SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released a new version for SIMATIC STEP 7 Safety V18 and recommends to update to the latest version.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-32737US | — | — | ||
A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deseria… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - CSAF Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - HTML Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - PDF Versionself
- SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19 - TXT Versionself
Behebungen (2)
- MitigationSIMATIC STEP 7 Safety V18
Avoid uploading PLC software from untrusted devices or MMC cards
- BehobenSIMATIC STEP 7 Safety V18
Update to V18 Update 2 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan