ICSA-21-194-05

Siemens SIMATIC Software Products

view advisory published 2021-07-13

Multiple SIMATIC Software products are affected by a vulnerability that could allow an attacker to manipulate project files and remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-31893US	high7.8	0.56% (47th)	—	2021-07-13
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP…

references

External citations — patches, advisories, analysis.

remediations (10)

No fix availableSIMATIC PCS 7 V8.2 and earlier
Currently no remediation is available
FixedSIMATIC PCS 7 V9.0
Update to V9.0 SP3 or later version
FixedSIMATIC PDM
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/
FixedSIMATIC STEP 7 V5.X
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/
FixedSINAMICS STARTER (containing STEP 7 OEM version)
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/
WorkaroundSIMATIC PCS 7 V8.2 and earlier
Only use project files from trusted sources
WorkaroundSIMATIC PCS 7 V9.0
Only use project files from trusted sources
WorkaroundSIMATIC PDM
Only use project files from trusted sources
WorkaroundSIMATIC STEP 7 V5.X
Only use project files from trusted sources
WorkaroundSINAMICS STARTER (containing STEP 7 OEM version)
Only use project files from trusted sources

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan