SSA-779936: Catalog-Profile Deserialization Vulnerability in Siemens Engineering Platforms before V19
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-32735US | — | — | ||
A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATIC STEP 7 Safety V18 (… | ||||
references
External citations — patches, advisories, analysis.
- SSA-779936: Catalog-Profile Deserialization Vulnerability in Siemens Engineering Platforms before V19 - CSAF Versionself
- SSA-779936: Catalog-Profile Deserialization Vulnerability in Siemens Engineering Platforms before V19 - HTML Versionself
- SSA-779936: Catalog-Profile Deserialization Vulnerability in Siemens Engineering Platforms before V19 - PDF Versionself
- SSA-779936: Catalog-Profile Deserialization Vulnerability in Siemens Engineering Platforms before V19 - TXT Versionself
remediations (54)
- MitigationSIMATIC STEP 7 Safety V16
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC STEP 7 Safety V17
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC STEP 7 Safety V18
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC STEP 7 V16
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC STEP 7 V17
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC STEP 7 V18
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC WinCC Unified V16
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC WinCC Unified V17
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC WinCC Unified V18
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC WinCC V16
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC WinCC V17
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMATIC WinCC V18
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMOCODE ES V16
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMOCODE ES V17
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMOCODE ES V18
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMOTION SCOUT TIA V5.4 SP1
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMOTION SCOUT TIA V5.4 SP3
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIMOTION SCOUT TIA V5.5 SP1
Avoid opening untrusted files from unknown sources in affected products
- MitigationSINAMICS Startdrive V16
Avoid opening untrusted files from unknown sources in affected products
- MitigationSINAMICS Startdrive V17
Avoid opening untrusted files from unknown sources in affected products
- MitigationSINAMICS Startdrive V18
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIRIUS Safety ES V17
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIRIUS Safety ES V18
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIRIUS Soft Starter ES V17
Avoid opening untrusted files from unknown sources in affected products
- MitigationSIRIUS Soft Starter ES V18
Avoid opening untrusted files from unknown sources in affected products
- MitigationSoft Starter ES V16
Avoid opening untrusted files from unknown sources in affected products
- MitigationTIA Portal Cloud V3.0
Avoid opening untrusted files from unknown sources in affected products
- No fix plannedSIMOTION SCOUT TIA V5.4 SP1
Currently no fix is planned
- No fix plannedSIMOTION SCOUT TIA V5.4 SP3
Currently no fix is planned
- No fix plannedSIMOTION SCOUT TIA V5.5 SP1
Currently no fix is planned
- No fix plannedSINAMICS Startdrive V16
Currently no fix is planned
- No fix plannedSINAMICS Startdrive V17
Currently no fix is planned
- No fix plannedSINAMICS Startdrive V18
Currently no fix is planned
- FixedSIMATIC STEP 7 Safety V16
Update to V16 Update 7 or later version
- FixedSIMATIC STEP 7 Safety V17
Update to V17 Update 7 or later version
- FixedSIMATIC STEP 7 Safety V18
Update to V18 Update 2 or later version
- FixedSIMATIC STEP 7 V16
Update to V16 Update 7 or later version
- FixedSIMATIC STEP 7 V17
Update to V17 Update 7 or later version
- FixedSIMATIC STEP 7 V18
Update to V18 Update 2 or later version
- FixedSIMATIC WinCC Unified V16
Update to V16 Update 7 or later version
- FixedSIMATIC WinCC Unified V17
Update to V17 Update 7 or later version
- FixedSIMATIC WinCC Unified V18
Update to V18 Update 2 or later version
- FixedSIMATIC WinCC V16
Update to V16.7 or later version
- FixedSIMATIC WinCC V17
Update to V17.7 or later version
- FixedSIMATIC WinCC V18
Update to V18 Update 2 or later version
- FixedSIMOCODE ES V16
Update to V16 Update 7 or later version
- FixedSIMOCODE ES V17
Update to V17 Update 7 or later version
- FixedSIMOCODE ES V18
Update to V18 Update 2 or later version
- FixedSIRIUS Safety ES V17
Update to V17 Update 7 or later version
- FixedSIRIUS Safety ES V18
Update to V18 Update 2 or later version
- FixedSIRIUS Soft Starter ES V17
Update to V17 Update 7 or later version
- FixedSIRIUS Soft Starter ES V18
Update to V18 Update 2 or later version
- FixedSoft Starter ES V16
Update to V16 Update 7 or later version
- FixedTIA Portal Cloud V3.0
Update to V18 Update 2 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan