CVE-2020-7580
highPriorität · verfolgen · 27EPSS 0.005 · 40. PerzentilDEEURUUSEPSS · bewertet 2026-10-26
A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Upd3), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC ProSave (All versions < V17), SIMATIC S7-1500 Software Controller (All versions < V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMATIC STEP 7 V5 (All versions < V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions < V3.16 P018), SIMATIC WinCC OA V3.17 (All versions < V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions < V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 3), SINAMICS STARTER (All Versions < V5.4 HF2), SINAMICS Startdrive (All Versions < V16 Update 3), SINEC NMS (All versions < V1.0 SP2), SINEMA Server (All versions < V14 SP3), SINUMERIK ONE virtual (All Versions < V6.14), SINUMERIK Operate (All Versions < V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSIMATIC Automation Toolsiemens_psirt
Update to V4 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/98161300/ - BehobenSIMATIC NET PC Software V14siemens_psirt
Update to V14 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807351/ - BehobenSIMATIC NET PC Software V16siemens_psirt
Update to V16 Upd3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780209/ - BehobenSIMATIC PCS neosiemens_psirt
Update to V3.0 SP1 or later version To obtain SIMATIC PCS neo V3.0 SP1 contact your local support.
- BehobenSIMATIC ProSavesiemens_psirt
Update to V17 or later version <https://support.industry.siemens.com/cs/ww/en/view/10347815/> Note: Some versions of SIMATIC ProSave are not available as separate download (e.g. V17). In this case, use the version of SIMATIC ProSave as bundled with the corresponding version of SIMATIC WinCC (TIA Portal).
- BehobenSIMATIC S7-1500 Software Controllersiemens_psirt
Update to V21.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478528/ - BehobenSIMATIC STEP 7 (TIA Portal) V13siemens_psirt
Update to V13 SP2 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759753/ - BehobenSIMATIC STEP 7 (TIA Portal) V14siemens_psirt
Update to V14 SP1 Update 10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109747387 - BehobenSIMATIC STEP 7 (TIA Portal) V15siemens_psirt
Update to V15.1 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763890/ - BehobenSIMATIC STEP 7 (TIA Portal) V16siemens_psirt
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109775861/ - BehobenSIMATIC STEP 7 V5siemens_psirt
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109779992/ - BehobenSIMATIC WinCC OA V3.16siemens_psirt
Update to V3.16 P018 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA V3.17siemens_psirt
Update to V3.17 P003 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC Runtime Advancedsiemens_psirt
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776018/ - BehobenSIMATIC WinCC Runtime Professional V13siemens_psirt
Update to V13 SP2 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759782/ - BehobenSIMATIC WinCC Runtime Professional V14siemens_psirt
Update to V14 SP1 Update 10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109747394/ - BehobenSIMATIC WinCC Runtime Professional V15siemens_psirt
Update to V15.1 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763892/ - BehobenSIMATIC WinCC Runtime Professional V16siemens_psirt
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/ - BehobenSIMATIC WinCC V7.4siemens_psirt
Update to V7.4 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109779373/ - BehobenSIMATIC WinCC V7.5siemens_psirt
Update to V7.5 SP1 Update 3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109773812/ - BehobenSINAMICS STARTERsiemens_psirt
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109782792/ - BehobenSINAMICS Startdrivesiemens_psirt
Update to V16 Update 3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109781202/ - BehobenSINEC NMSsiemens_psirt
Update to version V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109797645/ - BehobenSINEMA Serversiemens_psirt
Update to V14 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109801374/ - BehobenSINUMERIK ONE virtualsiemens_psirt
Update to V6.14 or later version The update can be obtained from Siemens representative or via Siemens customer service
- BehobenSINUMERIK Operatesiemens_psirt
Update to V6.14 or later version The update can be obtained from Siemens representative or via Siemens customer service
- BehobenSIMATIC Automation Toolcisa_csaf_ot
Update to V4 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/98161300/ - BehobenSIMATIC NET PC Software V14cisa_csaf_ot
Update to V14 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807351/ - BehobenSIMATIC NET PC Software V16cisa_csaf_ot
Update to V16 Upd3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780209/ - BehobenSIMATIC PCS neocisa_csaf_ot
Update to V3.0 SP1 or later version To obtain SIMATIC PCS neo V3.0 SP1 contact your local support.
- BehobenSIMATIC ProSavecisa_csaf_ot
Update to V17 or later version <https://support.industry.siemens.com/cs/ww/en/view/10347815/> Note: Some versions of SIMATIC ProSave are not available as separate download (e.g. V17). In this case, use the version of SIMATIC ProSave as bundled with the corresponding version of SIMATIC WinCC (TIA Portal).
- BehobenSIMATIC S7-1500 Software Controllercisa_csaf_ot
Update to V21.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478528/ - BehobenSIMATIC STEP 7 (TIA Portal) V13cisa_csaf_ot
Update to V13 SP2 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759753/ - BehobenSIMATIC STEP 7 (TIA Portal) V14cisa_csaf_ot
Update to V14 SP1 Update 10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109747387 - BehobenSIMATIC STEP 7 (TIA Portal) V15cisa_csaf_ot
Update to V15.1 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763890/ - BehobenSIMATIC STEP 7 (TIA Portal) V16cisa_csaf_ot
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109775861/ - BehobenSIMATIC STEP 7 V5cisa_csaf_ot
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109779992/ - BehobenSIMATIC WinCC OA V3.16cisa_csaf_ot
Update to V3.16 P018 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA V3.17cisa_csaf_ot
Update to V3.17 P003 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC Runtime Advancedcisa_csaf_ot
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776018/ - BehobenSIMATIC WinCC Runtime Professional V13cisa_csaf_ot
Update to V13 SP2 Update 4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759782/ - BehobenSIMATIC WinCC Runtime Professional V14cisa_csaf_ot
Update to V14 SP1 Update 10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109747394/ - BehobenSIMATIC WinCC Runtime Professional V15cisa_csaf_ot
Update to V15.1 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763892/ - BehobenSIMATIC WinCC Runtime Professional V16cisa_csaf_ot
Update to V16 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/ - BehobenSIMATIC WinCC V7.4cisa_csaf_ot
Update to V7.4 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109779373/ - BehobenSIMATIC WinCC V7.5cisa_csaf_ot
Update to V7.5 SP1 Update 3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109773812/ - BehobenSINAMICS STARTERcisa_csaf_ot
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109782792/ - BehobenSINAMICS Startdrivecisa_csaf_ot
Update to V16 Update 3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109781202/ - BehobenSINEC NMScisa_csaf_ot
Update to version V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109797645/ - BehobenSINEMA Servercisa_csaf_ot
Update to V14 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109801374/ - BehobenSINUMERIK ONE virtualcisa_csaf_ot
Update to V6.14 or later version The update can be obtained from Siemens representative or via Siemens customer service
- BehobenSINUMERIK Operatecisa_csaf_ot
Update to V6.14 or later version The update can be obtained from Siemens representative or via Siemens customer service
- MitigationSIMATIC Automation Toolsiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V14siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V15siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V16siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC PCS neosiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC ProSavesiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC S7-1500 Software Controllersiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V13siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V14siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V15siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V16siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 V5siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC OA V3.16siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC OA V3.17siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Advancedsiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V13siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V14siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V15siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V16siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC V7.4siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC V7.5siemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINAMICS STARTERsiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINAMICS Startdrivesiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINEC NMSsiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINEMA Serversiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINUMERIK ONE virtualsiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINUMERIK Operatesiemens_psirt
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC Automation Toolcisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V14cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V15cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC NET PC Software V16cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC PCS neocisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC ProSavecisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC S7-1500 Software Controllercisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V13cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V14cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V15cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 (TIA Portal) V16cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC STEP 7 V5cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC OA V3.16cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC OA V3.17cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Advancedcisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V13cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V14cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V15cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC Runtime Professional V16cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC V7.4cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSIMATIC WinCC V7.5cisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINAMICS STARTERcisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINAMICS Startdrivecisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINEC NMScisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINEMA Servercisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINUMERIK ONE virtualcisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- MitigationSINUMERIK Operatecisa_csaf_ot
Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered as a temporary workaround.
- Kein Fix geplantSIMATIC NET PC Software V15siemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V15cisa_csaf_ot
Currently no fix is planned
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.1–8.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (154)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-312271SSA-312271: Unquoted Search Path Vulnerability in Windows-based Industrial Software Applications2020-06-09csaf · siemens_psirtDE
Several industrial products as listed below contain a local privilege escalation vulnerability that could allow a local attacker to execute arbitrary code with SYTEM privileges. Siemens has released updates for the affected products and recommends to update to the latest versions.
- ICSA-20-161-04Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update J)2020-06-09icsa · cisa_csaf_otUS
Several industrial products as listed below contain a local privilege escalation vulnerability that could allow a local attacker to execute arbitrary code with SYTEM privileges. Siemens has released updates for the affected products and recommends to update to the latest versions.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-312271.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-7580cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-161-04cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-code-execution-via-Windows-exe-Extension-32489cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.2015/cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-161-04cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-312271.pdfenisa_euvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-161-04enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan