{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2020-7580", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2020-7580", "idYear": 2020, "status": "PUBLISHED", "publishedAt": "2020-06-10T00:00:00.000Z", "updatedAt": "2024-08-04T09:33:19.492Z", "importedAt": "2026-10-24T01:56:21.187Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": null, "summary": "A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Upd3), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC ProSave (All versions < V17), SIMATIC S7-1500 Software Controller (All versions < V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMATIC STEP 7 V5 (All versions < V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions < V3.16 P018), SIMATIC WinCC OA V3.17 (All versions < V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions < V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 3), SINAMICS STARTER (All Versions < V5.4 HF2), SINAMICS Startdrive (All Versions < V16 Update 3), SINEC NMS (All versions < V1.0 SP2), SINEMA Server (All versions < V14 SP3), SINUMERIK ONE virtual (All Versions < V6.14), SINUMERIK Operate (All Versions < V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges.", "affected": [ { "vendor": "Siemens", "product": "SIMATIC Automation Tool", "versions": [ { "version": "All versions < V4 SP2", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC NET PC Software V14", "versions": [ { "version": "All versions < V14 SP1 Update 14", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC NET PC Software V15", "versions": [ { "version": "All versions", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC NET PC Software V16", "versions": [ { "version": "All versions < V16 Upd3", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC PCS neo", "versions": [ { "version": "All versions < V3.0 SP1", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC ProSave", "versions": [ { "version": "All versions < V17", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 Software Controller", "versions": [ { "version": "All versions < V21.8", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC STEP 7 (TIA Portal) V13", "versions": [ { "version": "All versions < V13 SP2 Update 4", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC STEP 7 (TIA Portal) V14", "versions": [ { "version": "All versions < V14 SP1 Update 10", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC STEP 7 (TIA Portal) V15", "versions": [ { "version": "All versions < V15.1 Update 5", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC STEP 7 (TIA Portal) V16", "versions": [ { "version": "All versions < V16 Update 2", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC STEP 7 V5", "versions": [ { "version": "All versions < V5.6 SP2 HF3", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC OA V3.16", "versions": [ { "version": "All versions < V3.16 P018", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC OA V3.17", "versions": [ { "version": "All versions < V3.17 P003", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC Runtime Advanced", "versions": [ { "version": "All versions < V16 Update 2", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC Runtime Professional V13", "versions": [ { "version": "All versions < V13 SP2 Update 4", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC Runtime Professional V14", "versions": [ { "version": "All versions < V14 SP1 Update 10", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC Runtime Professional V15", "versions": [ { "version": "All versions < V15.1 Update 5", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC Runtime Professional V16", "versions": [ { "version": "All versions < V16 Update 2", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC V7.4", "versions": [ { "version": "All versions < V7.4 SP1 Update 14", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SIMATIC WinCC V7.5", "versions": [ { "version": "All versions < V7.5 SP1 Update 3", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SINAMICS STARTER", "versions": [ { "version": "All Versions < V5.4 HF2", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SINAMICS Startdrive", "versions": [ { "version": "All Versions < V16 Update 3", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SINEC NMS", "versions": [ { "version": "All versions < V1.0 SP2", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SINEMA Server", "versions": [ { "version": "All versions < V14 SP3", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SINUMERIK ONE virtual", "versions": [ { "version": "All Versions < V6.14", "status": "affected" } ] }, { "vendor": "Siemens", "product": "SINUMERIK Operate", "versions": [ { "version": "All Versions < V6.14", "status": "affected" } ] } ] } } }