cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-49775,https://securityvulnerability.io/vulnerability/CVE-2024-49775,Heap-Based Buffer Overflow in Siemens Automation Products,"CVE-2024-49775 identifies a critical heap-based buffer overflow vulnerability affecting multiple Siemens automation products, including the Opcenter suite and the Totally Integrated Automation Portal (TIA Portal). This vulnerability resides in the integrated UMC component and could allow an unauthenticated remote attacker to execute arbitrary code. Given the widespread use of these products in industrial environments, the implications of such exploitation could lead to severe operational disruptions. Siemens has acknowledged this vulnerability in all listed versions and it is imperative for users to assess their current configurations and apply necessary mitigations.",Siemens,"Opcenter Execution Foundation,Opcenter Intelligence,Opcenter Quality,Opcenter Rdl,Simatic Pcs Neo V4.0,Simatic Pcs Neo V4.1,Simatic Pcs Neo V5.0,Sinec Nms,Totally Integrated Automation Portal (tia Portal) V16,Totally Integrated Automation Portal (tia Portal) V17,Totally Integrated Automation Portal (tia Portal) V18,Totally Integrated Automation Portal (tia Portal) V19",9.8,CRITICAL,0.000910000002477318,false,,false,false,false,,false,false,2024-12-16T15:06:04.714Z,184
CVE-2024-33698,https://securityvulnerability.io/vulnerability/CVE-2024-33698,Heap-Based Buffer Overflow in Opcenter and SIMATIC Products by Siemens,"A critical security vulnerability exists within the integrated UMC component of various Siemens products, including Opcenter and SIMATIC series. This vulnerability is characterized as a heap-based buffer overflow, which could potentially enable an unauthenticated remote attacker to execute arbitrary code on the affected systems. This flaw underscores the importance of regular updates and security patch management to protect industrial applications from malicious exploitation.",Siemens,"Opcenter Execution Foundation,Opcenter Quality,Opcenter Rdl,Simatic Information Server 2022,Simatic Information Server 2024,Simatic Pcs Neo V4.0,Simatic Pcs Neo V4.1,Simatic Pcs Neo V5.0,Sinec Nms,Totally Integrated Automation Portal (tia Portal) V16,Totally Integrated Automation Portal (tia Portal) V17,Totally Integrated Automation Portal (tia Portal) V18,Totally Integrated Automation Portal (tia Portal) V19",9.8,CRITICAL,0.0004299999854993075,false,,false,false,false,,false,false,2024-09-10T09:36:31.009Z,0
CVE-2022-45147,https://securityvulnerability.io/vulnerability/CVE-2022-45147,Serious Vulnerability Affects Siemens' SIMATIC PCS NEO and STEP 7 Applications,"A vulnerability exists in Siemens SIMATIC PCS neo and STEP 7 products, where improper restrictions on the .NET BinaryFormatter during deserialization of user-controllable input could lead to type confusion. This flaw allows an attacker to execute arbitrary code within the affected applications. For more details, refer to the official Siemens CERT portal.",Siemens,"Simatic Pcs Neo V4.0,Simatic Step 7 V16,Simatic Step 7 V17,Simatic Step 7 V18",7.8,HIGH,0.0004299999854993075,false,,false,false,false,,false,false,2024-07-09T12:04:22.545Z,0
CVE-2023-46284,https://securityvulnerability.io/vulnerability/CVE-2023-46284,Out of Bounds Write Vulnerability in Siemens Automation Products,"A significant out of bounds write vulnerability exists in various Siemens automation products, including Opcenter Execution Foundation and the Totally Integrated Automation Portal. This vulnerability arises when specific requests are processed on designated TCP ports (4002 and 4004), leading to a potential application crash. The affected services are designed to auto-restart following a crash, which may allow an attacker to exploit the application further. Timely updates to the latest versions are crucial for mitigating this risk.",Siemens,"Opcenter Execution Foundation,Opcenter Quality,Simatic Pcs Neo,Sinec Nms,Totally Integrated Automation Portal (tia Portal) V14,Totally Integrated Automation Portal (tia Portal) V15.1,Totally Integrated Automation Portal (tia Portal) V16,Totally Integrated Automation Portal (tia Portal) V17,Totally Integrated Automation Portal (tia Portal) V18",7.5,HIGH,0.0004299999854993075,false,,false,false,false,,false,false,2023-12-12T12:15:00.000Z,0
CVE-2023-46283,https://securityvulnerability.io/vulnerability/CVE-2023-46283,Out of Bounds Write Vulnerability in Opcenter and TIA Portal by Siemens,"A vulnerability exists in various Siemens software products that allows for an out of bounds write, potentially leading an attacker to crash the application while processing specific requests on a designated TCP port. Following the crash, the affected service is configured to automatically restart, which could be exploited by an attacker for further malicious actions. It's crucial for users of Opcenter Execution Foundation, TIA Portal, and related products to ensure they are running the latest versions to mitigate this risk.",Siemens,"Opcenter Execution Foundation,Opcenter Quality,Simatic Pcs Neo,Sinec Nms,Totally Integrated Automation Portal (tia Portal) V14,Totally Integrated Automation Portal (tia Portal) V15.1,Totally Integrated Automation Portal (tia Portal) V16,Totally Integrated Automation Portal (tia Portal) V17,Totally Integrated Automation Portal (tia Portal) V18",7.5,HIGH,0.0004299999854993075,false,,false,false,false,,false,false,2023-12-12T12:15:00.000Z,0
CVE-2023-46282,https://securityvulnerability.io/vulnerability/CVE-2023-46282,Reflected Cross-Site Scripting Vulnerability in Siemens Automation Products,"A reflected cross-site scripting vulnerability has been found in various Siemens automation products, including the Opcenter Execution Foundation and the Totally Integrated Automation Portal. This flaw allows attackers to inject arbitrary JavaScript code into the web interface, which could subsequently be executed by another user, potentially compromising their session and leading to unauthorized actions. The affected versions span multiple platforms, necessitating immediate attention for users of these critical systems.",Siemens,"Opcenter Execution Foundation,Opcenter Quality,Simatic Pcs Neo,Sinec Nms,Totally Integrated Automation Portal (tia Portal) V14,Totally Integrated Automation Portal (tia Portal) V15.1,Totally Integrated Automation Portal (tia Portal) V16,Totally Integrated Automation Portal (tia Portal) V17,Totally Integrated Automation Portal (tia Portal) V18",6.1,MEDIUM,0.0006799999973736703,false,,false,false,false,,false,false,2023-12-12T12:15:00.000Z,0
CVE-2023-46281,https://securityvulnerability.io/vulnerability/CVE-2023-46281,CORS Misconfiguration in Siemens Web Interfaces,"A vulnerability exists in the web interfaces of several Siemens products, where an overly permissive CORS policy could allow an attacker to exploit this misconfiguration. By manipulating CORS settings, an attacker could deceive legitimate users into triggering unintended actions, which may compromise the security of the user's session or expose sensitive data.",Siemens,"Opcenter Execution Foundation,Opcenter Quality,Simatic Pcs Neo,Sinec Nms,Totally Integrated Automation Portal (tia Portal) V14,Totally Integrated Automation Portal (tia Portal) V15.1,Totally Integrated Automation Portal (tia Portal) V16,Totally Integrated Automation Portal (tia Portal) V17,Totally Integrated Automation Portal (tia Portal) V18",8.8,HIGH,0.0018500000005587935,false,,false,false,false,,false,false,2023-12-12T12:15:00.000Z,0
CVE-2023-46285,https://securityvulnerability.io/vulnerability/CVE-2023-46285,Input Validation Vulnerability in Siemens Automation Products,"An improper input validation vulnerability exists in various Siemens automation products. This flaw can be exploited by sending specially crafted messages to the service running on port 4004/tcp, potentially leading to a Denial-of-Service condition. Notably, the affected services are designed to auto-restart once a failure is detected, which may make detection of the attack more challenging.",Siemens,"Opcenter Execution Foundation,Opcenter Quality,Simatic Pcs Neo,Sinec Nms,Totally Integrated Automation Portal (tia Portal) V14,Totally Integrated Automation Portal (tia Portal) V15.1,Totally Integrated Automation Portal (tia Portal) V16,Totally Integrated Automation Portal (tia Portal) V17,Totally Integrated Automation Portal (tia Portal) V18",7.5,HIGH,0.0004299999854993075,false,,false,false,false,,false,false,2023-12-12T12:15:00.000Z,0
CVE-2023-46097,https://securityvulnerability.io/vulnerability/CVE-2023-46097,SQL Injection Flaw in SIMATIC PCS neo by Siemens,"A vulnerability exists in the PUD Manager of SIMATIC PCS neo where it fails to adequately sanitize user-provided inputs. This flaw allows an authenticated adjacent attacker to craft and execute arbitrary SQL statements, potentially compromising the integrity of the underlying database and exposing sensitive data.",Siemens,SIMATIC PCS neo,8,HIGH,0.0004299999854993075,false,,false,false,false,,false,false,2023-11-14T11:15:00.000Z,0
CVE-2023-46096,https://securityvulnerability.io/vulnerability/CVE-2023-46096,Improper Authentication in SIMATIC PCS neo by Siemens,"A security issue has been detected in SIMATIC PCS neo, where the PUD Manager web service fails to properly authenticate users. This vulnerability may allow an unauthorized attacker within the adjacent network to produce a privileged token, which could facilitate the upload of additional documents without the necessary permissions. It emphasizes the importance of robust authentication measures to protect against unauthorized access and potential data breaches.",Siemens,SIMATIC PCS neo,6.5,MEDIUM,0.00044999999227002263,false,,false,false,false,,false,false,2023-11-14T11:15:00.000Z,0
CVE-2023-46098,https://securityvulnerability.io/vulnerability/CVE-2023-46098,CORS Misconfiguration in SIMATIC PCS neo by Siemens,"A security issue exists within SIMATIC PCS neo, where an overly permissive Cross-Origin Resource Sharing (CORS) policy can be exploited. By accessing the Information Server, attackers may manipulate a legitimate user's actions, leading to unauthorized behavior. This vulnerability affects all versions of the product prior to 4.1.",Siemens,SIMATIC PCS neo,8.8,HIGH,0.0016799999866634607,false,,false,false,false,,false,false,2023-11-14T11:15:00.000Z,0
CVE-2023-46099,https://securityvulnerability.io/vulnerability/CVE-2023-46099,Stored Cross-Site Scripting Flaw in SIMATIC PCS neo by Siemens,"A stored cross-site scripting vulnerability has been discovered in the Administration Console of SIMATIC PCS neo. This security flaw affects all versions prior to V4.1 and allows an attacker with elevated privileges to inject malicious JavaScript code into the application. The injected code can then be executed by another user, potentially compromising sensitive information and endangering system integrity.",Siemens,SIMATIC PCS neo,4.8,MEDIUM,0.0005300000193528831,false,,false,false,false,,false,false,2023-11-14T11:15:00.000Z,0
CVE-2023-38558,https://securityvulnerability.io/vulnerability/CVE-2023-38558,Local Credential Exposure in SIMATIC PCS neo Administration Console by Siemens,"A vulnerability in the Administration Console of SIMATIC PCS neo versions exposes Windows administrator credentials to local attackers. This security flaw allows unauthorized personnel with local access to retrieve sensitive credential information, potentially enabling them to impersonate administrators and gain further access to Windows-based systems. Organizations using affected versions are advised to review their security practices and implement measures to mitigate the risks associated with this vulnerability.",Siemens,"SIMATIC PCS neo (Administration Console) V4.0,SIMATIC PCS neo (Administration Console) V4.0 Update 1",5.5,MEDIUM,0.0004199999966658652,false,,false,false,false,,false,false,2023-09-14T11:15:00.000Z,0
CVE-2023-28831,https://securityvulnerability.io/vulnerability/CVE-2023-28831,Integer Overflow Issue in Siemens OPC UA Implementations,"The OPC UA implementations in Siemens products harbor an integer overflow vulnerability that can lead to an infinite loop during the certificate validation process. This condition could be exploited by an unauthenticated remote attacker utilizing a specially crafted certificate, resulting in a denial of service that impacts application availability and reliability.",Siemens,"Simatic Braumat,Simatic Cloud Connect 7 Cc712,Simatic Cloud Connect 7 Cc716,Simatic Comfort/mobile Rt,Simatic Drive Controller Cpu 1504d Tf,Simatic Drive Controller Cpu 1507d Tf,Simatic Et 200sp Open Controller Cpu 1515sp Pc2 (incl. Siplus Variants),Simatic Ipc Diagmonitor,Simatic Net Pc Software V14,Simatic Net Pc Software V16,Simatic Net Pc Software V17,Simatic Net Pc Software V18,Simatic Pcs 7 V9.1,Simatic Pcs Neo V4.0,Simatic S7-1500 Cpu 1510sp F-1 Pn,Simatic S7-1500 Cpu 1510sp-1 Pn,Simatic S7-1500 Cpu 1511-1 Pn,Simatic S7-1500 Cpu 1511c-1 Pn,Simatic S7-1500 Cpu 1511f-1 Pn,Simatic S7-1500 Cpu 1511t-1 Pn,Simatic S7-1500 Cpu 1511tf-1 Pn,Simatic S7-1500 Cpu 1512c-1 Pn,Simatic S7-1500 Cpu 1512sp F-1 Pn,Simatic S7-1500 Cpu 1512sp-1 Pn,Simatic S7-1500 Cpu 1513-1 Pn,Simatic S7-1500 Cpu 1513f-1 Pn,Simatic S7-1500 Cpu 1514sp F-2 Pn,Simatic S7-1500 Cpu 1514sp-2 Pn,Simatic S7-1500 Cpu 1514spt F-2 Pn,Simatic S7-1500 Cpu 1514spt-2 Pn,Simatic S7-1500 Cpu 1515-2 Pn,Simatic S7-1500 Cpu 1515f-2 Pn,Simatic S7-1500 Cpu 1515t-2 Pn,Simatic S7-1500 Cpu 1515tf-2 Pn,Simatic S7-1500 Cpu 1516-3 Pn/dp,Simatic S7-1500 Cpu 1516f-3 Pn/dp,Simatic S7-1500 Cpu 1516t-3 Pn/dp,Simatic S7-1500 Cpu 1516tf-3 Pn/dp,Simatic S7-1500 Cpu 1517-3 Pn/dp,Simatic S7-1500 Cpu 1517f-3 Pn/dp,Simatic S7-1500 Cpu 1517t-3 Pn/dp,Simatic S7-1500 Cpu 1517tf-3 Pn/dp,Simatic S7-1500 Cpu 1518-4 Pn/dp,Simatic S7-1500 Cpu 1518-4 Pn/dp Mfp,Simatic S7-1500 Cpu 1518f-4 Pn/dp,Simatic S7-1500 Cpu 1518f-4 Pn/dp Mfp,Simatic S7-1500 Cpu 1518t-4 Pn/dp,Simatic S7-1500 Cpu 1518tf-4 Pn/dp,Simatic S7-1500 Cpu S7-1518-4 Pn/dp Odk,Simatic S7-1500 Cpu S7-1518f-4 Pn/dp Odk,Simatic S7-1500 Et 200pro: Cpu 1513pro F-2 Pn,Simatic S7-1500 Et 200pro: Cpu 1513pro-2 Pn,Simatic S7-1500 Et 200pro: Cpu 1516pro F-2 Pn,Simatic S7-1500 Et 200pro: Cpu 1516pro-2 Pn,Simatic S7-1500 Software Controller V2,Simatic S7-1500 Software Controller V3,Simatic S7-plcsim Advanced,Simatic Sistar,Simatic Wincc Oa V3.17,Simatic Wincc Oa V3.18,Simatic Wincc Oa V3.19,Simatic Wincc Opc Ua Client,Simatic Wincc Runtime Professional V16,Simatic Wincc Runtime Professional V17,Simatic Wincc Runtime Professional V18,Simatic Wincc Runtime Professional V19,Simatic Wincc Unified Opc Ua Server,Simatic Wincc V7.4,Simatic Wincc V7.5,Simatic Wincc V8.0,Sinumerik Mc,Sinumerik One,Siplus Et 200sp Cpu 1510sp F-1 Pn,Siplus Et 200sp Cpu 1510sp F-1 Pn Rail,Siplus Et 200sp Cpu 1510sp-1 Pn,Siplus Et 200sp Cpu 1510sp-1 Pn Rail,Siplus Et 200sp Cpu 1512sp F-1 Pn,Siplus Et 200sp Cpu 1512sp F-1 Pn Rail,Siplus Et 200sp Cpu 1512sp-1 Pn,Siplus Et 200sp Cpu 1512sp-1 Pn Rail,Siplus S7-1500 Cpu 1511-1 Pn,Siplus S7-1500 Cpu 1511-1 Pn T1 Rail,Siplus S7-1500 Cpu 1511-1 Pn Tx Rail,Siplus S7-1500 Cpu 1511f-1 Pn,Siplus S7-1500 Cpu 1513-1 Pn,Siplus S7-1500 Cpu 1513f-1 Pn,Siplus S7-1500 Cpu 1515f-2 Pn,Siplus S7-1500 Cpu 1515f-2 Pn Rail,Siplus S7-1500 Cpu 1515f-2 Pn T2 Rail,Siplus S7-1500 Cpu 1516-3 Pn/dp,Siplus S7-1500 Cpu 1516-3 Pn/dp Rail,Siplus S7-1500 Cpu 1516-3 Pn/dp Tx Rail,Siplus S7-1500 Cpu 1516f-3 Pn/dp,Siplus S7-1500 Cpu 1516f-3 Pn/dp Rail,Siplus S7-1500 Cpu 1518-4 Pn/dp,Siplus S7-1500 Cpu 1518-4 Pn/dp Mfp,Siplus S7-1500 Cpu 1518f-4 Pn/dp",7.5,HIGH,0.0005300000193528831,false,,false,false,false,,false,false,2023-09-12T10:15:00.000Z,0
CVE-2022-27194,https://securityvulnerability.io/vulnerability/CVE-2022-27194,,"A vulnerability has been identified in SIMATIC PCS neo (Administration Console) (All versions < V3.1 SP1), SINETPLAN (All versions), TIA Portal (V15, V15.1, V16 and V17). The affected system cannot properly process specially crafted packets sent to port 8888/tcp. A remote attacker could exploit this vulnerability to cause a Denial-of-Service condition. The affected devices must be restarted manually.",Siemens,"Simatic Pcs Neo (administration Console),Sinetplan,Tia Portal",7.5,HIGH,0.0017900000093504786,false,,false,false,false,,false,false,2022-04-12T09:07:59.000Z,0
CVE-2020-7588,https://securityvulnerability.io/vulnerability/CVE-2020-7588,,"A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending a specially crafted packet to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself.",Siemens,"Opcenter Execution Discrete,Opcenter Execution Foundation,Opcenter Execution Process,Opcenter Intelligence,Opcenter Quality,Opcenter Rd&l,Simatic It Lms,Simatic It Production Suite,Simatic Notifier Server For Windows,Simatic Pcs Neo,Simatic Step 7 (tia Portal) V15,Simatic Step 7 (tia Portal) V16,Simocode Es V15.1,Simocode Es V16,Soft Starter Es V15.1,Soft Starter Es V16",5.3,MEDIUM,0.0010999999940395355,false,,false,false,false,,false,false,2020-07-14T13:18:05.000Z,0
CVE-2020-7587,https://securityvulnerability.io/vulnerability/CVE-2020-7587,,"A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending multiple specially crafted packets to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself. On some cases the vulnerability could leak random information from the remote service.",Siemens,"Opcenter Execution Discrete,Opcenter Execution Foundation,Opcenter Execution Process,Opcenter Intelligence,Opcenter Quality,Opcenter Rd&l,Simatic It Lms,Simatic It Production Suite,Simatic Notifier Server For Windows,Simatic Pcs Neo,Simatic Step 7 (tia Portal) V15,Simatic Step 7 (tia Portal) V16,Simocode Es V15.1,Simocode Es V16,Soft Starter Es V15.1,Soft Starter Es V16",8.2,HIGH,0.002460000105202198,false,,false,false,false,,false,false,2020-07-14T13:18:05.000Z,0
CVE-2020-7581,https://securityvulnerability.io/vulnerability/CVE-2020-7581,,"A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). A component within the affected application calls a helper binary with SYSTEM privileges during startup while the call path is not quoted. This could allow a local attacker with administrative privileges to execute code with SYSTEM level privileges.",Siemens,"Opcenter Execution Discrete,Opcenter Execution Foundation,Opcenter Execution Process,Opcenter Intelligence,Opcenter Quality,Opcenter Rd&l,Simatic Notifier Server For Windows,Simatic Pcs Neo,Simatic Step 7 (tia Portal) V15,Simatic Step 7 (tia Portal) V16,Simocode Es V15.1,Simocode Es V16,Soft Starter Es V15.1,Soft Starter Es V16",6.7,MEDIUM,0.0004199999966658652,false,,false,false,false,,false,false,2020-07-14T13:18:05.000Z,0
CVE-2020-7580,https://securityvulnerability.io/vulnerability/CVE-2020-7580,,"A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Upd3), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC ProSave (All versions < V17), SIMATIC S7-1500 Software Controller (All versions < V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMATIC STEP 7 V5 (All versions < V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions < V3.16 P018), SIMATIC WinCC OA V3.17 (All versions < V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions < V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 3), SINAMICS STARTER (All Versions < V5.4 HF2), SINAMICS Startdrive (All Versions < V16 Update 3), SINEC NMS (All versions < V1.0 SP2), SINEMA Server (All versions < V14 SP3), SINUMERIK ONE virtual (All Versions < V6.14), SINUMERIK Operate (All Versions < V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges.",Siemens,"Simatic Automation Tool,Simatic Net Pc Software V14,Simatic Net Pc Software V15,Simatic Net Pc Software V16,Simatic Pcs Neo,Simatic Prosave,Simatic S7-1500 Software Controller,Simatic Step 7 (tia Portal) V13,Simatic Step 7 (tia Portal) V14,Simatic Step 7 (tia Portal) V15,Simatic Step 7 (tia Portal) V16,Simatic Step 7 V5,Simatic Wincc Oa V3.16,Simatic Wincc Oa V3.17,Simatic Wincc Runtime Advanced,Simatic Wincc Runtime Professional V13,Simatic Wincc Runtime Professional V14,Simatic Wincc Runtime Professional V15,Simatic Wincc Runtime Professional V16,Simatic Wincc V7.4,Simatic Wincc V7.5,Sinamics Starter,Sinamics Startdrive,Sinec Nms,Sinema Server,Sinumerik One Virtual,Sinumerik Operate",6.7,MEDIUM,0.0004600000102072954,false,,false,false,false,,false,false,2020-06-10T00:00:00.000Z,0