Siemens SIMATIC PCS 7 DLL uncontrolled search path

Summaryinfo

A vulnerability, which was classified as critical, has been found in Siemens SIMATIC PCS 7, SIMATIC PDM, SIMATIC STEP 7 and SINAMICS STARTER. Impacted is an unknown function of the component DLL Handler. This manipulation causes uncontrolled search path. This vulnerability is registered as CVE-2020-7585. The attack needs to be launched locally. No exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Siemens SIMATIC PCS 7, SIMATIC PDM, SIMATIC STEP 7 and SINAMICS STARTER (SCADA Software) (affected version unknown). It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component DLL Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF1). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information.

The weakness was published 06/10/2020. This vulnerability is known as CVE-2020-7585 since 01/21/2020. Attacking locally is a requirement. The successful exploitation needs a single authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

Applying a patch is able to eliminate this problem.

Similar entry is available at VDB-156536. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• SCADA Software

Vendor

• Siemens

Name

• SIMATIC PCS 7
• SIMATIC PDM
• SIMATIC STEP 7
• SINAMICS STARTER

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion