SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19
view advisory published 2024-07-09
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released a new version for SIMATIC STEP 7 Safety V18 and recommends to update to the latest version.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-32737US | — | — | ||
A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deseria… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - CSAF Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - HTML Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - PDF Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - TXT Versionself
03
remediations (2)
- MitigationSIMATIC STEP 7 Safety V18
Avoid uploading PLC software from untrusted devices or MMC cards
- FixedSIMATIC STEP 7 Safety V18
Update to V18 Update 2 or later version
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan