CVE-2023-24287: 
Linux Debian vulnerability analysis and mitigation

A vulnerability has been identified in SIMATIC PCS 7 V8.2, V9.0, and V9.1, SIMATIC WinCC Runtime Professional V16 and V17, and SIMATIC WinCC V7.3, V7.4, and V7.5 systems. The vulnerability (CVE-2023-24287) allows an authenticated attacker to escape the WinCC Kiosk Mode when no printer is configured on the host system (Siemens Advisory).

The vulnerability is classified with a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability stems from a missing printer configuration on the host system that can be exploited to bypass the WinCC Kiosk Mode security restrictions. The issue is tracked as CWE-1188 (Insecure Default Initialization of Resource) (NVD).

If successfully exploited, this vulnerability allows an authenticated attacker with local access to escape the WinCC Kiosk Mode restrictions by leveraging the printer dialog functionality. This could potentially lead to unauthorized access to system resources and compromise of system security controls (Siemens Advisory).

Siemens has released security updates to address this vulnerability. Users should update to SIMATIC PCS 7 V9.0 SP3 UC06, V9.1 SP1 UC01, SIMATIC WinCC Runtime Professional V17 Upd4, WinCC V7.4 SP1 Update 21, or WinCC V7.5 SP2 Update 8 as applicable (Siemens Advisory).