PT-2024-9406 · Siemens · Simatic Step 7 Safety+10

Chengbin Wang + 2 · Published 2024-12-10 · Updated 2024-12-10 · CVE-2024-49849

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: SIMATIC S7-PLCSIM versions V16 through V17 SIMATIC STEP 7 Safety versions V16 through V19 SIMATIC STEP 7 versions V16 through V19 SIMATIC WinCC Unified versions V16 through V19 SIMATIC WinCC versions V16 through V19 SIMOCODE ES versions V16 through V19 SIMOTION SCOUT TIA versions V5.4 SP1 through V5.6 SP1 SINAMICS Startdrive versions V16 through V19 SIRIUS Safety ES versions V17 through V19 SIRIUS Soft Starter ES versions V17 through V19 TIA Portal Cloud versions V16 through V19

Description: The affected products do not properly sanitize user-controllable input when parsing log files, which could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This issue is related to deficiencies in the deserialization mechanism. Exploitation of this issue may allow an attacker to execute arbitrary code.

Recommendations: For SIMATIC S7-PLCSIM versions V16 through V17, update to a patched version. For SIMATIC STEP 7 Safety versions V16 through V19, update to a patched version. For SIMATIC STEP 7 versions V16 through V19, update to a patched version. For SIMATIC WinCC Unified versions V16 through V19, update to a patched version. For SIMATIC WinCC versions V16 through V19, update to a patched version. For SIMOCODE ES versions V16 through V19, update to a patched version. For SIMOTION SCOUT TIA versions V5.4 SP1 through V5.6 SP1, update to a patched version. For SINAMICS Startdrive versions V16 through V19, update to a patched version. For SIRIUS Safety ES versions V17 through V19, update to a patched version. For SIRIUS Soft Starter ES versions V17 through V19, update to a patched version. For TIA Portal Cloud versions V16 through V19, update to a patched version. As a temporary workaround, consider restricting access to log file parsing functionality until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-11099

CVE-2024-49849

Affected Products

Simatic S7-Plcsim

Simatic Step 7

Simatic Step 7 Safety

Simatic Wincc

Simatic Wincc Unified

Simocode Es

Simotion Scout Tia

Sinamics Startdrive

Sirius Safety Es

Sirius Soft Starter Es

Tia Portal Cloud

References · 6

• https://bdu.fstec.ru/vul/2024-11099 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49849 · Security Note
• https://t.me/cvedetector/12508 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-800126.html · Note
• https://twitter.com/CVEnew/status/1866486777017418093 · Twitter Post
• https://twitter.com/CveFindCom/status/1866483847149265104 · Twitter Post