Publication Date:
Last Update:
Current Version: V1.3
CVSS v3.1 Base Score: 7.8
Affected Product and Versions Remediation

All versions
Currently no fix is available

All versions
Currently no fix is planned

All versions
Currently no fix is planned

All versions
Currently no fix is available

All versions < V17 SP1

All versions
Currently no fix is available

All versions
Currently no fix is planned

All versions < V2022 SP1
In the context of SIMATIC PCS neo, update to SIMATIC PCS neo V4.1 or later version

All versions < V8.0

All versions < V18 Update 2
Update to V18 Update 2 or later version

All versions < V18.0 UPD 1 SR 1
Update to V18.0 UPD 1 SR 1 or later version

All versions
Currently no fix is available
  • Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to V1.04.405 or later if possible

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.
Please follow the General Security Recommendations.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Un-/Collapse All

The vulnerability classification has been performed by using the CVSS scoring system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS environmental score is specific to the customer’s environment and will impact the overall CVSS score. The environmental score should therefore be individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a community-developed list of common software security weaknesses. This serves as a common language and as a baseline for weakness identification, mitigation, and prevention efforts. A detailed list of CWE classes can be found at: https://cwe.mitre.org/.

CVSS v3.1 Base Score 7.8
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CWE CWE-20: Improper Input Validation

  • Michael Heinzl for coordinated disclosure

https://www.siemens.com/cert/advisories

V1.0 (2023-04-11): Publication Date
V1.1 (2023-06-13): Added fix for SIMATIC NET PC Software V17, clarified no fix planned for SIMATIC Process Historian 2020 OPC UA Server, SIMATIC NET PC Software V14 and V15
V1.2 (2023-08-08): Added fix for SIMATIC WinCC Runtime Professional
V1.3 (2023-11-14): Added fix for SIMATIC Process Historian 2022 OPC UA Server