Vulnerability · Published Sep 10, 2024 · Assigned by siemens
CVE-2024-35783
Critical 9.1
In plain English
A critical-severity security flaw in SIMATIC BATCH V9.1 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All versions < V2022 SP1 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC06), SIMATIC Process Historian 2020 (All versions < V2020 SP2 Update 5), SIMATIC Process Historian 2022 (All versions < V2022 SP1 Update 2), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 3), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 18), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products run their DB server with elevated privileges which could allow an authenticated attacker to execute arbitrary OS commands with administrative privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC BATCH V9.1 | 0 – before * |
| Siemens | SIMATIC Information Server 2020 | 0 – before V2020 SP2 Update 5 |
| Siemens | SIMATIC Information Server 2022 | 0 – before V2022 SP1 Update 2 |
| Siemens | SIMATIC PCS 7 V9.1 | 0 – before V9.1 SP2 UC06 |
| Siemens | SIMATIC Process Historian 2020 | 0 – before V2020 SP2 Update 5 |
| Siemens | SIMATIC Process Historian 2022 | 0 – before V2022 SP1 Update 2 |
| Siemens | SIMATIC WinCC Runtime Professional V18 | 0 – before V18 Update 5 |
| Siemens | SIMATIC WinCC Runtime Professional V19 | 0 – before V19 Update 3 |
| Siemens | SIMATIC WinCC V7.4 | 0 – before * |
| Siemens | SIMATIC WinCC V7.5 | 0 – before V7.5 SP2 Update 18 |
| Siemens | SIMATIC WinCC V8.0 | 0 – before V8.0 Update 5 |
Weakness: CWE-250 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C