Skip to content
OpenAdvisories
High SSA-800126 1 CVE

SSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20

Published Dec 10, 2024 · Updated Nov 10, 2026 · Revision 5

Vendor: Siemens Product: SIMATIC S7-PLCSIM V16 Product: SIMATIC S7-PLCSIM V17 Product: SIMATIC STEP 7 Safety V16 Product: SIMATIC STEP 7 Safety V17 Product: SIMATIC STEP 7 Safety V18 Product: SIMATIC STEP 7 Safety V19 Product: SIMATIC STEP 7 V16 Product: SIMATIC STEP 7 V17 Product: SIMATIC STEP 7 V18 Product: SIMATIC STEP 7 V19 Product: SIMATIC WinCC Unified V16 Product: SIMATIC WinCC Unified V17 Product: SIMATIC WinCC Unified V18 Product: SIMATIC WinCC Unified V19 Product: SIMATIC WinCC V16 Product: SIMATIC WinCC V17 Product: SIMATIC WinCC V18 Product: SIMATIC WinCC V19 Product: SIMOCODE ES V16 Product: SIMOCODE ES V17 Product: SIMOCODE ES V18 Product: SIMOCODE ES V19 Product: SIMOTION SCOUT TIA V5.4 Product: SIMOTION SCOUT TIA V5.5 Product: SIMOTION SCOUT TIA V5.6 Product: SINAMICS Startdrive V16 Product: SINAMICS Startdrive V17 Product: SINAMICS Startdrive V18 Product: SINAMICS Startdrive V19 +10 more

Summary

Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter "Additional Information" below for more details.

Vulnerabilities 1

Revision history

  1. #5

    Added fix for TIA Portal Cloud V17, SIMOTION SCOUT TIA V5.4, SIMOTION SCOUT TIA V5.5 and updated the fix version for SIMOTION SCOUT TIA V5.6

  2. #4

    Added fix version for SIMATIC STEP 7 Safety V18, SIMATIC STEP 7 V18, SIMATIC WinCC Unified V18, SIMATIC WinCC V18, TIA Portal Cloud V18

  3. #3

    Added fix for Totally Integrated Automation Portal (TIA Portal) V17

  4. #2

    Added fix for Totally Integrated Automation Portal (TIA Portal) V19; Name of SIMOTION SCOUT TIA V5.6 SP1 was updated to SIMOTION SCOUT TIA V5.6 and Name of SIMOTION SCOUT TIA V5.5 SP1 was updated to SIMOTION SCOUT TIA V5.5; Removed entry for SIMOTION SCOUT TIA V5.4 SP1 as the product is renamed to SIMOTION SCOUT TIA V5.4 which is mentioned in TIA portal; Name of SIMOTION SCOUT TIA V5.4 SP3 was updated to SIMOTION SCOUT TIA V5.4

  5. #1

    Publication Date

References