Code injection

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3, SIMATIC PDM All versions V9.2, SIMATIC STEP 7 V5.X All versions V5.6 SP2 HF3, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 HF2. A DLL Hijacking...

CVE-2020-7586

CVE-2020-7586 is a local, heap-based buffer overflow vulnerability affecting Siemens products (SIMATIC PCS 7, PDM, STEP 7, SINAMICS STARTER). The issue allows a local attacker with existing access to cause a DoS and potentially access confidential information due to memory corruption. Root cause ...

CVE-2020-7585

The connected advisory (ICSA-20-161-05) provides concrete details for CVE-2020-7585. A DLL hijacking flaw (Uncontrolled Search Path Element, CWE-427) in Siemens software could allow a local attacker with access to execute code with elevated privileges, affecting: SIMATIC PCS 7 v8.2 and earlier; S...

CVE-2020-7580

A vulnerability has been identified in SIMATIC Automation Tool All versions V4 SP2, SIMATIC NET PC Software V14 All versions V14 SP1 Update 14, SIMATIC NET PC Software V15 All versions, SIMATIC NET PC Software V16 All versions V16 Upd3, SIMATIC PCS neo All versions V3.0 SP1, SIMATIC ProSave All...

PT-2020-5920

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS 7 versions V8.2 and earlier SIMATIC PCS 7 version V9.0 through V9.0 SP2 SIMATIC PDM versions prior to V9.2 SIMATIC STEP 7 versions prior to V5.6 SP2 HF3 SINAMICS STARTER versions prior to V5.4 HF2 Description: A buffer overflow...

CVE-2020-7586: Heap-based Buffer Overflow

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3, SIMATIC PDM All versions V9.2, SIMATIC STEP 7 V5.X All versions V5.6 SP2 HF3, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 HF2. A buffer overflow...

CVE-2020-7580

CVE-2020-7580 affects Siemens products (e.g., SIMATIC Automation Tool, STEP 7/TIA Portal, WinCC OA, ProSave, S7-1500 controllers, etc.). Root cause: a common component calls a helper binary with SYSTEM privileges while the call path is not quoted (unquoted search path/element CWE-428). This could...

CVE-2020-7585: Uncontrolled Search Path Element

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3, SIMATIC PDM All versions V9.2, SIMATIC STEP 7 V5.X All versions V5.6 SP2 HF3, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 HF2. A DLL Hijacking...

PT-2020-5921

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS 7 versions V8.2 and earlier SIMATIC PCS 7 version V9.0 through V9.0 SP2 SIMATIC PDM versions prior to V9.2 SIMATIC STEP 7 versions prior to V5.6 SP2 HF3 SINAMICS STARTER versions prior to V5.4 HF2 Description: A DLL Hijacking...

Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update J)

1. EXECUTIVE SUMMARY --------- Begin Update K Part 1 of 2 --------- CVSS v3 8.8 --------- End Update K Part 1 of 2 --------- ATTENTION: Low attack complexity Vendor: Siemens Equipment: SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK Vulnerability: Unquoted Search Path or Element 2. UPDATE...

Siemens SIMATIC, SINAMICS (Update C)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Siemens Equipment: SIMATIC, SINAMICS Vulnerabilities: Uncontrolled Search Path Element, Heap-based Buffer Overflow 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled ICSA-20-161-05...

Siemens Ktk Uncontrolled Resource Consumption

A vulnerability has been identified in KTK ATE530S All versions, SIDOOR ATD430W All versions, SIDOOR ATE530S COATED All versions, SIDOOR ATE531S All versions, SIMATIC ET 200SP Open Controller CPU 1515SP PC incl. SIPLUS variants All versions = V4.2, SIMATIC ET200SP IM155-6 MF HF All versions,...

Siemens Dk Uncontrolled Resource Consumption

A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller All versions, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 All Versions V4.5, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P All Versions V4.6, PROFINET...

Siemens KTK, SIDOOR, SIMATIC, and SINAMICS (Update D)

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

The vulnerability of the SINAMICS PERFECT HARMONY GH180 driver software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the device.

The vulnerability of SINAMICS PERFECT HARMONY GH180 driver software is related to insufficient verification of input data. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the device...

CVE-2019-19278

A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With option A30 HMIs 12 inches or larger All versions, SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR325.-.....-.... High Availability All versions...

Design/Logic Flaw

A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With option A30 HMIs 12 inches or larger All versions, SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR325.-.....-.... High Availability All versions...

CVE-2019-19278

A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With option A30 HMIs 12 inches or larger All versions, SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR325.-.....-.... High Availability All versions...

CVE-2019-19278

The CVE-2019-19278 entry concerns Siemens SINAMICS PERFECT HARMONY GH180 drives (MLFB 6SR32/4/5 with option A30 for HMIs ≥12 in, and MLFB 6SR325 High Availability) where an unauthenticated attacker with physical access can restore the device to a state where protection mechanisms are disabled. Th...

CVE-2019-19278: Protection Mechanism Failure

A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With option A30 HMIs 12 inches or larger All versions, SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR325.-.....-.... High Availability All versions...