Siemens TIA Administrator (Update A)
The latest update for TIA Administrator, installed together with TIA Portal and PCS neo, fixes a privilege escalation vulnerability that could allow local users to escalate privileges and execute code as local SYSTEM user. Siemens has released updates for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-25238US | high7.8 | — | ||
A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in specific folders could… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-428051: Privilege Escalation Vulnerability in TIA Administrator - CSAF Versionself
- SSA-428051: Privilege Escalation Vulnerability in TIA Administrator - PDF Versionself
- SSA-428051: Privilege Escalation Vulnerability in TIA Administrator - TXT Versionself
- ICS Advisory ICSA-21-040-05 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-040-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (4)
- MitigationPCS neo (Administration Console)
For PCS neo apply measures described in “Industrial Security in SIMATIC PCS neo”: https://support.industry.siemens.com/cs/ww/en/view/109771524
- MitigationTIA Portal
For PCS neo apply measures described in “Industrial Security in SIMATIC PCS neo”: https://support.industry.siemens.com/cs/ww/en/view/109771524
- BehobenPCS neo (Administration Console)
Update to V3.1 or later version
- BehobenTIA Portal
Update TIA Administrator to V1.0 SP2 Upd2 or later version
https://support.industry.siemens.com/cs/ww/en/view/114358/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan