SSA-800126

csafDEsiemens_psirt

SSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20

view advisory published 2024-12-10

Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter "Additional Information" below for more details.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2024-49849US——
A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V…
02

references

External citations — patches, advisories, analysis.

03

remediations (78)

  • MitigationSIMATIC S7-PLCSIM V16

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC S7-PLCSIM V17

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC STEP 7 Safety V16

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC STEP 7 Safety V17

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC STEP 7 Safety V18

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC STEP 7 Safety V19

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC STEP 7 V16

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC STEP 7 V17

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC STEP 7 V18

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC STEP 7 V19

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC WinCC Unified V16

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC WinCC Unified V17

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC WinCC Unified V18

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC WinCC Unified V19

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC WinCC V16

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC WinCC V17

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC WinCC V18

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMATIC WinCC V19

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMOCODE ES V16

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMOCODE ES V17

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMOCODE ES V18

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMOCODE ES V19

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMOTION SCOUT TIA V5.4

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMOTION SCOUT TIA V5.5

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIMOTION SCOUT TIA V5.6

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSINAMICS Startdrive V16

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSINAMICS Startdrive V17

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSINAMICS Startdrive V18

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSINAMICS Startdrive V19

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIRIUS Safety ES V17 (TIA Portal)

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIRIUS Safety ES V18 (TIA Portal)

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIRIUS Safety ES V19 (TIA Portal)

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIRIUS Soft Starter ES V17 (TIA Portal)

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIRIUS Soft Starter ES V18 (TIA Portal)

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationSIRIUS Soft Starter ES V19 (TIA Portal)

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationTIA Portal Cloud V16

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationTIA Portal Cloud V17

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationTIA Portal Cloud V18

    Avoid opening untrusted files from unknown sources in affected products

  • MitigationTIA Portal Cloud V19

    Avoid opening untrusted files from unknown sources in affected products

  • No fix plannedSIMATIC S7-PLCSIM V16

    Currently no fix is planned

  • No fix plannedSIMATIC S7-PLCSIM V17

    Currently no fix is planned

  • No fix plannedSIMATIC STEP 7 Safety V16

    Currently no fix is planned

  • No fix plannedSIMATIC STEP 7 V16

    Currently no fix is planned

  • No fix plannedSIMATIC WinCC Unified V16

    Currently no fix is planned

  • No fix plannedSIMATIC WinCC V16

    Currently no fix is planned

  • No fix plannedSIMOCODE ES V16

    Currently no fix is planned

  • No fix plannedSINAMICS Startdrive V16

    Currently no fix is planned

  • No fix plannedTIA Portal Cloud V16

    Currently no fix is planned

  • No fix availableSIMOCODE ES V17

    Currently no fix is available

  • No fix availableSIMOCODE ES V18

    Currently no fix is available

  • No fix availableSIMOCODE ES V19

    Currently no fix is available

  • No fix availableSIMOTION SCOUT TIA V5.4

    Currently no fix is available

  • No fix availableSIMOTION SCOUT TIA V5.5

    Currently no fix is available

  • No fix availableSINAMICS Startdrive V17

    Currently no fix is available

  • No fix availableSINAMICS Startdrive V18

    Currently no fix is available

  • No fix availableSINAMICS Startdrive V19

    Currently no fix is available

  • No fix availableSIRIUS Safety ES V17 (TIA Portal)

    Currently no fix is available

  • No fix availableSIRIUS Safety ES V19 (TIA Portal)

    Currently no fix is available

  • No fix availableSIRIUS Soft Starter ES V17 (TIA Portal)

    Currently no fix is available

  • No fix availableSIRIUS Soft Starter ES V18 (TIA Portal)

    Currently no fix is available

  • No fix availableSIRIUS Soft Starter ES V19 (TIA Portal)

    Currently no fix is available

  • No fix availableTIA Portal Cloud V17

    Currently no fix is available

  • FixedSIMATIC STEP 7 Safety V17

    Update to V17 Update 9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784441/
  • FixedSIMATIC STEP 7 Safety V18

    Update to V18 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109817218/
  • FixedSIMATIC STEP 7 Safety V19

    Update to V19 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109925643/
  • FixedSIMATIC STEP 7 V17

    Update to V17 Update 9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784441/
  • FixedSIMATIC STEP 7 V18

    Update to V18 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109817218/
  • FixedSIMATIC STEP 7 V19

    Update to V19 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109925643/
  • FixedSIMATIC WinCC Unified V17

    Update to V17 Update 9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784441/
  • FixedSIMATIC WinCC Unified V18

    Update to V18 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109817218/
  • FixedSIMATIC WinCC Unified V19

    Update to V19 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109925643/
  • FixedSIMATIC WinCC V17

    Update to V17 Update 9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784441/
  • FixedSIMATIC WinCC V18

    Update to V18 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109817218/
  • FixedSIMATIC WinCC V19

    Update to V19 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109925643/
  • FixedSIMOTION SCOUT TIA V5.6

    Update to V5.6 SP1 HF7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989067/
  • FixedSIRIUS Safety ES V18 (TIA Portal)

    Update to V18 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109817575/
  • FixedTIA Portal Cloud V18

    Update to V6.3.0.2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794456/
  • FixedTIA Portal Cloud V19

    TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan