Description
A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (All versions < V1.1), TIA Project-Server V16 (All versions), TIA Project-Server V17 (All versions < V17 Update 6). Affected applications contain an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | TIA Multiuser Server V14 | — | — |
| Siemens | TIA Multiuser Server V15 | All versions < V15.1 Update 8 | — |
| Siemens | TIA Project-Server | All versions < V1.1 | — |
| Siemens | TIA Project-Server V16 | — | — |
| Siemens | TIA Project-Server V17 | All versions < V17 Update 6 | — |
Advisories 3
- ICSA-23-047-07 Siemens TIA Project-Server formerly known as TIA Multiuser Server CISA ICS & IT advisories · Aug 13, 2024
- SSA-640968 SSA-640968: Untrusted Search Path Vulnerability in TIA Project-Server formerly known as TIA Multiuser Server Siemens ProductCERT · Aug 13, 2024
- WID-SEC-2023-0357 Siemens TIA Portal: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Feb 13, 2023