Siemens SIMATIC, SINAMICS (Update C)
Multiple SIMATIC Software products are affected by two vulnerabilities that could allow an attacker to manipulate project files that may lead to Remote Code Execution or Denial-of-Service attacks. Siemens has released updates to some of the affected products and recommends that customers update to the latest version. Siemens is preparing further updates and recommends specific workarounds and mitigations until patches are available.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-7586US | high7.8 | — | ||
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP… | ||||
| CVE-2020-7585US | high7.8 | — | ||
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP… | ||||
references
External citations — patches, advisories, analysis.
- SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products - CSAF Versionself
- SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products - PDF Versionself
- SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products - TXT Versionself
- ICS Advisory ICSA-20-161-05 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-20-161-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (20)
- MitigationSIMATIC PCS 7 V8.2 and earlier
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V8.2 and earlier
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V9.0
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V9.0
Only use project files from trusted sources.
- MitigationSIMATIC PDM
Only use project files from trusted sources.
- MitigationSIMATIC PDM
Only use project files from trusted sources.
- MitigationSIMATIC STEP 7 V5.X
Only use project files from trusted sources.
- MitigationSIMATIC STEP 7 V5.X
Only use project files from trusted sources.
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)
Only use project files from trusted sources.
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)
Only use project files from trusted sources.
- FixedSIMATIC PCS 7 V8.2 and earlier
See recommendations from section Workarounds and Mitigations or upgrade to a newer SIMATIC PCS 7 version
- FixedSIMATIC PCS 7 V8.2 and earlier
See recommendations from section Workarounds and Mitigations or upgrade to a newer SIMATIC PCS 7 version
- FixedSIMATIC PCS 7 V9.0
Update to V9.0 SP3 or later version
- FixedSIMATIC PCS 7 V9.0
Update to V9.0 SP3 or later version
- FixedSIMATIC PDM
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/ - FixedSIMATIC PDM
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/ - FixedSIMATIC STEP 7 V5.X
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/ - FixedSIMATIC STEP 7 V5.X
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/ - FixedSINAMICS STARTER (containing STEP 7 OEM version)
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/ - FixedSINAMICS STARTER (containing STEP 7 OEM version)
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan