CVE-2020-7587
Description
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending multiple specially crafted packets to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself. On some cases the vulnerability could leak random information from the remote service.
How to fix
- siemens opcenter_execution_discrete3.2 or later
- siemens opcenter_execution_foundation3.2 or later
- siemens opcenter_execution_process3.2 or later
- siemens opcenter_intelligence3.3 or later
- siemens opcenter_quality11.3 or later
- siemens simatic_it_lms2.6 or later
- siemens simatic_it_production_suite8.0 or later
- siemens simatic_pcs_neo3.0 or later
- siemens simatic_step_715.1 or later
- siemens simocode_es15.1 or later
- siemens soft_starter_es15.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens opcenter_execution_discrete | v < 3.2 | 3.2 |
| siemens opcenter_execution_foundation | v < 3.2 | 3.2 |
| siemens opcenter_execution_process | v < 3.2 | 3.2 |
| siemens opcenter_intelligence | v < 3.3 | 3.3 |
| siemens opcenter_quality | v < 11.3 | 11.3 |
| siemens opcenter_rd\&l | 8.0 | — |
| siemens simatic_it_lms | v < 2.6 | 2.6 |
| siemens simatic_it_production_suite | v < 8.0 | 8.0 |
| siemens simatic_notifier_server | No range specified | — |
| siemens simatic_pcs_neo | v < 3.0, 3.0 | 3.0 |
| siemens simatic_step_7 | 15 ≤ v < 15.1, 15.1, 16 | 15.1 |
| siemens simocode_es | v < 15.1, 15.1, 16 | 15.1 |
| siemens soft_starter_es | v < 15.1, 15.1 | 15.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.