CVE-2024-54678: SIMATIC PCS neo V4.1 0 to before *; +36 more affected products

Affected technology

SIMATIC PCS neo V4.1 · 0 to before *
Siemens

SIMATIC PCS neo V5.0 · 0 to before *
Siemens

SIMATIC PCS neo V6.0 · 0 to before V6.0 SP1 Update 1
Siemens

SIMATIC S7-PLCSIM V17 · 0 to before *
Siemens

SIMATIC STEP 7 V17 · 0 to before V17 Update 9
Siemens

SIMATIC STEP 7 V18 · 0 to before V18 Update 6
Siemens

SIMATIC STEP 7 V19 · 0 to before V19 Update 4
Siemens

SIMATIC STEP 7 V20 · 0 to before V20 Update 4
Siemens

SIMATIC WinCC V17 · 0 to before V17 Update 9
Siemens

SIMATIC WinCC V18 · 0 to before V18 Update 6
Siemens

SIMATIC WinCC V19 · 0 to before V19 Update 4
Siemens

SIMATIC WinCC V20 · 0 to before V20 Update 4
Siemens

SIMOCODE ES V17 · 0 to before *
Siemens

SIMOCODE ES V18 · 0 to before *
Siemens

SIMOCODE ES V19 · 0 to before *
Siemens

SIMOCODE ES V20 · 0 to before *
Siemens

SIMOTION SCOUT TIA V5.4 · 0 to before *
Siemens

SIMOTION SCOUT TIA V5.5 · 0 to before *
Siemens

SIMOTION SCOUT TIA V5.6 · 0 to before V5.6 SP1 HF7
Siemens

SIMOTION SCOUT TIA V5.7 · 0 to before *
Siemens

SINAMICS Startdrive V17 · 0 to before *
Siemens

SINAMICS Startdrive V18 · 0 to before *
Siemens

SINAMICS Startdrive V19 · 0 to before *
Siemens

SINAMICS Startdrive V20 · 0 to before *
Siemens

SIRIUS Safety ES V17 (TIA Portal) · 0 to before *
Siemens

SIRIUS Safety ES V18 (TIA Portal) · 0 to before *
Siemens

SIRIUS Safety ES V19 (TIA Portal) · 0 to before *
Siemens

SIRIUS Safety ES V20 (TIA Portal) · 0 to before *
Siemens

SIRIUS Soft Starter ES V17 (TIA Portal) · 0 to before *
Siemens

SIRIUS Soft Starter ES V18 (TIA Portal) · 0 to before *
Siemens

SIRIUS Soft Starter ES V19 (TIA Portal) · 0 to before *
Siemens

SIRIUS Soft Starter ES V20 (TIA Portal) · 0 to before *
Siemens

TIA Portal Cloud V17 · 0 to before *
Siemens

TIA Portal Cloud V18 · 0 to before V6.3.0.2
Siemens

TIA Portal Cloud V19 · 0 to before V5.2.1.1
Siemens

TIA Portal Cloud V20 · 0 to before V5.2.2.2
Siemens

TIA Portal Test Suite V20 · 0 to before V20 Update 4
Siemens

Description’s affected range: versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STE

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · Low privileges required · Passive user interaction

What an attacker can do

An authenticated local attacker could cause a type confusion and execute arbitrary code within the affected application. Vendor/CNA’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality, integrity and availability impact as high.