CVE-2022-45147
Description
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.
How to fix
- Siemens SIMATIC STEP 7 V18V18 Update 2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens SIMATIC PCS neo V4.0 | 0 | — |
| Siemens SIMATIC STEP 7 V16 | 0 | — |
| Siemens SIMATIC STEP 7 V17 | 0 | — |
| Siemens SIMATIC STEP 7 V18 | v < V18 Update 2 | V18 Update 2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.