VDB

CVE-2024-35783

CVE-2024-35783 PUBLISHED CVSS 9.100000381469727 CRITICAL

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 18), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products run their DB server with elevated privileges which could allow an authenticated attacker to execute arbitrary OS commands with administrative privileges.

EPSS 0.18% · 38.9th percentile

Risk Scores

CVSS v3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
EPSS Score
0.18%
38.9th percentile

Affected Products

VendorProductVersions
SiemensSIMATIC BATCH V9.10
siemenssimatic_wincc7.4, 8.0
SiemensSIMATIC Information Server 20220
SiemensSIMATIC Information Server 20200
SiemensSIMATIC Process Historian 20220
SiemensSIMATIC WinCC V7.50
SiemensSIMATIC WinCC Runtime Professional V190
SiemensSIMATIC WinCC V8.00
SiemensSIMATIC WinCC Runtime Professional V180
SiemensSIMATIC Process Historian 20200
SiemensSIMATIC WinCC V7.40
SiemensSIMATIC PCS 7 V9.10
siemenssimatic_batch0

Timeline

  • Sep 10, 2024 CVE Published
  • Sep 10, 2024 PoC Published
  • Sep 11, 2024 EPSS Score
  • Sep 14, 2024 PoC Published
  • Sep 15, 2024 PoC Published
  • Oct 1, 2024 EPSS Score
  • Oct 4, 2024 Coalition ESS Score
  • Oct 15, 2024 Coalition ESS Score
  • Oct 21, 2024 EPSS Score
  • Nov 9, 2024 EPSS Score
  • Nov 12, 2024 Coalition ESS Score
  • Nov 29, 2024 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›