Skip to content
OpenAdvisories
Critical ICSA-19-351-02 54 CVEs

Siemens SPPA-T3000 (Update A)

Published Dec 10, 2019 · Updated May 6, 2025 · Revision 4

Vendor: Siemens Product: SPPA-T3000 Application Server Product: SPPA-T3000 MS3000 Migration Server

Summary

SPPA-T3000 Application Server and MS3000 Migration Server are affected by multiple vulnerabilities. Some of the vulnerabilities can allow an attacker to execute arbitrary code on the server. Exploitation of the vulnerabilities described in this advisory requires access to either Application- or Automation Highway. Both highways should not be exposed if the environment has been set up according to the recommended system configuration in the SPPA-T3000 security manual.

In this case Siemens Energy considers the environmental score as CR:L/IR:L/AR:H/MAV:A for vulnerabilities related to the Application Server and CR:L/IR:L/AR:M/MAV:A for vulnerabilities related to the Migration Server.

Siemens Energy provides a service pack to fix vulnerabilities on the Application Server and recommends configurations to mitigate the vulnerabilities in the Migration Server. Detailed information will be available for SPPA-T3000 customers in the Siemens Energy Customer Portal (https://cep.siemens-energy.com/).

Vulnerabilities 54

Revision history

  1. #4

    Revision - Fixing typos

  2. #3

    Editorial changes, assigned to Siemens Energy

  3. #2

    Added updates and configuration recommendations

  4. #1

    Publication Date

References