CVE-2020-7585 — Vulnetix

CVE-2020-7585 PUBLISHED CVSS 7.800000190734863 HIGH

A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF1). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information.

EPSS 0.09% · 25.1th percentile

Risk Scores

CVSS 3.1

7.800000190734863

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.09%

25.1th percentile

Affected Products

Vendor	Product	Versions
siemens	simatic_step_7	5.6, 5.6, 5.6
Siemens	SINAMICS STARTER (containing STEP 7 OEM version)	All versions < V5.4 HF2
siemens	simatic_process_device_manager
Siemens	SIMATIC PCS 7 V8.2 and earlier	All versions
Siemens	SIMATIC PCS 7 V9.0	All versions < V9.0 SP3
Siemens	SIMATIC PDM	*
siemens	sinamics_starter	5.4, 0
siemens	simatic_pcs_7
Siemens	SIMATIC STEP 7 V5.X	All versions < V5.6 SP2 HF3

Exploit Intelligence

Timeline

Jun 9, 2020 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Oct 26, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 28, 2022 EPSS Score
Apr 1, 2022 EPSS Score
May 1, 2022 EPSS Score
Jul 3, 2022 EPSS Score
Sep 4, 2022 EPSS Score

References

Open in Interactive Console →