Unquoted Search Path or Element in Siemens products - CVE-2020-7581

Vulnerability identifier: #VU29944

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7581

CWE-ID: CWE-428

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code on the target system. 

The vulnerability exist due to a component within the affected application calls a helper binary with SYSTEM privileges during startup while the call path is not quoted. A local administrator can execute arbitrary code with SYSTEM level privileges.

Opcenter Execution Discrete
Opcenter Execution Foundation
Opcenter Execution Process
Opcenter Intelligence
Opcenter Quality
SIMATIC IT LMS
SIMATIC IT Production Suite
SIMATIC Notifier Server for Windows
SIMOCODE ES
Opcenter RD&L
SIMATIC STEP 7 (TIA Portal)
SIMATIC PCS neo
Soft Starter ES

Install updates from vendor's website.

Opcenter Execution Discrete - update to 3.2
Opcenter Execution Foundation - update to 3.2
Opcenter Execution Process - update to 3.2
Opcenter Quality - update to 11.3
SIMATIC STEP 7 (TIA Portal) - update to 16.0 Update 2

• https://cert-portal.siemens.com/productcert/pdf/ssa-841348.pdf

• Multiple vulnerabilities in Siemens UMC Stack