CVE-2023-42796

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11). The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint. This could allow an authenticated remote attacker to traverse directories on the system and download arbitrary files. By exploring active session IDs, the vulnerability could potentially be leveraged to escalate privileges to the administrator role.

• CWE-22

• https://cert-portal.siemens.com/productcert/pdf/ssa-770890.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-770890.pdfPatch, Vendor Advisory

Published

Oct 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42790A stack-based buffer overflow vulnerability in Fortinet Fort…8.1
• CVE-2023-42791A relative path traversal in Fortinet FortiManager version 7…8.8
• CVE-2023-42792Apache Airflow, in versions prior to 2.7.2, contains a secur…6.5
• CVE-2023-42793In JetBrains TeamCity before 2023.05.4 authentication bypass…9.8
• CVE-2023-42794Incomplete Cleanup vulnerability in Apache Tomcat. The inte…5.9
• CVE-2023-42795Incomplete Cleanup vulnerability in Apache Tomcat.When recyc…5.3
• CVE-2023-42797A vulnerability has been identified in CP-8031 MASTER MODULE…7.2
• CVE-2023-42798AutomataCI is a template git repository equipped with a nati…9.1
• CVE-2023-42799Moonlight-common-c contains the core GameStream client code …8.8
• CVE-2023-4280An unvalidated input in Silicon Labs TrustZone implementatio…9.8
• CVE-2023-42800Moonlight-common-c contains the core GameStream client code …8.8
• CVE-2023-42801Moonlight-common-c contains the core GameStream client code …7.6