CVE-2024-35783
Description
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All versions < V2022 SP1 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC06), SIMATIC Process Historian 2020 (All versions < V2020 SP2 Update 5), SIMATIC Process Historian 2022 (All versions < V2022 SP1 Update 2), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 3), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 18), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products run their DB server with elevated privileges which could allow an authenticated attacker to execute arbitrary OS commands with administrative privileges.
How to fix
- Siemens SIMATIC Information Server 2020V2020 SP2 Update 5 or later
- Siemens SIMATIC Information Server 2022V2022 SP1 Update 2 or later
- Siemens SIMATIC PCS 7 V9.1V9.1 SP2 UC06 or later
- Siemens SIMATIC Process Historian 2020V2020 SP2 Update 5 or later
- Siemens SIMATIC Process Historian 2022V2022 SP1 Update 2 or later
- Siemens SIMATIC WinCC Runtime Professional V18V18 Update 5 or later
- Siemens SIMATIC WinCC Runtime Professional V19V19 Update 3 or later
- Siemens SIMATIC WinCC V7.5V7.5 SP2 Update 18 or later
- Siemens SIMATIC WinCC V8.0V8.0 Update 5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens SIMATIC BATCH V9.1 | 0 | — |
| Siemens SIMATIC Information Server 2020 | v < V2020 SP2 Update 5 | V2020 SP2 Update 5 |
| Siemens SIMATIC Information Server 2022 | v < V2022 SP1 Update 2 | V2022 SP1 Update 2 |
| Siemens SIMATIC PCS 7 V9.1 | v < V9.1 SP2 UC06 | V9.1 SP2 UC06 |
| Siemens SIMATIC Process Historian 2020 | v < V2020 SP2 Update 5 | V2020 SP2 Update 5 |
| Siemens SIMATIC Process Historian 2022 | v < V2022 SP1 Update 2 | V2022 SP1 Update 2 |
| Siemens SIMATIC WinCC Runtime Professional V18 | v < V18 Update 5 | V18 Update 5 |
| Siemens SIMATIC WinCC Runtime Professional V19 | v < V19 Update 3 | V19 Update 3 |
| Siemens SIMATIC WinCC V7.4 | 0 | — |
| Siemens SIMATIC WinCC V7.5 | v < V7.5 SP2 Update 18 | V7.5 SP2 Update 18 |
| Siemens SIMATIC WinCC V8.0 | v < V8.0 Update 5 | V8.0 Update 5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.