Input validation error in Siemens products - CVE-2020-7588

Vulnerability identifier: #VU29948

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7588

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Opcenter Execution Discrete
Opcenter Execution Foundation
Opcenter Execution Process
Opcenter Intelligence
Opcenter Quality
SIMATIC IT LMS
SIMATIC IT Production Suite
SIMATIC Notifier Server for Windows
SIMOCODE ES
Opcenter RD&L
SIMATIC STEP 7 (TIA Portal)
SIMATIC PCS neo
Soft Starter ES

Install updates from vendor's website.

Opcenter Execution Discrete - update to 3.2
Opcenter Execution Foundation - update to 3.2
Opcenter Execution Process - update to 3.2
Opcenter Quality - update to 11.3
SIMATIC STEP 7 (TIA Portal) - update to 16.0 Update 2

• https://cert-portal.siemens.com/productcert/pdf/ssa-841348.pdf

• Multiple vulnerabilities in Siemens UMC Stack