Uncontrolled resource consumption in Siemens Opcenter Execution Discrete
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending multiple specially crafted packets to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself. On some cases the vulnerability could leak random information from the remote service.
Why it matters now
EPSS 0.02484 84th percentileScored 2026-11-07
Fix Fixed Opcenter Execution Discrete (Siemens): V3.2Opcenter Execution Foundation (Siemens): V3.2+5 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Opcenter Execution Discrete | before V3.2 | V3.2 | Patch available | CNA |
| Siemens | Opcenter Execution Foundation | before V3.2 | V3.2 | Patch available | CNA |
| Siemens | Opcenter Execution Process | before V3.2 | V3.2 | Patch available | CNA |
| Siemens | Opcenter Intelligence | before V3.3 | V3.3 | Patch available | CNA |
| Siemens | Opcenter Quality | before V11.3 | V11.3 | Patch available | CNA |
| Siemens | Opcenter RD&L | V8.0 | — | No fix listed | CNA |
| Siemens | SIMATIC IT LMS | before V2.6 | V2.6 | Patch available | CNA |
| Siemens | SIMATIC IT Production Suite | before V8.0 | V8.0 | Patch available | CNA |
| Siemens | SIMATIC Notifier Server for Windows | All versions | — | No fix listed | CNA |
| Siemens | SIMATIC PCS neo | All versions < V3.0 SP1 | — | No fix listed | CNA |
| Siemens | SIMATIC STEP 7 (TIA Portal) V15 | All versions < V15.1 Update 5 | — | No fix listed | CNA |
| Siemens | SIMATIC STEP 7 (TIA Portal) V16 | All versions < V16 Update 2 | — | No fix listed | CNA |
| Siemens | SIMOCODE ES V15.1 | All versions < V15.1 Update 4 | — | No fix listed | CNA |
| Siemens | SIMOCODE ES V16 | All versions < V16 Update 1 | — | No fix listed | CNA |
| Siemens | Soft Starter ES V15.1 | All versions < V15.1 Update 3 | — | No fix listed | CNA |
| Siemens | Soft Starter ES V16 | All versions < V16 Update 1 | — | No fix listed | CNA |
- Opcenter Execution Discrete VendorSiemens Affected before V3.2 Fixed in V3.2 Patch available CNA
- Opcenter Execution Foundation VendorSiemens Affected before V3.2 Fixed in V3.2 Patch available CNA
- Opcenter Execution Process VendorSiemens Affected before V3.2 Fixed in V3.2 Patch available CNA
- Opcenter Intelligence VendorSiemens Affected before V3.3 Fixed in V3.3 Patch available CNA
- Opcenter Quality VendorSiemens Affected before V11.3 Fixed in V11.3 Patch available CNA
- Opcenter RD&L VendorSiemens Affected V8.0 Fixed in — No fix listed CNA
- SIMATIC IT LMS VendorSiemens Affected before V2.6 Fixed in V2.6 Patch available CNA
- SIMATIC IT Production Suite VendorSiemens Affected before V8.0 Fixed in V8.0 Patch available CNA
- SIMATIC Notifier Server for Windows VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIMATIC PCS neo VendorSiemens Affected All versions < V3.0 SP1 Fixed in — No fix listed CNA
- SIMATIC STEP 7 (TIA Portal) V15 VendorSiemens Affected All versions < V15.1 Update 5 Fixed in — No fix listed CNA
- SIMATIC STEP 7 (TIA Portal) V16 VendorSiemens Affected All versions < V16 Update 2 Fixed in — No fix listed CNA
- SIMOCODE ES V15.1 VendorSiemens Affected All versions < V15.1 Update 4 Fixed in — No fix listed CNA
- SIMOCODE ES V16 VendorSiemens Affected All versions < V16 Update 1 Fixed in — No fix listed CNA
- Soft Starter ES V15.1 VendorSiemens Affected All versions < V15.1 Update 3 Fixed in — No fix listed CNA
- Soft Starter ES V16 VendorSiemens Affected All versions < V16 Update 1 Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:opcenter_execution_discrete:*:*:*:*:*:*:*:* | before 3.2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:opcenter_execution_foundation:*:*:*:*:*:*:*:* | before 3.2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:opcenter_execution_process:*:*:*:*:*:*:*:* | before 3.2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* | before 3.3 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:opcenter_quality:*:*:*:*:*:*:*:* | before 11.3 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:opcenter_rd\&l:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_it_lms:*:*:*:*:*:*:*:* | before 2.6 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_it_production_suite:*:*:*:*:*:*:*:* | before 8.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_notifier_server:*:*:*:*:*:windows:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:opcenter_execution_discrete:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:opcenter_execution_foundation:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:opcenter_execution_process:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* Versions before 3.3 Vulnerable ·Siemens
- cpe:2.3:a:siemens:opcenter_quality:*:*:*:*:*:*:*:* Versions before 11.3 Vulnerable ·Siemens
- cpe:2.3:a:siemens:opcenter_rd\&l:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_it_lms:*:*:*:*:*:*:*:* Versions before 2.6 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_it_production_suite:*:*:*:*:*:*:*:* Versions before 8.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_notifier_server:*:*:*:*:*:windows:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Siemens
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:simatic_pcs_neo:3.0:-:*:*:*:*:*:* | 3.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:* | 15 to before 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_step_7:15.1:-:*:*:*:*:*:* | 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_step_7:16:-:*:*:*:*:*:* | 16 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simatic_step_7:16:update1:*:*:*:*:*:* | 16 update1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simocode_es:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simocode_es:15.1:-:*:*:*:*:*:* | 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:simocode_es:16:-:*:*:*:*:*:* | 16 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:soft_starter_es:*:*:*:*:*:*:*:* | before 15.1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:soft_starter_es:15.1:-:*:*:*:*:*:* | 15.1 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:simatic_pcs_neo:3.0:-:*:*:*:*:*:* Versions 3.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:* Versions 15 to before 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_step_7:15.1:-:*:*:*:*:*:* Versions 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_step_7:16:-:*:*:*:*:*:* Versions 16 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simatic_step_7:16:update1:*:*:*:*:*:* Versions 16 update1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simocode_es:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simocode_es:15.1:-:*:*:*:*:*:* Versions 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:simocode_es:16:-:*:*:*:*:*:* Versions 16 Vulnerable ·Siemens
- cpe:2.3:a:siemens:soft_starter_es:*:*:*:*:*:*:*:* Versions before 15.1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:soft_starter_es:15.1:-:*:*:*:*:*:* Versions 15.1 Vulnerable ·Siemens
Remediation
- Fix · CNA Opcenter Execution Discrete (Siemens) Fixed in V3.2
- Fix · CNA Opcenter Execution Foundation (Siemens) Fixed in V3.2
- Fix · CNA Opcenter Execution Process (Siemens) Fixed in V3.2
- Fix · CNA Opcenter Intelligence (Siemens) Fixed in V3.3
- Fix · CNA Opcenter Quality (Siemens) Fixed in V11.3
- Fix · CNA SIMATIC IT LMS (Siemens) Fixed in V2.6
- Fix · CNA SIMATIC IT Production Suite (Siemens) Fixed in V8.0
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7587
- 2026-10-03 Alias added: GHSA-pjx6-jj7c-74m7
References
More Siemens Opcenter Execution Discrete vulnerabilities
- TI-2020-06104 A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2)… CVSS 3.1MEDIUM 6.7
- TI-2020-06110 Improper input validation in Siemens Opcenter Execution Discrete CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-7587 · CVE Program
- CVE-2020-7587 · NVD
- FIRST EPSS
- GHSA-pjx6-jj7c-74m7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences