Vulnetix
Try Vulnetix Request Demo
SSA-800126 PUBLISHED CVSS 7.800000190734863 HIGH

Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter "Additional Information" below for more details.

Risk Scores

CVSS v3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected Products

VendorProductVersions
SIMOCODE ES V17
SIMATIC WinCC Unified V18
SIMATIC STEP 7 V17
SIMATIC STEP 7 V16
SIMATIC STEP 7 Safety V18
SIMOCODE ES V16
SIMATIC WinCC Unified V16
SIMATIC WinCC V18
SIMATIC WinCC V16
SIMATIC STEP 7 Safety V16
SIMATIC WinCC Unified V17
SIMATIC WinCC V19
SIMATIC STEP 7 Safety V17
SIMATIC WinCC V17
SIMATIC STEP 7 V18
SIMATIC STEP 7 Safety V19
SIMATIC STEP 7 V19
SIMATIC S7-PLCSIM V16
SIMATIC WinCC Unified V19
SIMATIC S7-PLCSIM V17

Timeline

References

Open in Interactive Console →