CVE-2020-7586
mediumpriority · track · 31EPSS 0.004 · 36 %ileDEEURUUSEPSS · scored 2026-10-27
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). A buffer overflow vulnerability could allow a local attacker to cause a Denial-of-Service situation. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC PCS 7 V8.2 and earliersiemens_psirt
See recommendations from section Workarounds and Mitigations or upgrade to a newer SIMATIC PCS 7 version
- FixedSIMATIC PCS 7 V9.0siemens_psirt
Update to V9.0 SP3 or later version
- FixedSIMATIC PDMsiemens_psirt
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/ - FixedSIMATIC STEP 7 V5.Xsiemens_psirt
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/ - FixedSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/ - FixedSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
See recommendations from section Workarounds and Mitigations or upgrade to a newer SIMATIC PCS 7 version
- FixedSIMATIC PCS 7 V9.0cisa_csaf_ot
Update to V9.0 SP3 or later version
- FixedSIMATIC PDMcisa_csaf_ot
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/ - FixedSIMATIC STEP 7 V5.Xcisa_csaf_ot
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/ - FixedSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/ - MitigationSIMATIC PCS 7 V8.2 and earliersiemens_psirt
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V9.0siemens_psirt
Only use project files from trusted sources.
- MitigationSIMATIC PDMsiemens_psirt
Only use project files from trusted sources.
- MitigationSIMATIC STEP 7 V5.Xsiemens_psirt
Only use project files from trusted sources.
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
Only use project files from trusted sources.
- MitigationSIMATIC PCS 7 V9.0cisa_csaf_ot
Only use project files from trusted sources.
- MitigationSIMATIC PDMcisa_csaf_ot
Only use project files from trusted sources.
- MitigationSIMATIC STEP 7 V5.Xcisa_csaf_ot
Only use project files from trusted sources.
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Only use project files from trusted sources.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.6–7.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (30)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- SSA-689942SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products2020-06-09csaf · siemens_psirtDE
Multiple SIMATIC Software products are affected by two vulnerabilities that could allow an attacker to manipulate project files that may lead to Remote Code Execution or Denial-of-Service attacks. Siemens has released updates to some of the affected products and recommends that customers update to the latest version. Siemens is preparing further updates and recommends specific workarounds and mitigations until patches are available.
- ICSA-20-161-05Siemens SIMATIC, SINAMICS (Update C)2020-06-09icsa · cisa_csaf_otUS
Multiple SIMATIC Software products are affected by two vulnerabilities that could allow an attacker to manipulate project files that may lead to Remote Code Execution or Denial-of-Service attacks. Siemens has released updates to some of the affected products and recommends that customers update to the latest version. Siemens is preparing further updates and recommends specific workarounds and mitigations until patches are available.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-689942.pdfcnnvd
- https://cert-portal.siemens.com/productcert/txt/ssa-689942.txtPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-7586cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-161-05cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-two-vulnerabilities-32490cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.2015/cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-161-05cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-689942.pdfenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan