-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19

Publication Date:        2024-07-09
Last Update:             2024-07-09
Current Version:         1.0
CVSS v3.1 Base Score:    6.3
CVSS v4.0 Base Score:    7.0



SUMMARY
=======

Affected applications do not properly restrict the .NET
BinaryFormatter when deserializing user-controllable input. This could
allow an attacker to cause a type confusion and execute arbitrary code
within the affected application.

Siemens has released a new version for SIMATIC STEP 7 Safety V18 and
recommends to update to the latest version.


AFFECTED PRODUCTS AND SOLUTION
==============================
        
 * Totally Integrated Automation Portal (TIA Portal):

     - Remediation:
         Update to V18 Update 2 or later version
         See further recommendations from section "Workarounds and Mitigations"
     - Download:
         https://support.industry.siemens.com/cs/ww/en/view/109817218/


     * Totally Integrated Automation Portal (TIA Portal) V18:

         - Remediation:
                 Update to V18 Update 2 or later version
                 See further recommendations from section "Workarounds and Mitigations"
         - Download:
                 https://support.industry.siemens.com/cs/ww/en/view/109817218/


         * SIMATIC STEP 7 Safety V18:
             - Affected versions:
                         All versions < V18 Update 2

             - Remediation:
                         Update to V18 Update 2 or later version
                         See further recommendations from section "Workarounds and Mitigations"
             - Download:
                         https://support.industry.siemens.com/cs/ww/en/view/109817218/

    

WORKAROUNDS AND MITIGATIONS
===========================

Siemens has identified the following specific workarounds and mitigations that
customers can apply to reduce the risk:

  * Avoid uploading PLC software from untrusted devices or MMC cards

Product-specific remediations or mitigations can be found in the section
"Affected Products and Solution".

Please follow the "General Security Recommendations".

GENERAL SECURITY RECOMMENDATIONS
================================

As a general security measure, Siemens strongly recommends to protect
network access to devices with appropriate mechanisms. In order to
operate the devices in a protected IT environment, Siemens recommends
to configure the environment according to Siemens' operational
guidelines for Industrial Security (Download:

https://www.siemens.com/cert/operational-guidelines-industrial-
security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found
at: https://www.siemens.com/industrialsecurity


PRODUCT DESCRIPTION
===================

SIPLUS extreme products are designed for reliable operation under
extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS,
SIMOTION, SCALANCE or other devices. SIPLUS devices use the same
firmware as the product they are based on.

Totally Integrated Automation Portal (TIA Portal) is a PC software
that provides access to the complete range of Siemens digitalized
automation services, from digital planning and integrated engineering
to transparent operation.

VULNERABILITY DESCRIPTION
=========================

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.
Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.


* Vulnerability CVE-2023-32737

  Affected applications do not properly restrict the .NET
  BinaryFormatter when deserializing user-controllable input. This
  could allow an attacker to cause a type confusion and execute
  arbitrary code within the affected application.

    This is the same issue that exists for .NET BinaryFormatter
  https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.

    CVSS v3.1 Base Score: 6.3
    CVSS Vector:          CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
    CVSS v4.0 Base Score: 7.0
    CVSS Vector:          CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    CWE:                  CWE-502: Deserialization of Untrusted Data


ADDITIONAL INFORMATION
======================

For further inquiries on security vulnerabilities in Siemens products and
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2024-07-09): Publication Date

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.

Copyright: Siemens 2024
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEch+g+vCfo0skv7l6x5aGHHWng/oFAmaMfYAACgkQx5aGHHWn
g/q2Eg//Xcdurugorqq6oGnxfVKgQNIucY66TLWSywFjo+v8EujF9w/QiDuwc3qY
UvVuDFnrBza0fM4+qMgZSDtkOa+uxVqET73/b52cdii5i8cocrQtwLs0GBMfnvVk
GWOiKLNhpCKq6apYveB7cJFUcNQhNRFBEGymddikjlmzCijoLNvS9bwWJGnWmgQS
1yUblGcLLgoWyr02wl9nzrlJRZvZllaM3WJegqK6U4PjBTjTzoekhV1k9tKUQB0p
lOdR5dauL8T/ifn3REolilq8pbmsYC1JNjbBmssYnFTHLwcqeYes57x6de/efdMu
k/hv/CIFNLaDX4EysZThl3LBaX9NVesD1DdFpTE0Zd/qP7vFMeEdGF1+gDLMoLLp
g+mCLCeukZ88CsLELZUJ6N6+YH8FngTUvZoYT7YbZG4FNxOvoPBTCqWwiqzRXSmC
kyG8z/he6PvojwWHXBOhPtLVqMiirQpemX9oCP842oKy0gtqGAatOx9jfaziEUaW
KPrIG1cP/RFeqPohhp7DXNSFm2AZ84LGdReV1rfjHP96EOs0PX3ZwLwdlitEJhof
P89RUH0G1hiUqcvVZ1s2FSsFH040UY4FwxkcyH8PGl8+v2bORHmX4v4svQqLJkmu
fHwIc74a9FEuVakHt15ahig2k3snJcWDU4zerQGAMbjLiCssLM4=
=Wxh9
-----END PGP SIGNATURE-----