7.8
High
CVE-2022-45147 A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC…
Description
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SIMATIC PCS neo V4.0 | Versions not published | |
| SIMATIC STEP 7 V16 | Versions not published | |
| SIMATIC STEP 7 V17 | Versions not published | |
| SIMATIC STEP 7 V18 | Versions not published | |
| simatic_pcs_neo 4.0 | 4.0 → < 5.0 | 5.0 |
| simatic_step_7 18 | 18 → latest | No fix stated |
| simatic_step_7 17 | 17 → < 18 | 18 |
| simatic_step_7 16 | 16 → < 17 | 17 |
References
- cert-portal.siemens.com cert-portal.siemens.com
Timeline
- Published
- Last modified
Other CVEs of SIMATIC PCS neo V4.0
The 5 CVEs of SIMATIC PCS neo V4.0 →
CVE-2024-45386
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1…
8.8
High
CVE-2024-49775
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter…
9.8
Critical
CVE-2024-33698
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410),…
9.8
Critical
CVE-2023-28831
The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could…
7.5
High