ID
VAR-202508-3769
TITLE
Multiple SIEMENS product privilege escalation vulnerabilities
Trust: 0.6
DESCRIPTION
The SIMATIC Information Server is used for reporting and visualization of process data stored in the SIMATIC Process Historian. SIMATIC PDM MS provides independent field device management, diagnostics, and data acquisition across multiple communication protocols, independent of the automation project. The SIMATIC Process Historian is the long-term archiving system for SIMATIC PCS 7, SIMATIC WinCC, and SIMATIC PCS neo. It stores process values, alarms, and batch data from production plants in its database and provides historical process data for reporting and visualization applications. SIMATIC WinCC Open Architecture (OA) is part of the SIMATIC HMI family. It is designed for applications requiring a high degree of customer-specific adaptability, large or complex applications, and applications and projects with specific system requirements or functionality. Several SIEMENS products contain a privilege escalation vulnerability that could be exploited by an attacker to escalate privileges.
Trust: 0.6
IOT TAXONOMY
| category: | ['ICS'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | siemens | model: | simatic pdm maintenance station all | scope: | eq | version: | v5.0 | Trust: 0.6 |
| vendor: | siemens | model: | simatic process historian all | scope: | eq | version: | 2020 | Trust: 0.6 |
| vendor: | siemens | model: | simatic process historian all | scope: | eq | version: | 2022 | Trust: 0.6 |
| vendor: | siemens | model: | simatic process historian all | scope: | eq | version: | 2024 | Trust: 0.6 |
| vendor: | siemens | model: | simatic information server all | scope: | eq | version: | 2020 | Trust: 0.6 |
| vendor: | siemens | model: | simatic information server all | scope: | eq | version: | 2022 | Trust: 0.6 |
| vendor: | siemens | model: | simatic information server all | scope: | eq | version: | 2024 | Trust: 0.6 |
| vendor: | siemens | model: | simatic wincc oa p032 | scope: | eq | version: | v3.18<v3.18 | Trust: 0.6 |
| vendor: | siemens | model: | simatic wincc oa p020 | scope: | eq | version: | v3.19<v3.19 | Trust: 0.6 |
| vendor: | siemens | model: | simatic wincc oa p008 | scope: | eq | version: | v3.20<v3.20 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||
|
|
PATCH
| title: | Patch for Multiple SIEMENS product privilege escalation vulnerabilities | url: | https://www.cnvd.org.cn/patchInfo/show/723046 | Trust: 0.6 |
EXTERNAL IDS
| db: | SIEMENS | id: | SSA-331739 | Trust: 0.6 |
| db: | CNVD | id: | CNVD-2025-19351 | Trust: 0.6 |
REFERENCES
| url: | https://cert-portal.siemens.com/productcert/html/ssa-331739.html | Trust: 0.6 |
SOURCES
| db: | CNVD | id: | CNVD-2025-19351 |
LAST UPDATE DATE
2025-10-16T23:32:28.301000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-19351 | date: | 2025-08-22T00:00:00 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-19351 | date: | 2025-08-12T00:00:00 |