Vulnerability Details : CVE-2020-7580
A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Upd3), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC ProSave (All versions < V17), SIMATIC S7-1500 Software Controller (All versions < V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMATIC STEP 7 V5 (All versions < V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions < V3.16 P018), SIMATIC WinCC OA V3.17 (All versions < V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions < V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 3), SINAMICS STARTER (All Versions < V5.4 HF2), SINAMICS Startdrive (All Versions < V16 Update 3), SINEC NMS (All versions < V1.0 SP2), SINEMA Server (All versions < V14 SP3), SINUMERIK ONE virtual (All Versions < V6.14), SINUMERIK Operate (All Versions < V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges.
Vulnerability category: Execute code
Products affected by CVE-2020-7580
- cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update2:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update10:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update11:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update12:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update13:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update2:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update3:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update4:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update5:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update6:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update7:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update8:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc:7.4:sp1_update9:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_step_7:5.6:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_step_7:5.6:sp1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_step_7:5.6:sp2:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_step_7:5.6:sp2_hotfix1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc_open_architecture:3.16:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc_open_architecture:3.17:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinema_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_prosave:*:*:*:*:*:*:*:*
- Siemens » Simatic Wincc Runtime ProfessionalVersions from including (>=) 13 and up to, including, (<=) 16cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinumerik_operate:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_net_pc:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_net_pc:16:-:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_net_pc:16:update1:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_s7-1500_software_controller:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinec_network_management_system:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_automatic_tool:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinamics_startdrive:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinamics_starter_commissioning_tool:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:sinumerik_one_virtual:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-7580
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 15 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-7580
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
6.7
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
0.8
|
5.9
|
NIST |
CWE ids for CVE-2020-7580
-
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.Assigned by:
- nvd@nist.gov (Secondary)
- productcert@siemens.com (Primary)
References for CVE-2020-7580
-
https://cert-portal.siemens.com/productcert/pdf/ssa-312271.pdf
Vendor Advisory
-
https://us-cert.cisa.gov/ics/advisories/icsa-20-161-04
Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update E) | CISAThird Party Advisory;US Government Resource
Jump to