CVE-2020-7588
Description
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending a specially crafted packet to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself.
How to fix
- siemens opcenter_execution_discrete3.2 or later
- siemens opcenter_execution_foundation3.2 or later
- siemens opcenter_execution_process3.2 or later
- siemens opcenter_quality11.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens opcenter_execution_discrete | v < 3.2 | 3.2 |
| siemens opcenter_execution_foundation | v < 3.2 | 3.2 |
| siemens opcenter_execution_process | v < 3.2 | 3.2 |
| siemens opcenter_intelligence | No range specified | — |
| siemens opcenter_quality | v < 11.3 | 11.3 |
| siemens opcenter_rd\&l | 8.0 | — |
| siemens simatic_it_lms | No range specified | — |
| siemens simatic_it_production_suite | No range specified | — |
| siemens simatic_notifier_server | No range specified | — |
| siemens simatic_pcs_neo | No range specified | — |
| siemens simatic_step_7 | 15 ≤ v ≤ 15.1, 16 | — |
| siemens simocode_es | No range specified | — |
| siemens soft_starter_es | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.