Siemens SIMATIC Step 7 vulnerabilities

23 CVEs affecting Siemens SIMATIC Step 7, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-32736, published 2024-11-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-7587, published 2020-07-14. High severity, CVSS 8.2. EPSS: 2.5% chance of exploitation in the next 30 days. A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2),…
CVE-2020-7588, published 2020-07-14. Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2),…
CVE-2015-1601, published 2015-04-06. Medium severity, CVSS 6.8. EPSS: 1.4% chance of exploitation in the next 30 days. Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors.
CVE-2023-25910, published 2023-06-13. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7-PM (All versions < V5.7 SP2 HF1), SIMATIC STEP 7 V5 (All…
CVE-2019-10929, published 2019-08-13. Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU…
CVE-2015-1356, published 2015-02-18. Medium severity, CVSS 4.4. EPSS: 0.5% chance of exploitation in the next 30 days. Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish…
CVE-2020-7580, published 2020-06-10. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions),…
CVE-2012-3015, published 2012-07-26. Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days. Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse…
CVE-2020-7585, published 2020-06-10. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All…
CVE-2020-7586, published 2020-06-10. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All…

Latest

CVE-2023-32736, published 2024-11-12. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions <…
CVE-2023-32737, published 2024-07-09. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing…
CVE-2023-32735, published 2024-07-09. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATIC STEP 7 Safety V18 (All versions < V18…
CVE-2022-45147, published 2024-07-09. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2).…
CVE-2022-46141, published 2023-12-12. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker to gain access to the access level…
CVE-2021-42029, published 2022-04-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC STEP 7 (TIA Portal) V17 (All versions <…
CVE-2020-7581, published 2020-07-14. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2),…