SSA-693808

csafDEsiemens_psirt

SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms

Advisory ansehen veröffentlicht 2025-08-12

Affected products do not properly restrict access permissions to a local Windows Named Pipe and do not properly sanitize user-controllable input sent to that Named Pipe. This could allow a local authenticated attacker to cause a type confusion and execute arbitrary code within the affected application and its privileges. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2024-54678US——
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), SIMATIC S7…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (74)

  • MitigationSIMATIC PCS neo V4.1

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC PCS neo V5.0

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC PCS neo V6.0

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC S7-PLCSIM V17

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC STEP 7 V17

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC STEP 7 V18

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC STEP 7 V19

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC STEP 7 V20

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC WinCC V17

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC WinCC V18

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC WinCC V19

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMATIC WinCC V20

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMOCODE ES V17

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMOCODE ES V18

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMOCODE ES V19

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMOCODE ES V20

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMOTION SCOUT TIA V5.4

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMOTION SCOUT TIA V5.5

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMOTION SCOUT TIA V5.6

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIMOTION SCOUT TIA V5.7

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSINAMICS Startdrive V17

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSINAMICS Startdrive V18

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSINAMICS Startdrive V19

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSINAMICS Startdrive V20

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIRIUS Safety ES V17 (TIA Portal)

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIRIUS Safety ES V18 (TIA Portal)

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIRIUS Safety ES V19 (TIA Portal)

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIRIUS Safety ES V20 (TIA Portal)

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIRIUS Soft Starter ES V17 (TIA Portal)

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIRIUS Soft Starter ES V18 (TIA Portal)

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIRIUS Soft Starter ES V19 (TIA Portal)

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationSIRIUS Soft Starter ES V20 (TIA Portal)

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationTIA Portal Cloud V17

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationTIA Portal Cloud V18

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationTIA Portal Cloud V19

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationTIA Portal Cloud V20

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • MitigationTIA Portal Test Suite V20

    On Desktop systems: Execute affected software on Windows hosts where only a single user is configured

  • Kein Fix geplantSIMATIC PCS neo V4.1

    Currently no fix is planned

  • Kein Fix geplantSIMATIC PCS neo V5.0

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-PLCSIM V17

    Currently no fix is planned

  • Kein Fix verfügbarSIMOCODE ES V17

    Currently no fix is available

  • Kein Fix verfügbarSIMOCODE ES V19

    Currently no fix is available

  • Kein Fix verfügbarSIMOCODE ES V20

    Currently no fix is available

  • Kein Fix verfügbarSIMOTION SCOUT TIA V5.7

    Currently no fix is available

  • Kein Fix verfügbarSINAMICS Startdrive V19

    Currently no fix is available

  • Kein Fix verfügbarSINAMICS Startdrive V20

    Currently no fix is available

  • Kein Fix verfügbarSIRIUS Safety ES V17 (TIA Portal)

    Currently no fix is available

  • Kein Fix verfügbarSIRIUS Safety ES V19 (TIA Portal)

    Currently no fix is available

  • Kein Fix verfügbarSIRIUS Safety ES V20 (TIA Portal)

    Currently no fix is available

  • Kein Fix verfügbarSIRIUS Soft Starter ES V17 (TIA Portal)

    Currently no fix is available

  • Kein Fix verfügbarSIRIUS Soft Starter ES V19 (TIA Portal)

    Currently no fix is available

  • Kein Fix verfügbarSIRIUS Soft Starter ES V20 (TIA Portal)

    Currently no fix is available

  • Kein Fix verfügbarTIA Portal Cloud V17

    Currently no fix is available

  • BehobenSIMATIC PCS neo V6.0

    Update to V6.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/110000357/
  • BehobenSIMATIC STEP 7 V17

    Update to V17 Update 9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784441/
  • BehobenSIMATIC STEP 7 V18

    Update to V18 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109817218/
  • BehobenSIMATIC STEP 7 V19

    Update to V19 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109925643/
  • BehobenSIMATIC STEP 7 V20

    Update to V20 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109963851/
  • BehobenSIMATIC WinCC V17

    Update to V17 Update 9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784441/
  • BehobenSIMATIC WinCC V18

    Update to V18 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109817218/
  • BehobenSIMATIC WinCC V19

    Update to V19 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109925643/
  • BehobenSIMATIC WinCC V20

    Update to V20 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109963851/
  • BehobenSIMOCODE ES V18

    https://support.industry.siemens.com/cs/ww/en/view/109817218/

  • BehobenSIMOTION SCOUT TIA V5.4

    https://support.industry.siemens.com/cs/ww/en/view/109784441/

  • BehobenSIMOTION SCOUT TIA V5.5

    https://support.industry.siemens.com/cs/ww/en/view/109817218/

  • BehobenSIMOTION SCOUT TIA V5.6

    Update to V5.6 SP1 HF7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989067/
  • BehobenSINAMICS Startdrive V17

    https://support.industry.siemens.com/cs/ww/en/view/109784441/

  • BehobenSINAMICS Startdrive V18

    https://support.industry.siemens.com/cs/ww/en/view/109817218/

  • BehobenSIRIUS Safety ES V18 (TIA Portal)

    https://support.industry.siemens.com/cs/ww/en/view/109817218/

  • BehobenSIRIUS Soft Starter ES V18 (TIA Portal)

    https://support.industry.siemens.com/cs/ww/en/view/109817218/

  • BehobenTIA Portal Cloud V18

    Update to V6.3.0.2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794456/
  • BehobenTIA Portal Cloud V19

    Fixed with V5.2.1.1, no user action required

  • BehobenTIA Portal Cloud V20

    Fixed with V5.2.2.2, no user action required

  • BehobenTIA Portal Test Suite V20

    Update to V20 Update 4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109963851/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan