← Security Alerts

ICSA-24-347-05: Siemens Siemens Engineering Platforms

CISA advisory · released 2024-12-10

Source record Collected from CISA's CSAF advisory feed

CISA's summary

Summary: Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter "Additional Information" below for more details.

Products, as the advisory lists them

VendorProductVersion
SiemensSIMATIC S7-PLCSIM V16vers:all/*
SiemensSIMATIC S7-PLCSIM V17vers:all/*
SiemensSIMATIC STEP 7 Safety V16vers:all/*
SiemensSIMATIC STEP 7 Safety V17vers:all/*
SiemensSIMATIC STEP 7 Safety V18vers:all/*
SiemensSIMATIC STEP 7 Safety V19<V19_Update_4
SiemensSIMATIC STEP 7 V16vers:all/*
SiemensSIMATIC STEP 7 V17vers:all/*
SiemensSIMATIC STEP 7 V18vers:all/*
SiemensSIMATIC STEP 7 V19<V19_Update_4
SiemensSIMATIC WinCC Unified V16vers:all/*
SiemensSIMATIC WinCC Unified V17vers:all/*
SiemensSIMATIC WinCC Unified V18vers:all/*
SiemensSIMATIC WinCC Unified V19<V19_Update_4
SiemensSIMATIC WinCC V16vers:all/*
SiemensSIMATIC WinCC V17vers:all/*
SiemensSIMATIC WinCC V18vers:all/*
SiemensSIMATIC WinCC V19<V19_Update_4
SiemensSIMOCODE ES V16vers:all/*
SiemensSIMOCODE ES V17vers:all/*
SiemensSIMOCODE ES V18vers:all/*
SiemensSIMOCODE ES V19vers:all/*
SiemensSIMOTION SCOUT TIA V5.4vers:all/*
SiemensSIMOTION SCOUT TIA V5.5vers:all/*
SiemensSIMOTION SCOUT TIA V5.6<V5.6_SP1_HF7
SiemensSINAMICS Startdrive V16vers:all/*
SiemensSINAMICS Startdrive V17vers:all/*
SiemensSINAMICS Startdrive V18vers:all/*
SiemensSINAMICS Startdrive V19vers:all/*
SiemensSIRIUS Safety ES V17 (TIA Portal)vers:all/*
SiemensSIRIUS Safety ES V18 (TIA Portal)vers:all/*
SiemensSIRIUS Safety ES V19 (TIA Portal)vers:all/*
SiemensSIRIUS Soft Starter ES V17 (TIA Portal)vers:all/*
SiemensSIRIUS Soft Starter ES V18 (TIA Portal)vers:all/*
SiemensSIRIUS Soft Starter ES V19 (TIA Portal)vers:all/*
SiemensTIA Portal Cloud V16vers:all/*
SiemensTIA Portal Cloud V17vers:all/*
SiemensTIA Portal Cloud V18vers:all/*
SiemensTIA Portal Cloud V19vers:intdot/<5.2.1.1

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

Acknowledgments, as the advisory lists them

The advisory's legal notice

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Sources

DeSpy's copy of this version is dated 2026-09-28.

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.

Scope, sources and licences →