Siemens TIA Portal
TIA Portal contains a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-26293US | — | — | ||
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V… | ||||
references
External citations — patches, advisories, analysis.
- SSA-116924: Path Traversal Vulnerability in TIA Portal - CSAF Versionself
- SSA-116924: Path Traversal Vulnerability in TIA Portal - HTML Versionself
- ICS Advisory ICSA-23-103-04 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-103-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (8)
- MitigationTotally Integrated Automation Portal (TIA Portal) V15
Do not open untrusted project files or PC system configuration files
- MitigationTotally Integrated Automation Portal (TIA Portal) V16
Do not open untrusted project files or PC system configuration files
- MitigationTotally Integrated Automation Portal (TIA Portal) V17
Do not open untrusted project files or PC system configuration files
- MitigationTotally Integrated Automation Portal (TIA Portal) V18
Do not open untrusted project files or PC system configuration files
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V15
Currently no fix is planned
- FixedTotally Integrated Automation Portal (TIA Portal) V16
Update to V16 Update 7 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V17
Update to V17 Update 6 or later version
- FixedTotally Integrated Automation Portal (TIA Portal) V18
Update to V18 Update 1 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan