Siemens Engineering Platforms
Affected products do not properly restrict access permissions to a local Windows Named Pipe and do not properly sanitize user-controllable input sent to that Named Pipe. This could allow a local authenticated attacker to cause a type confusion and execute arbitrary code within the affected application and its privileges. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-54678US | — | — | ||
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), SIMATIC S7… | ||||
references
External citations — patches, advisories, analysis.
- SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms - CSAF Versionself
- SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms - HTML Versionself
- ICS Advisory ICSA-25-226-03 JSONself
- ICS Advisory ICSA-25-226-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (74)
- MitigationSIMATIC PCS neo V4.1
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC PCS neo V5.0
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC PCS neo V6.0
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC S7-PLCSIM V17
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC STEP 7 V17
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC STEP 7 V18
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC STEP 7 V19
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC STEP 7 V20
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC WinCC V17
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC WinCC V18
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC WinCC V19
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMATIC WinCC V20
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMOCODE ES V17
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMOCODE ES V18
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMOCODE ES V19
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMOCODE ES V20
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMOTION SCOUT TIA V5.4
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMOTION SCOUT TIA V5.5
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMOTION SCOUT TIA V5.6
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIMOTION SCOUT TIA V5.7
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSINAMICS Startdrive V17
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSINAMICS Startdrive V18
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSINAMICS Startdrive V19
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSINAMICS Startdrive V20
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIRIUS Safety ES V17 (TIA Portal)
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIRIUS Safety ES V18 (TIA Portal)
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIRIUS Safety ES V19 (TIA Portal)
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIRIUS Safety ES V20 (TIA Portal)
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIRIUS Soft Starter ES V17 (TIA Portal)
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIRIUS Soft Starter ES V18 (TIA Portal)
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIRIUS Soft Starter ES V19 (TIA Portal)
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationSIRIUS Soft Starter ES V20 (TIA Portal)
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationTIA Portal Cloud V17
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationTIA Portal Cloud V18
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationTIA Portal Cloud V19
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationTIA Portal Cloud V20
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- MitigationTIA Portal Test Suite V20
On Desktop systems: Execute affected software on Windows hosts where only a single user is configured
- No fix plannedSIMATIC PCS neo V4.1
Currently no fix is planned
- No fix plannedSIMATIC PCS neo V5.0
Currently no fix is planned
- No fix plannedSIMATIC S7-PLCSIM V17
Currently no fix is planned
- No fix availableSIMATIC STEP 7 V18
Currently no fix is available
- No fix availableSIMATIC WinCC V18
Currently no fix is available
- No fix availableSIMOCODE ES V17
Currently no fix is available
- No fix availableSIMOCODE ES V19
Currently no fix is available
- No fix availableSIMOCODE ES V20
Currently no fix is available
- No fix availableSIMOTION SCOUT TIA V5.7
Currently no fix is available
- No fix availableSINAMICS Startdrive V19
Currently no fix is available
- No fix availableSINAMICS Startdrive V20
Currently no fix is available
- No fix availableSIRIUS Safety ES V17 (TIA Portal)
Currently no fix is available
- No fix availableSIRIUS Safety ES V19 (TIA Portal)
Currently no fix is available
- No fix availableSIRIUS Safety ES V20 (TIA Portal)
Currently no fix is available
- No fix availableSIRIUS Soft Starter ES V17 (TIA Portal)
Currently no fix is available
- No fix availableSIRIUS Soft Starter ES V19 (TIA Portal)
Currently no fix is available
- No fix availableSIRIUS Soft Starter ES V20 (TIA Portal)
Currently no fix is available
- No fix availableTIA Portal Cloud V17
Currently no fix is available
- No fix availableTIA Portal Cloud V18
Currently no fix is available
- FixedSIMATIC PCS neo V6.0
Update to V6.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000357/ - FixedSIMATIC STEP 7 V17
Update to V17 Update 9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/ - FixedSIMATIC STEP 7 V19
Update to V19 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109925643/ - FixedSIMATIC STEP 7 V20
Update to V20 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109963851/ - FixedSIMATIC WinCC V17
Update to V17 Update 9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/ - FixedSIMATIC WinCC V19
Update to V19 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109925643/ - FixedSIMATIC WinCC V20
Update to V20 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109963851/ - FixedSIMOCODE ES V18
https://support.industry.siemens.com/cs/ww/en/view/109817218/
- FixedSIMOTION SCOUT TIA V5.4
https://support.industry.siemens.com/cs/ww/en/view/109784441/
- FixedSIMOTION SCOUT TIA V5.5
https://support.industry.siemens.com/cs/ww/en/view/109817218/
- FixedSIMOTION SCOUT TIA V5.6
Update to V5.6 SP1 HF7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109989067/ - FixedSINAMICS Startdrive V17
https://support.industry.siemens.com/cs/ww/en/view/109784441/
- FixedSINAMICS Startdrive V18
https://support.industry.siemens.com/cs/ww/en/view/109817218/
- FixedSIRIUS Safety ES V18 (TIA Portal)
https://support.industry.siemens.com/cs/ww/en/view/109817218/
- FixedSIRIUS Soft Starter ES V18 (TIA Portal)
https://support.industry.siemens.com/cs/ww/en/view/109817218/
- FixedTIA Portal Cloud V19
Fixed with V5.2.1.1, no user action required
- FixedTIA Portal Cloud V20
Fixed with V5.2.2.2, no user action required
- FixedTIA Portal Test Suite V20
Update to V20 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109963851/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan