CVE-2023-51438: Critical Redfish Flaw in Siemens SIMATIC IPC maxView

CVE-2023-51438 is a Critical (10.0) improper input validation flaw in maxView Storage Manager, shipped with Siemens SIMATIC IPC647E, IPC847E and IPC1047E on Windows. Where the Redfish server is configured for remote management, it can provide unauthorized access. Update maxView to V4.14.00.26068 or later.

What's affected

Siemens advisory SSA-702935 lists these products as affected:

• SIMATIC IPC647E, all versions with maxView Storage Manager before V4.14.00.26068 on Windows
• SIMATIC IPC847E, all versions with maxView Storage Manager before V4.14.00.26068 on Windows
• SIMATIC IPC1047E, all versions with maxView Storage Manager before V4.14.00.26068 on Windows

The advisory describes the issue as arising in default installations of maxView Storage Manager where the Redfish server is configured for remote system management. Microchip, the maker of maxView, has released new versions, and Siemens recommends updating to V4.14.00.26068 or later.

The record rates it 10.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The Siemens advisory gives the same base score. The record's CISA KEV flag is false.

How to check if you're exposed

Check each IPC for an installed maxView Storage Manager and read its version from the application or from Windows installed programs. On the command line you can list it with PowerShell:

Get-Package -Name "*maxView*" | Select-Object Name, Version

If the version is lower than V4.14.00.26068, the device is in scope. Next, find out whether the Redfish server is enabled for remote management, since the advisory ties the issue to that configuration. Check which network segments can reach the device and whether the management port is reachable from outside the control network.

Keep an asset list of IPC models and storage software versions. If your list does not record software on industrial PCs, build it now, because this is the kind of issue that gets missed.

What to do now

1. Inventory every SIMATIC IPC647E, IPC847E and IPC1047E and note the maxView Storage Manager version.
2. Update maxView Storage Manager to V4.14.00.26068 or later. The Siemens advisory links to the Microchip download page for the update.
3. If Redfish remote management is not needed, turn it off until you have patched.
4. Follow Siemens' general recommendation to protect network access to devices and run them in a protected IT environment, following its operational guidelines for industrial security.
5. Test the update on a spare unit first if the IPC runs a live process.

Why it matters

The record classifies the weakness as CWE-20 (Improper Input Validation). The advisory text is brief and does not describe the internal mechanism, so this post does not guess at it. What it does say is that a default installation with Redfish configured for remote management can give unauthorized access.

The score is the maximum because the vector needs no privileges and no user interaction, works over the network, and carries a changed scope, so impact extends beyond the vulnerable component. Industrial PCs often sit on flat networks and receive updates rarely, which raises the real world risk. The practical lesson is that vendor software bundled on a device is part of your attack surface and belongs in the same inventory as your applications.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Siemens advisory SSA-702935 (fetched, HTML version of the PDF cited in the record)
• Gold page for CVE-2023-51438

Last reviewed: 19 October 2026.