Siemens SIMATIC SCADA/PCS 7 RCE Vulnerability Advisory (SSA-629254)

Key Information Vulnerability Description Vulnerability ID: SSA-629254 Vulnerability Type: Remote Code Execution Vulnerability Affected Products: SIMATIC SCADA and PCS 7 systems CVSS v3.1 Base Score: 9.1 CVSS v4.0 Base Score: 9.4 Affected Scope Affected Products and Versions: - SIMATIC BATCH V9.1 - SIMATIC Information Server - SIMATIC PCS 7 - SIMATIC Process Historian - SIMATIC WinCC Runtime Professional - SIMATIC WinCC V7/V8 Remediation SIMATIC BATCH V9.1: No remediation available at this time. SIMATIC Information Server: No remediation available at this time. SIMATIC PCS 7: Upgrade WinCC to V7.5 SP2 Update 18 or later. SIMATIC Process Historian: No remediation available at this time. SIMATIC WinCC Runtime Professional: No remediation available at this time. SIMATIC WinCC V7/V8: See details. Workarounds and Mitigations Refer to the general security recommendations in the Affected Products and Remediation section. General Security Recommendations It is recommended to operate devices within a protected IT environment and follow industrial security operational guidelines (download: ). Product Description Describes all vulnerabilities addressed in this security advisory (CVE-IDs). Acknowledgments Thanks to Tim Dijkman from Powerspex for reporting this vulnerability. Additional Information For further inquiries regarding security vulnerabilities, contact Siemens ProductCERT: . Version History V1.0 (2024-09-10): Release date Terms and Use Siemens Security Advisories are subject to Siemens’ license terms or any other applicable agreements previously entered into with Siemens. Where applicable, the terms of the Siemens Security Advisory, the terms of use of the Siemens global website (), and the terms specifically applicable to clauses 8–10, shall apply to information, software, or documentation. In case of conflict, license terms shall take precedence over terms of use.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SIMATIC SCADA/PCS 7 RCE Vulnerability Advisory (SSA-629254)