PT-2024-7414 · Siemens · Simatic Step 7 Safety

Published 2024-07-09 · Updated 2024-07-09 · CVE-2023-32737

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SIMATIC STEP 7 Safety versions prior to V18 Update 2

Description: The issue is related to the improper restriction of the .NET BinaryFormatter when deserializing user-controllable input, which could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is similar to the issue that exists for .NET BinaryFormatter.

Recommendations: For versions prior to V18 Update 2, update to V18 Update 2 to resolve the issue. As a temporary workaround, consider restricting the use of the .NET BinaryFormatter when deserializing user-controllable input to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-08788

CVE-2023-32737

Affected Products

Simatic Step 7 Safety

References · 5

• https://bdu.fstec.ru/vul/2024-08788 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-32737 · Security Note
• https://twitter.com/VulmonFeeds/status/1810686108558049527 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-313039.html · Note
• https://twitter.com/CVEnew/status/1810652006228660411 · Twitter Post