Remote Code Execution Vulnerability in Siemens SIMATIC Products

CVE-2019-10918

Summary

A remote code execution vulnerability has been identified in various versions of Siemens SIMATIC PCS 7 and WinCC products. An authenticated attacker with network access can exploit this vulnerability through the DCOM interface, enabling them to execute arbitrary commands with SYSTEM privileges. This can significantly compromise the confidentiality, integrity, and availability of the affected systems. Successful exploitation requires only low-privileged user credentials and eliminates the need for user interaction. As of the latest advisory publication, no public exploitation of this security vulnerability has been reported.

References