Summary
An attacker could achieve privilege escalation on the web server of certain devices configured by SIMATIC STEP 7 (TIA Portal) due to incorrect handling of the webserver's user management configuration during downloading. This only affects the S7-1200 and S7-1500 CPUs' (incl. related ET200 CPUs and SIPLUS variants) web server, when activated.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 …
Revision history
-
#1
Publication Date
References
-
SSA-350757: Improper Access Control Vulnerability in TIA Portal Affecting S7-1200 and S7-1500 CPUs Web Server (Incl. Related ET200 CPUs and SIPLUS variants) - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-350757.pdf
-
SSA-350757: Improper Access Control Vulnerability in TIA Portal Affecting S7-1200 and S7-1500 CPUs Web Server (Incl. Related ET200 CPUs and SIPLUS variants) - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-350757.txt