SSA-841348

csafDEsiemens_psirt

SSA-841348: Multiple Vulnerabilities in the UMC Component

view advisory published 2020-07-14

The products listed below contain two security vulnerabilities in the UMC component that could allow an attacker to cause a partial denial- of-service of the UMC component, or to locally escalate privileges from a user with administrative privileges to execute code with SYSTEM level privileges. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

01

describes (3)

Related CVEs.

IDseverity exploitable
CVE-2020-7588USmedium5.3—
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versi…
CVE-2020-7587UShigh8.2—
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versi…
CVE-2020-7581USmedium6.7—
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versi…
02

references

External citations — patches, advisories, analysis.

03

remediations (92)

  • MitigationOpcenter Execution Discrete

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationOpcenter Execution Discrete

    Have the software running on systems within trusted networks

  • MitigationOpcenter Execution Discrete

    Have the software running on systems within trusted networks

  • MitigationOpcenter Execution Foundation

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationOpcenter Execution Foundation

    Have the software running on systems within trusted networks

  • MitigationOpcenter Execution Foundation

    Have the software running on systems within trusted networks

  • MitigationOpcenter Execution Process

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationOpcenter Execution Process

    Have the software running on systems within trusted networks

  • MitigationOpcenter Execution Process

    Have the software running on systems within trusted networks

  • MitigationOpcenter Intelligence

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationOpcenter Intelligence

    Have the software running on systems within trusted networks

  • MitigationOpcenter Intelligence

    Have the software running on systems within trusted networks

  • MitigationOpcenter Quality

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationOpcenter Quality

    Have the software running on systems within trusted networks

  • MitigationOpcenter Quality

    Have the software running on systems within trusted networks

  • MitigationOpcenter RD&L

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationOpcenter RD&L

    Have the software running on systems within trusted networks

  • MitigationOpcenter RD&L

    Have the software running on systems within trusted networks

  • MitigationSIMATIC IT LMS

    Have the software running on systems within trusted networks

  • MitigationSIMATIC IT LMS

    Have the software running on systems within trusted networks

  • MitigationSIMATIC IT Production Suite

    Have the software running on systems within trusted networks

  • MitigationSIMATIC IT Production Suite

    Have the software running on systems within trusted networks

  • MitigationSIMATIC Notifier Server for Windows

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationSIMATIC Notifier Server for Windows

    Have the software running on systems within trusted networks

  • MitigationSIMATIC Notifier Server for Windows

    Have the software running on systems within trusted networks

  • MitigationSIMATIC PCS neo

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationSIMATIC PCS neo

    Have the software running on systems within trusted networks

  • MitigationSIMATIC PCS neo

    Have the software running on systems within trusted networks

  • MitigationSIMATIC STEP 7 (TIA Portal) V15

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationSIMATIC STEP 7 (TIA Portal) V15

    Have the software running on systems within trusted networks

  • MitigationSIMATIC STEP 7 (TIA Portal) V15

    Have the software running on systems within trusted networks

  • MitigationSIMATIC STEP 7 (TIA Portal) V16

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationSIMATIC STEP 7 (TIA Portal) V16

    Have the software running on systems within trusted networks

  • MitigationSIMATIC STEP 7 (TIA Portal) V16

    Have the software running on systems within trusted networks

  • MitigationSIMOCODE ES V15.1

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationSIMOCODE ES V15.1

    Have the software running on systems within trusted networks

  • MitigationSIMOCODE ES V15.1

    Have the software running on systems within trusted networks

  • MitigationSIMOCODE ES V16

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationSIMOCODE ES V16

    Have the software running on systems within trusted networks

  • MitigationSIMOCODE ES V16

    Have the software running on systems within trusted networks

  • MitigationSoft Starter ES V15.1

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationSoft Starter ES V15.1

    Have the software running on systems within trusted networks

  • MitigationSoft Starter ES V15.1

    Have the software running on systems within trusted networks

  • MitigationSoft Starter ES V16

    CVE-2020-7581: Make sure that there is no executable at the following locations: C:\Program.exe, C:\Program Files\Common.exe, or C:\Program Files\Common Files\Siemens\Automation\Simatic.exe

  • MitigationSoft Starter ES V16

    Have the software running on systems within trusted networks

  • MitigationSoft Starter ES V16

    Have the software running on systems within trusted networks

  • No fix plannedSIMATIC Notifier Server for Windows

    Currently no fix is planned

  • No fix plannedSIMATIC Notifier Server for Windows

    Currently no fix is planned

  • No fix plannedSIMATIC Notifier Server for Windows

    Currently no fix is planned

  • FixedOpcenter Execution Discrete

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Execution Discrete

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Execution Discrete

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Execution Foundation

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Execution Foundation

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Execution Foundation

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Execution Process

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Execution Process

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Execution Process

    Update to V3.2 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Intelligence

    Update to V3.3 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Intelligence

    Update to V3.3 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Intelligence

    Update to V3.3 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Quality

    Update to V11.3 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Quality

    Update to V11.3 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter Quality

    Update to V11.3 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter RD&L

    Update to V8.1 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter RD&L

    Update to V8.1 or later version

    https://support.sw.siemens.com/
  • FixedOpcenter RD&L

    Update to V8.1 or later version

    https://support.sw.siemens.com/
  • FixedSIMATIC IT LMS

    Update to V2.6 or later version

    https://support.sw.siemens.com/
  • FixedSIMATIC IT LMS

    Update to V2.6 or later version

    https://support.sw.siemens.com/
  • FixedSIMATIC IT Production Suite

    Update to V8.0 or later version

    https://support.sw.siemens.com/
  • FixedSIMATIC IT Production Suite

    Update to V8.0 or later version

    https://support.sw.siemens.com/
  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 or later version

  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 or later version

  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 or later version

  • FixedSIMATIC STEP 7 (TIA Portal) V15

    Update to V15.1 Update 5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109763890/
  • FixedSIMATIC STEP 7 (TIA Portal) V15

    Update to V15.1 Update 5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109763890/
  • FixedSIMATIC STEP 7 (TIA Portal) V15

    Update to V15.1 Update 5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109763890/
  • FixedSIMATIC STEP 7 (TIA Portal) V16

    Update to V16 Update 2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109775861/
  • FixedSIMATIC STEP 7 (TIA Portal) V16

    Update to V16 Update 2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109775861/
  • FixedSIMATIC STEP 7 (TIA Portal) V16

    Update to V16 Update 2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109775861/
  • FixedSIMOCODE ES V15.1

    Update to V15 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109768994/
  • FixedSIMOCODE ES V15.1

    Update to V15 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109768994/
  • FixedSIMOCODE ES V15.1

    Update to V15 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109768994/
  • FixedSIMOCODE ES V16

    Update to V16 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109781888/
  • FixedSIMOCODE ES V16

    Update to V16 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109781888/
  • FixedSIMOCODE ES V16

    Update to V16 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109781888/
  • FixedSoft Starter ES V15.1

    Update to V15 Update 3 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109769017/
  • FixedSoft Starter ES V15.1

    Update to V15 Update 3 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109769017/
  • FixedSoft Starter ES V15.1

    Update to V15 Update 3 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109769017/
  • FixedSoft Starter ES V16

    Update to V16 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109771657/
  • FixedSoft Starter ES V16

    Update to V16 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109771657/
  • FixedSoft Starter ES V16

    Update to V16 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109771657/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan