{"Vulnerability in Siemens Products Could Allow Arbitrary Code Execution"}
CVE-2024-49849

7.8HIGH

Key Information:

Vendor

Siemens
Status
Simatic S7-plcsim V16
Simatic S7-plcsim V17
Simatic Step 7 Safety V16
Simatic Step 7 Safety V17
Vendor
CVE Published:
10 December 2024

What is CVE-2024-49849?

A vulnerability has been identified across multiple versions and products within Siemens' SIMATIC and TIA Portal lines. The flaw involves inadequate sanitization of user-controllable input when parsing log files, potentially allowing an attacker to exploit this weakness. This exploitation may lead to type confusion and the execution of arbitrary code within the affected applications, compromising operational integrity and security.

Affected Version(s)

SIMATIC S7-PLCSIM V16 0

SIMATIC S7-PLCSIM V17 0

SIMATIC STEP 7 Safety V16 0

References

https://cert-portal.siemens.com/productcert/html/ssa-8001...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-49849 : {"Vulnerability in Siemens Products Could Allow Arbitrary Code Execution"}