PT-2020-2002 · Siemens · Tia Portal

Published 2020-01-14 · Updated 2022-08-10 · CVE-2019-10934

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIA Portal V14 (All versions) TIA Portal V15 (All versions < V15.1 Update 7) TIA Portal V16 (All versions < V16 Update 6) TIA Portal V17 (All versions < V17 Update 4)

Description A vulnerability has been identified that could allow an attacker to execute arbitrary code with SYSTEM privileges by changing the contents of a configuration file. The issue can be exploited by an attacker with a valid account and limited access rights on the system, and no user interaction is required. The vulnerability is related to incorrect restriction of a directory path with limited access, which could allow an attacker to elevate their privileges.

Recommendations For TIA Portal V14, update to a version that includes the necessary security fixes. For TIA Portal V15, update to V15.1 Update 7 or later. For TIA Portal V16, update to V16 Update 6 or later. For TIA Portal V17, update to V17 Update 4 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-01387

CVE-2019-10934

Affected Products

Tia Portal

References · 4

• https://bdu.fstec.ru/vul/2020-01387 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10934 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10934 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-629512.pdf · Vendor Advisory