SSA-825651 V1.0: Deserialization Vulnerability in SIMATIC STEP 7 (TIA Portal) before V18 Update 2

Risk Summary

<p>Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.</p> <p>Siemens has released a new version for SIMATIC STEP 7 (TIA Portal) V18 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.</p>

Remediations

• Refer to Siemens ProductCERT advisory for patch and remediation guidance.

Affected Vendors

Affected Products (1)