Local Code Execution Vulnerability in SIMATIC Automation Tools by Siemens

CVE-2020-7580

Summary

A vulnerability has been identified in various Siemens SIMATIC applications that allows a local attacker to execute arbitrary code with SYSTEM privileges. This issue arises because a common component frequently invokes a helper binary without properly quoting the call path, which may lead to unintended code execution with elevated privileges. Affected applications span across several SIMATIC products, including but not limited to the Automation Tool, PROsave, Step 7, and WinCC, highlighting a significant concern for users. It is imperative for organizations using these software versions to update to secure versions to mitigate this risk.

References