Skip to content
OpenAdvisories
High SSA-312271 1 CVE

SSA-312271: Unquoted Search Path Vulnerability in Windows-based Industrial Software Applications

Published Jun 9, 2020 · Updated Dec 13, 2022 · Revision 12

Vendor: Siemens Product: SIMATIC Automation Tool Product: SIMATIC NET PC Software V14 Product: SIMATIC NET PC Software V15 Product: SIMATIC NET PC Software V16 Product: SIMATIC PCS neo Product: SIMATIC ProSave Product: SIMATIC S7-1500 Software Controller Product: SIMATIC STEP 7 (TIA Portal) V13 Product: SIMATIC STEP 7 (TIA Portal) V14 Product: SIMATIC STEP 7 (TIA Portal) V15 Product: SIMATIC STEP 7 (TIA Portal) V16 Product: SIMATIC STEP 7 V5 Product: SIMATIC WinCC OA V3.16 Product: SIMATIC WinCC OA V3.17 Product: SIMATIC WinCC Runtime Advanced Product: SIMATIC WinCC Runtime Professional V13 Product: SIMATIC WinCC Runtime Professional V14 Product: SIMATIC WinCC Runtime Professional V15 Product: SIMATIC WinCC Runtime Professional V16 Product: SIMATIC WinCC V7.4 Product: SIMATIC WinCC V7.5 Product: SINAMICS Startdrive Product: SINAMICS STARTER Product: SINEC NMS Product: SINEMA Server Product: SINUMERIK ONE virtual Product: SINUMERIK Operate

Summary

Several industrial products as listed below contain a local privilege escalation vulnerability that could allow a local attacker to execute arbitrary code with SYTEM privileges.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

Revision history

  1. #12

    Corrected description and CVSS score for CVE-2020-7580

  2. #11

    Added solution for SIMATIC NET PC Software V14 and clarified affected versions

  3. #10

    Added solution for SIMATIC ProSave

  4. #9

    Updated solution for SINEMA Server

  5. #8

    Added solution for SIMATIC Automation Tool and updated solution for SINEC NMS

  6. #7

    Added solution for SINUMERIK ONE Virtual and SINUMERIK Operate

  7. #6

    Added solution for SIMATIC STEP 7 (TIA Portal) V14 and SIMATIC WinCC Runtime Professional V14

  8. #5

    Added solution for SIMATIC S7-1500 Software Controller and SINAMICS STARTER

  9. #4

    Added solution for SINAMICS Startdrive, SIMATIC STEP 7 (TIA Portal) V15, and SIMATIC WinCC Runtime Professional V15

  10. #3

    Added solution for SIMATIC PCS neo. Errata: SIMATIC PCS 7 removed from affected products

  11. #2

    Added solutions for SIMATIC STEP 7 V13, SIMATIC STEP 7 V16, SIMATIC WinCC Runtime Professional V13, SIMATIC WinCC Runtime Professional V16 and SIMATIC WinCC Runtime Advanced

  12. #1

    Publication Date

References