Summary
Siemens Tecnomatix Plant Simulation do not properly limit the access of the simulation model to the filesystem. This could allow an unauthorized attacker to read or delete arbitrary files or the entire filesystem of the device.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 2
-
Medium 6.8
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant …
-
Medium 6.2
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant …
Revision history
-
#2
Revision - Fixing typos
-
#1
Publication Date
References
-
SSA-507653: Improper Access Control Vulnerabilities in Tecnomatix Plant Simulation - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-507653.html
-
ICS Advisory ICSA-25-072-08 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-08
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B