Resource exhaustion in Siemens products - CVE-2020-7587

Vulnerability identifier: #VU29945

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7587

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Opcenter Execution Discrete
Opcenter Execution Foundation
Opcenter Execution Process
Opcenter Intelligence
Opcenter Quality
SIMATIC IT LMS
SIMATIC IT Production Suite
SIMATIC Notifier Server for Windows
SIMOCODE ES
Opcenter RD&L
SIMATIC STEP 7 (TIA Portal)
SIMATIC PCS neo
Soft Starter ES

Install updates from vendor's website.

Opcenter Execution Discrete - update to 3.2
Opcenter Execution Foundation - update to 3.2
Opcenter Execution Process - update to 3.2
Opcenter Quality - update to 11.3
SIMATIC STEP 7 (TIA Portal) - update to 16.0 Update 2

• https://cert-portal.siemens.com/productcert/pdf/ssa-841348.pdf

• Multiple vulnerabilities in Siemens UMC Stack