Skip to content
OpenAdvisories
Critical SSA-840188 3 CVEs

SSA-840188: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products

Published Nov 9, 2021 · Updated Apr 11, 2023 · Revision 7

Vendor: Siemens Product: OpenPCS 7 V8.2 Product: OpenPCS 7 V9.0 Product: OpenPCS 7 V9.1 Product: SIMATIC BATCH V8.2 Product: SIMATIC BATCH V9.0 Product: SIMATIC BATCH V9.1 Product: SIMATIC NET PC Software V14 Product: SIMATIC NET PC Software V15 Product: SIMATIC NET PC Software V16 Product: SIMATIC NET PC Software V17 Product: SIMATIC PCS 7 V8.2 Product: SIMATIC PCS 7 V9.0 Product: SIMATIC PCS 7 V9.1 Product: SIMATIC Route Control V8.2 Product: SIMATIC Route Control V9.0 Product: SIMATIC Route Control V9.1 Product: SIMATIC WinCC V15 and earlier Product: SIMATIC WinCC V16 Product: SIMATIC WinCC V17 Product: SIMATIC WinCC V7.4 Product: SIMATIC WinCC V7.5

Summary

Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow local or remote attackers to escalate privileges and read, write or delete critical files.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Note: The vulnerability CVE-2021-40359 is part of a shared component, used by various Siemens products (SIMATIC Communication Services - SCS). The installation of a fix version of any product also removes the vulnerability for other products on the same system, even if those products were not updated.

Vulnerabilities 3

Revision history

  1. #7

    No fix planned for OpenPCS 7 V8.2, for SIMATIC BATCH V8.2 and V9.0 and for SIMATIC Route Control V8.2 and V9.0

  2. #6

    Added fix for SIMATIC NET PC Software V16

  3. #5

    Added solution for SIMATIC WinCC V15

  4. #4

    Added solution for SIMATIC WinCC V7.4; added solution for SIMATIC PCS 7 V8.2 and SIMATIC PCS 7 V9.0 and related components; added SIMATIC NET PC Software incl. solution for V17; added a note regarding shared components

  5. #3

    Added Mitigation to CVE-2021-40358

  6. #2

    Added solution for SIMATIC WinCC V16 and V17 and adjusted solution for SIMATIC PCS 7 V9.1

  7. #1

    Publication Date

References