Summary
The installers used to install several Siemens products are affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected installer component. This vulnerability poses a risk only during setup and installation phase of the affected applications downloaded e.g. via OSD (Online Software Delivery).
Siemens has released new versions for several affected products and recommends using the latest versions during setup and installation. Siemens is preparing further fixes and recommends specific countermeasures for products where fixes are not or not yet available.
Vulnerabilities 1
-
High 7.8
The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code whe…
Revision history
-
#12
Added fix for SIMATIC WinCC Visualization Architect (SiVArc) V18; Added no fix planned for SIMATIC eaSie Workflow Skills V26,SIMATIC eaSie PCS 7 Skill Package V26,SIMATIC eaSie Document Skills V26,SIMATIC eaSie Core Package V26
-
#11
Update the affected version of SIMATIC Safety Matrix to V6.3
-
#10
Added fix version for SINETPLAN and TIA Portal V18; Updated affected version for Telecontrol and PowerControl to V9.1
-
#9
Added fix for D7-SYS, Automation Tool, Automation Tool SDK Windows and Updated PDM MS V5.0, Process Historian 2022,PCS 7 Advanced Process Functions,PCS 7 Advanced Process Graphics,PCS 7 Logic Matrix V10.0,PCS 7 Advanced Process Library incl. Faceplates V10.0,BATCH V10.0,PCS 7 Industry Library V9.1 and V10.0,PCS 7/OPEN OS V9.1,PCS 7 PowerControl ,PCS 7 Standard Chemical Library V10.0 and V9.1,PCS 7 TeleControl,PDM V9.2,S7 F Systems V6.4,Safety Matrix, OpenPCS 7 V9.1 and V10.0 to no fix planned
-
#8
Added fixes for Simatic Target, Simatic Wincc V7.5 and V8.0
-
#7
Updated remediation for SIMATIC ODK 1500S and SIMATIC S7-PLCSIM V17, V18, V19 to 'No fix planned' and added fix version for Create MyConfig (CMC)
-
#6
Added fixes for WinCC Panel Image Setup, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC Visualization Architect (SiVArc) V17, SIMATIC Process Historian 2024, SIMATIC PCS 7 Basis Library V10.0, SIMATIC Logon V2.0, SIMATIC PDM V9.3, and MultiFieldbus Configuration Tool (MFCT); Clarified that no fix is planned for TIA Project-Server V17
-
#5
Added fixes for TIA Project-Server, TIA Portal Cloud Connector, SIMATIC MTP CREATOR V5.x, SIMATIC S7-1500 Software Controller V3, Simatic Prosave, TIA Portal V20, V19, and V17 and updated Energy suite V17 and V18, SIMATIC S7-1500 Software Controller V2 with no fix planned
-
#4
Added Fixes for PCS 7 Logic Matrix V9.1, PCS7 Advanced Process Faceplates V9.1, SIMATIC PCS 7 Basis Faceplates V9.1 PCS 7 Basis Library V9.1, SIMATIC Management Agent V9.1, SIMATIC Management Console V9.1, PCS 7 V9.1, PCS 7 V10.0
-
#3
Added fix for MTP Creator V2.x, CFL V4.x, Simatic WinCC Unified Line Coordination and Simatic WinCC Unified Sequence
-
#2
Added Sahil Shah to acknowledgment; Added fix for SIMATIC Energy Suite V19, SIMATIC Energy Suite V20, SIMATIC MTP CREATOR V4.x, SIMATIC Control Function Library (CFL) V3.x, TIA Portal Test Suite V19, TIA Portal Test Suite V20, SIMATIC WinCC Visualization Architect V19, SIMATIC WinCC Visualization Architect V20, SIMATIC S7-PCT; Updated No fix planned for SIMATIC ProSave V17,SIMATIC WinCC flexible ES, SIMATIC Control Function Library (CFL) V1.x, SIMATIC Control Function Library (CFL) V2.x
-
#1
Publication Date
References
-
SSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-282044.html