SSA-312271: Unquoted Search Path Vulnerability in Windows-based Industrial Software Applications
Several industrial products as listed below contain a local privilege escalation vulnerability that could allow a local attacker to execute arbitrary code with SYTEM privileges. Siemens has released updates for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-7580US | medium6.7 | — | ||
A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-312271: Unquoted Search Path Vulnerability in Windows-based Industrial Software Applications - CSAF Versionself
- SSA-312271: Unquoted Search Path Vulnerability in Windows-based Industrial Software Applications - PDF Versionself
- SSA-312271: Unquoted Search Path Vulnerability in Windows-based Industrial Software Applications - TXT Versionself
Behebungen (54)
- MitigationSIMATIC Automation Tool
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V14
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V15
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V16
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC PCS neo
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC ProSave
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC S7-1500 Software Controller
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V13
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V14
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V15
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V16
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 V5
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC OA V3.16
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC OA V3.17
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Advanced
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V13
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V14
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V15
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V16
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC V7.4
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC V7.5
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINAMICS STARTER
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINAMICS Startdrive
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINEC NMS
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINEMA Server
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINUMERIK ONE virtual
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINUMERIK Operate
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- Kein Fix geplantSIMATIC NET PC Software V15
Currently no fix is planned
- BehobenSIMATIC Automation Tool
Update to V4 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/98161300/ - BehobenSIMATIC NET PC Software V14
Update to V14 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807351/ - BehobenSIMATIC NET PC Software V16
Update to V16 Upd3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780209/ - BehobenSIMATIC PCS neo
Update to V3.0 SP1 or later version To obtain SIMATIC PCS neo V3.0 SP1 contact your local support.
- BehobenSIMATIC ProSave
Update to V17 or later version <https://support.industry.siemens.com/cs/ww/en/view/10347815/> Note: Some versions of SIMATIC ProSave are not available as separate download (e.g. V17). In this case, use the version of SIMATIC ProSave as bundled with the corresponding version of SIMATIC WinCC (TIA Portal).
- BehobenSIMATIC S7-1500 Software Controller
Update to V21.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478528/ - BehobenSIMATIC STEP 7 (TIA Portal) V13
Update to V13 SP2 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759753/ - BehobenSIMATIC STEP 7 (TIA Portal) V14
Update to V14 SP1 Update 10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109747387 - BehobenSIMATIC STEP 7 (TIA Portal) V15
Update to V15.1 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763890/ - BehobenSIMATIC STEP 7 (TIA Portal) V16
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109775861/ - BehobenSIMATIC STEP 7 V5
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109779992/ - BehobenSIMATIC WinCC OA V3.16
Update to V3.16 P018 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA V3.17
Update to V3.17 P003 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC Runtime Advanced
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776018/ - BehobenSIMATIC WinCC Runtime Professional V13
Update to V13 SP2 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759782/ - BehobenSIMATIC WinCC Runtime Professional V14
Update to V14 SP1 Update 10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109747394/ - BehobenSIMATIC WinCC Runtime Professional V15
Update to V15.1 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763892/ - BehobenSIMATIC WinCC Runtime Professional V16
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/ - BehobenSIMATIC WinCC V7.4
Update to V7.4 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109779373/ - BehobenSIMATIC WinCC V7.5
Update to V7.5 SP1 Update 3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109773812/ - BehobenSINAMICS STARTER
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109782792/ - BehobenSINAMICS Startdrive
Update to V16 Update 3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109781202/ - BehobenSINEC NMS
Update to version V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109797645/ - BehobenSINEMA Server
Update to V14 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109801374/ - BehobenSINUMERIK ONE virtual
Update to V6.14 or later version The update can be obtained from Siemens representative or via Siemens customer service
- BehobenSINUMERIK Operate
Update to V6.14 or later version The update can be obtained from Siemens representative or via Siemens customer service
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan