SSA-428051: Privilege Escalation Vulnerability in TIA Administrator
The latest update for TIA Administrator, installed together with TIA Portal and PCS neo, fixes a privilege escalation vulnerability that could allow local users to escalate privileges and execute code as local SYSTEM user. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-25238US | high7.8 | — | ||
A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in specific folders could… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- MitigationPCS neo (Administration Console)
For PCS neo apply measures described in “Industrial Security in SIMATIC PCS neo”: https://support.industry.siemens.com/cs/ww/en/view/109771524
- MitigationTIA Portal
For PCS neo apply measures described in “Industrial Security in SIMATIC PCS neo”: https://support.industry.siemens.com/cs/ww/en/view/109771524
- FixedPCS neo (Administration Console)
Update to V3.1 or later version
- FixedTIA Portal
Update TIA Administrator to V1.0 SP2 Upd2 or later version
https://support.industry.siemens.com/cs/ww/en/view/114358/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan