CVE-2024-35783: falha crítica em Siemens SIMATIC BATCH V9.1
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.4epss 0.6%
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All versions < V2022 SP1 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC06), SIMATIC Process Historian 2020 (All versions < V2020 SP2 Update 5), SIMATIC Process Historian 2022 (All versions < V2022 SP1 Update 2), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 3), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 18), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products run their DB server with elevated privileges which could allow an authenticated attacker to execute arbitrary OS commands with administrative privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Siemens · SIMATIC BATCH V9.1Siemens · SIMATIC Information Server 2020Siemens · SIMATIC Information Server 2022Siemens · SIMATIC PCS 7 V9.1Siemens · SIMATIC Process Historian 2020Siemens · SIMATIC Process Historian 2022Siemens · SIMATIC WinCC Runtime Professional V18Siemens · SIMATIC WinCC Runtime Professional V19Siemens · SIMATIC WinCC V7.4Siemens · SIMATIC WinCC V7.5Siemens · SIMATIC WinCC V8.0CVEs relacionadas — Siemens SIMATIC BATCH V9.1
No mesmo produto, das mais perigosas para as menos.