A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). Legitimate file operations on the web server of the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read, write or delete unexpected critical files.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
SIMATIC PCS 7 V8.2
Vendor
Siemens
Product
SIMATIC PCS 7 V8.2
Platforms
Unknown
Default status
unknown
SIMATIC PCS 7 V8.2 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions
affected
Unavailable
Unavailable
Unavailable
None listed
SIMATIC PCS 7 V9.0
Vendor
Siemens
Product
SIMATIC PCS 7 V9.0
Platforms
Unknown
Default status
unknown
SIMATIC PCS 7 V9.0 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions < V9.0 SP3 UC04
affected
Unavailable
Unavailable
Unavailable
None listed
SIMATIC PCS 7 V9.1
Vendor
Siemens
Product
SIMATIC PCS 7 V9.1
Platforms
Unknown
Default status
unknown
SIMATIC PCS 7 V9.1 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions < V9.1 SP1
affected
Unavailable
Unavailable
Unavailable
None listed
SIMATIC WinCC V15 and earlier
Vendor
Siemens
Product
SIMATIC WinCC V15 and earlier
Platforms
Unknown
Default status
unknown
SIMATIC WinCC V15 and earlier · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions < V15 SP1 Update 7
affected
Unavailable
Unavailable
Unavailable
None listed
SIMATIC WinCC V16
Vendor
Siemens
Product
SIMATIC WinCC V16
Platforms
Unknown
Default status
unknown
SIMATIC WinCC V16 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions < V16 Update 5
affected
Unavailable
Unavailable
Unavailable
None listed
SIMATIC WinCC V17
Vendor
Siemens
Product
SIMATIC WinCC V17
Platforms
Unknown
Default status
unknown
SIMATIC WinCC V17 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions < V17 Update 2
affected
Unavailable
Unavailable
Unavailable
None listed
SIMATIC WinCC V7.4
Vendor
Siemens
Product
SIMATIC WinCC V7.4
Platforms
Unknown
Default status
unknown
SIMATIC WinCC V7.4 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions < V7.4 SP1 Update 19
affected
Unavailable
Unavailable
Unavailable
None listed
SIMATIC WinCC V7.5
Vendor
Siemens
Product
SIMATIC WinCC V7.5
Platforms
Unknown
Default status
unknown
SIMATIC WinCC V7.5 · Scoped product and version facts