Siemens TIA Portal and SIMATIC STEP 7
Advisory ansehen veröffentlicht 2024-07-09
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released a new version for SIMATIC STEP 7 Safety V18 and recommends to update to the latest version.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-32737US | — | — | ||
A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deseria… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - CSAF Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - HTML Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - PDF Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - TXT Versionself
- ICS Advisory ICSA-24-193-12 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-193-12 - Web Versionself
- Recommended Practicesexternal
03
Behebungen (2)
- MitigationSIMATIC STEP 7 Safety V18
Avoid uploading PLC software from untrusted devices or MMC cards
- BehobenSIMATIC STEP 7 Safety V18
Update to V18 Update 2 or later version
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan