SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products
Multiple SIMATIC Software products are affected by two vulnerabilities that could allow an attacker to manipulate project files that may lead to Remote Code Execution or Denial-of-Service attacks. Siemens has released updates to some of the affected products and recommends that customers update to the latest version. Siemens is preparing further updates and recommends specific workarounds and mitigations until patches are available.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-7586US | high7.8 | — | ||
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP… | ||||
| CVE-2020-7585US | high7.8 | — | ||
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products - CSAF Versionself
- SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products - PDF Versionself
- SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products - TXT Versionself
Behebungen (20)
- MitigationSIMATIC PCS 7 V8.2 and earlier
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V8.2 and earlier
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V9.0
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V9.0
Only use project files from trusted sources.
- MitigationSIMATIC PDM
Only use project files from trusted sources.
- MitigationSIMATIC PDM
Only use project files from trusted sources.
- MitigationSIMATIC STEP 7 V5.X
Only use project files from trusted sources.
- MitigationSIMATIC STEP 7 V5.X
Only use project files from trusted sources.
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)
Only use project files from trusted sources.
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)
Only use project files from trusted sources.
- BehobenSIMATIC PCS 7 V8.2 and earlier
See recommendations from section Workarounds and Mitigations or upgrade to a newer SIMATIC PCS 7 version
- BehobenSIMATIC PCS 7 V8.2 and earlier
See recommendations from section Workarounds and Mitigations or upgrade to a newer SIMATIC PCS 7 version
- BehobenSIMATIC PCS 7 V9.0
Update to V9.0 SP3 or later version
- BehobenSIMATIC PCS 7 V9.0
Update to V9.0 SP3 or later version
- BehobenSIMATIC PDM
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/ - BehobenSIMATIC PDM
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/ - BehobenSIMATIC STEP 7 V5.X
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/ - BehobenSIMATIC STEP 7 V5.X
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/ - BehobenSINAMICS STARTER (containing STEP 7 OEM version)
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/ - BehobenSINAMICS STARTER (containing STEP 7 OEM version)
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan