CVE-2020-7585
mediumPriorität · verfolgen · 31EPSS 0.005 · 39. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSIMATIC PCS 7 V8.2 and earliersiemens_psirt
See recommendations from section Workarounds and Mitigations or upgrade to a newer SIMATIC PCS 7 version
- BehobenSIMATIC PCS 7 V9.0siemens_psirt
Update to V9.0 SP3 or later version
- BehobenSIMATIC PDMsiemens_psirt
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/ - BehobenSIMATIC STEP 7 V5.Xsiemens_psirt
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/ - BehobenSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/ - BehobenSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
See recommendations from section Workarounds and Mitigations or upgrade to a newer SIMATIC PCS 7 version
- BehobenSIMATIC PCS 7 V9.0cisa_csaf_ot
Update to V9.0 SP3 or later version
- BehobenSIMATIC PDMcisa_csaf_ot
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/ - BehobenSIMATIC STEP 7 V5.Xcisa_csaf_ot
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/ - BehobenSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/ - MitigationSIMATIC PCS 7 V8.2 and earliersiemens_psirt
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V9.0siemens_psirt
Only use project files from trusted sources.
- MitigationSIMATIC PDMsiemens_psirt
Only use project files from trusted sources.
- MitigationSIMATIC STEP 7 V5.Xsiemens_psirt
Only use project files from trusted sources.
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V9.0cisa_csaf_ot
Only use project files from trusted sources.
- MitigationSIMATIC PDMcisa_csaf_ot
Only use project files from trusted sources.
- MitigationSIMATIC STEP 7 V5.Xcisa_csaf_ot
Only use project files from trusted sources.
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Only use project files from trusted sources.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.6–7.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (30)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-689942SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products2020-06-09csaf · siemens_psirtDE
Multiple SIMATIC Software products are affected by two vulnerabilities that could allow an attacker to manipulate project files that may lead to Remote Code Execution or Denial-of-Service attacks. Siemens has released updates to some of the affected products and recommends that customers update to the latest version. Siemens is preparing further updates and recommends specific workarounds and mitigations until patches are available.
- ICSA-20-161-05Siemens SIMATIC, SINAMICS (Update C)2020-06-09icsa · cisa_csaf_otUS
Multiple SIMATIC Software products are affected by two vulnerabilities that could allow an attacker to manipulate project files that may lead to Remote Code Execution or Denial-of-Service attacks. Siemens has released updates to some of the affected products and recommends that customers update to the latest version. Siemens is preparing further updates and recommends specific workarounds and mitigations until patches are available.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (13)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-689942.pdfcnnvd
- https://cert-portal.siemens.com/productcert/txt/ssa-689942.txtPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-7585cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-161-05cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-two-vulnerabilities-32490cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.2015/cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-161-05cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-689942.pdfenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan