CVE-2020-7580 vulnerability in Siemens Products
Published on June 10, 2020

A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Upd3), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC ProSave (All versions < V17), SIMATIC S7-1500 Software Controller (All versions < V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMATIC STEP 7 V5 (All versions < V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions < V3.16 P018), SIMATIC WinCC OA V3.17 (All versions < V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions < V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 3), SINAMICS STARTER (All Versions < V5.4 HF2), SINAMICS Startdrive (All Versions < V16 Update 3), SINEC NMS (All versions < V1.0 SP2), SINEMA Server (All versions < V14 SP3), SINUMERIK ONE virtual (All Versions < V6.14), SINUMERIK Operate (All Versions < V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges.

NVD

Weakness Type

Unquoted Search Path or Element

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.

Products Associated with CVE-2020-7580

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-7580 are published in these products:

Siemens Simatic Net Pc

Siemens Simatic Pcs 7

Siemens Simatic Wincc

Siemens Simatic Wincc Runtime Advanced

Siemens Simatic Wincc Runtime Professional

Siemens Sinema Server

Siemens Simatic Automatic Tool

Siemens Simatic Pcs Neo

Siemens Simatic Prosave

Siemens Simatic Step 7

Siemens Simatic Wincc Open Architecture

Siemens Sinumerik Operate

Siemens Sinumerik One Virtual

Siemens Sinec Network Management System

Siemens Sinamics Startdrive

Siemens Sinamics Starter Commissioning Tool

Siemens Simatic S7 1500 Software Controller

Siemens Sinamics Starter

Siemens Sinec Nms

Affected Versions

Siemens SIMATIC Automation Tool:

Version All versions < V4 SP2 is affected.

Siemens SIMATIC NET PC Software V14:

Version All versions < V14 SP1 Update 14 is affected.

Siemens SIMATIC NET PC Software V15:

Version All versions is affected.

Siemens SIMATIC NET PC Software V16:

Version All versions < V16 Upd3 is affected.

Siemens SIMATIC PCS neo:

Version All versions < V3.0 SP1 is affected.

Siemens SIMATIC ProSave:

Version All versions < V17 is affected.

Siemens SIMATIC S7-1500 Software Controller:

Version All versions < V21.8 is affected.

Siemens SIMATIC STEP 7 (TIA Portal) V13:

Version All versions < V13 SP2 Update 4 is affected.

Siemens SIMATIC STEP 7 (TIA Portal) V14:

Version All versions < V14 SP1 Update 10 is affected.

Siemens SIMATIC STEP 7 (TIA Portal) V15:

Version All versions < V15.1 Update 5 is affected.

Siemens SIMATIC STEP 7 (TIA Portal) V16:

Version All versions < V16 Update 2 is affected.

Siemens SIMATIC STEP 7 V5:

Version All versions < V5.6 SP2 HF3 is affected.

Siemens SIMATIC WinCC OA V3.16:

Version All versions < V3.16 P018 is affected.

Siemens SIMATIC WinCC OA V3.17:

Version All versions < V3.17 P003 is affected.

Siemens SIMATIC WinCC Runtime Advanced:

Version All versions < V16 Update 2 is affected.

Siemens SIMATIC WinCC Runtime Professional V13:

Version All versions < V13 SP2 Update 4 is affected.

Siemens SIMATIC WinCC Runtime Professional V14:

Version All versions < V14 SP1 Update 10 is affected.

Siemens SIMATIC WinCC Runtime Professional V15:

Version All versions < V15.1 Update 5 is affected.

Siemens SIMATIC WinCC Runtime Professional V16:

Version All versions < V16 Update 2 is affected.

Siemens SIMATIC WinCC V7.4:

Version All versions < V7.4 SP1 Update 14 is affected.

Siemens SIMATIC WinCC V7.5:

Version All versions < V7.5 SP1 Update 3 is affected.

Siemens SINAMICS STARTER:

Version All Versions < V5.4 HF2 is affected.

Siemens SINAMICS Startdrive:

Version All Versions < V16 Update 3 is affected.

Siemens SINEC NMS:

Version All versions < V1.0 SP2 is affected.

Siemens SINEMA Server:

Version All versions < V14 SP3 is affected.

Siemens SINUMERIK ONE virtual:

Version All Versions < V6.14 is affected.

Siemens SINUMERIK Operate:

Version All Versions < V6.14 is affected.

Exploit Probability

EPSS

0.05%

Percentile

15.22%