Skip to content
OpenAdvisories
High SSA-392859 1 CVE

SSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20

Published Dec 10, 2024 · Updated Oct 13, 2026 · Revision 4

Vendor: Siemens Product: SIMATIC S7-PLCSIM V17 Product: SIMATIC S7-PLCSIM V18 Product: SIMATIC STEP 7 Safety V17 Product: SIMATIC STEP 7 Safety V18 Product: SIMATIC STEP 7 Safety V19 Product: SIMATIC STEP 7 V17 Product: SIMATIC STEP 7 V18 Product: SIMATIC STEP 7 V19 Product: SIMATIC WinCC Unified PC Runtime V18 Product: SIMATIC WinCC Unified PC Runtime V19 Product: SIMATIC WinCC Unified V17 Product: SIMATIC WinCC Unified V18 Product: SIMATIC WinCC Unified V19 Product: SIMATIC WinCC V17 Product: SIMATIC WinCC V18 Product: SIMATIC WinCC V19 Product: SIMOCODE ES V17 Product: SIMOCODE ES V18 Product: SIMOCODE ES V19 Product: SIMOTION SCOUT TIA V5.4 Product: SIMOTION SCOUT TIA V5.5 Product: SIMOTION SCOUT TIA V5.6 Product: SINAMICS Startdrive V17 Product: SINAMICS Startdrive V18 Product: SINAMICS Startdrive V19 Product: SIRIUS Safety ES V17 (TIA Portal) Product: SIRIUS Safety ES V18 (TIA Portal) Product: SIRIUS Safety ES V19 (TIA Portal) Product: SIRIUS Soft Starter ES V17 (TIA Portal) +5 more

Summary

Affected products contain a local arbitrary code execution vulnerability that could allow an attacker to perform actions against the operation system of that environment.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-52051. See the chapter "Additional Information" below for more details.

Vulnerabilities 1

Revision history

  1. #4

    Added no fix expected for PLCSIM, SIMATIC STEP 7 Safety V18, SIMATIC STEP 7 V18, SIMATIC WinCC Unified V18, SIMATIC WinCC V18

  2. #3

    Added fix for Totally Integrated Automation Portal (TIA Portal) V17

  3. #2

    Added fix for Totally Integrated Automation Portal (TIA Portal) V19; Name of SIMOTION SCOUT TIA V5.6 SP1 was updated to SIMOTION SCOUT TIA V5.6 and Name of SIMOTION SCOUT TIA V5.5 SP1 was updated to SIMOTION SCOUT TIA V5.5 and Name of SIMOTION SCOUT TIA V5.4 SP3 was updated to SIMOTION SCOUT TIA V5.4

  4. #1

    Publication Date

References