Log in Start free

Vulnerability · Published Jul 14, 2020 · Assigned by siemens

CVE-2020-7587

High 8.2

In plain English

A high-severity uncontrolled resource consumption in Opcenter Execution Discrete from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).

Severity (CVSS NVD)8.2High
Exploit odds (30 days)2.5%top 15.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending multiple specially crafted packets to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself. On some cases the vulnerability could leak random information from the remote service.

Affected products (as reported)

VendorProductVersions
Siemens Opcenter Execution Discrete All versions < V3.2
Siemens Opcenter Execution Foundation All versions < V3.2
Siemens Opcenter Execution Process All versions < V3.2
Siemens Opcenter Intelligence All versions < V3.3
Siemens Opcenter Quality All versions < V11.3
Siemens Opcenter RD&L V8.0
Siemens SIMATIC IT LMS All versions < V2.6
Siemens SIMATIC IT Production Suite All versions < V8.0
Siemens SIMATIC Notifier Server for Windows All versions
Siemens SIMATIC PCS neo All versions < V3.0 SP1
Siemens SIMATIC STEP 7 (TIA Portal) V15 All versions < V15.1 Update 5
Siemens SIMATIC STEP 7 (TIA Portal) V16 All versions < V16 Update 2
Siemens SIMOCODE ES V15.1 All versions < V15.1 Update 4
Siemens SIMOCODE ES V16 All versions < V16 Update 1
Siemens Soft Starter ES V15.1 All versions < V15.1 Update 3
Siemens Soft Starter ES V16 All versions < V16 Update 1

Weakness: CWE-400

References