5.5 SP1), SIMOTION C240 PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP/PN (All versions…

more

>= V5.4 < V5.5 SP1), SIMOTION D425-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D425-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D435-2 DP (All versions >= V5.4 < V5.5 SP1), SIMOTION D435-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D445-2 DP/PN (All versions >= V5.4), SIMOTION D445-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D455-2 DP/PN (All versions >= V5.4 < V5.5 SP1), SIMOTION P320-4 E (All versions >= V5.4), SIMOTION P320-4 S (All versions >= V5.4). When operated with Security Level Low the device does not protect access to certain services relevant for debugging. This could allow an unauthenticated attacker to extract confidential technology object (TO) configuration from the device.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1134.001 Token Impersonation/Theft Stealth
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1552.002 Credentials in Registry Credential Access
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
T1615 Group Policy Discovery Discovery
Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the…
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-29106Same vendor: Siemens
CVE-2024-27947Same vendor: Siemens
CVE-2025-40768Same vendor: Siemens
CVE-2025-40941Same vendor: Siemens
CVE-2025-40940Same vendor: Siemens
CVE-2025-40803Same vendor: Siemens
CVE-2024-37991Same vendor: Siemens
CVE-2024-46894Same vendor: Siemens
CVE-2023-29107Same vendor: Siemens
CVE-2025-25266Same vendor: Siemens

Affected Assets

siemens
simotion d425-2 dp firmware
5.5 · 5.4 — 5.5
siemens
simotion d425-2 dp\/pn firmware
5.5 · 5.4 — 5.5
siemens
simotion d435-2 dp firmware
5.5 · 5.4 — 5.5
siemens
simotion d435-2 dp\/pn firmware
5.5 · 5.4 — 5.5
siemens
simotion d445-2 dp\/pn \(0aa1\) firmware
5.5 · 5.4 — 5.5
siemens
simotion d445-2 dp\/pn \(0aa0\) firmware
5.4
siemens
simotion d455-2 dp\/pn firmware
5.5 · 5.4 — 5.5
siemens
simotion p320-4 e firmware
5.4
siemens
simotion p320-4 s firmware
5.4
siemens
simotion d410-2 dp firmware
5.5 · 5.4 — 5.5
+3 more product configuration(s) — see NVD for full list

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 11 hardening rules · 6 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.4.9
  • V11.7.1
  • V14.1.2
  • V14.2.4

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-213

Limits PII handling to authorized authority, making unauthorized exposure of sensitive information less likely.

addresses: CWE-200

Automated marking applies security attributes to system outputs, making it harder for attackers to exploit unmarked sensitive information leading to unauthorized exposure.

addresses: CWE-200

Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.

addresses: CWE-200

Prevents unauthorized exposure of sensitive information by prohibiting untrusted external systems from processing or storing it.

addresses: CWE-200

By enforcing authorization matching prior to sharing, the control reduces the risk of exposing sensitive information to unauthorized actors.

addresses: CWE-200

Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors.

addresses: CWE-200

Data mining protection mechanisms detect and block unauthorized bulk extraction of sensitive data, directly mitigating exposure to unauthorized actors.

addresses: CWE-200

Literacy training teaches users to recognize and avoid actions that result in unauthorized exposure of sensitive information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

GV.OC-02 mostly match
prevents

Understanding stakeholder needs directly surfaces incompatible sensitivity expectations that produce the exposure.

GV.PO-01 mostly match
prevents

Establishing risk-management policy based on organizational context is the primary mechanism for aligning divergent sensitivity rules.

PR.AA-05 mostly match
prevents

PR.AA-05 directly enforces least-privilege authorization that blocks most unauthorized disclosures, yet CWE-200 also arises from logging, error messages, and side-channel paths that access controls alone do not address.

PR.DS-10 mostly match
prevents

PR.DS-10 mostly prevents CWE-200 by directly eliminating unauthorized access to sensitive data-in-use, yet only partially addresses the weakness because CWE-200 spans many other exposure vectors outside runtime protection.

PR.IR-01 mostly match
prevents

PR.IR-01's segmentation/zero-trust controls largely eliminate network-level unauthorized access paths that enable exposure, yet CWE-200 spans many additional vectors (API responses, logs, app logic) that network controls alone cannot close.

PR.PS-06 mostly match
prevents

Secure SDLC practices catch most exposure flaws via design, testing and release controls, yet CWE-200 spans runtime/config issues a single development outcome cannot fully close.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.

prevents

Suppressing system details, error specifics, and previous log-on information until successful authentication reduces the information an unauthenticated attacker can gather.

prevents

Classification directly addresses mismatched sensitivity views by defining what must be protected.

prevents

Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.

prevents

Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.

prevents

Legal and contractual requirements often impose stricter sensitivity rules than developer policy.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Ubuntu 24.04 (3 rules)
  • V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. prevents CWE-200
  • V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
  • V-270708 Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. prevents CWE-213
Windows 10 (1 rule)
  • V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. prevents CWE-200
Windows Server 2016 (1 rule)
  • V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
Windows Server 2019 (2 rules)
  • V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
  • V-205757 Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group. prevents CWE-213
Windows Server 2022 (1 rule)
  • V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200

References