Read the docs
TI-2020-06110 Aliases CVE-2020-7588GHSA-jgfm-rcjw-3pmx

Improper input validation in Siemens Opcenter Execution Discrete

Priority LOW 28CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending a specially crafted packet to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself.

Why it matters now

EPSS 0.02151 82nd percentileScored 2026-11-07
Fix Fixed Opcenter Execution Discrete (Siemens): V3.2Opcenter Execution Foundation (Siemens): V3.2+5 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensOpcenter Execution Discretebefore V3.2V3.2Patch availableCNA
SiemensOpcenter Execution Foundationbefore V3.2V3.2Patch availableCNA
SiemensOpcenter Execution Processbefore V3.2V3.2Patch availableCNA
SiemensOpcenter Intelligencebefore V3.3V3.3Patch availableCNA
SiemensOpcenter Qualitybefore V11.3V11.3Patch availableCNA
SiemensOpcenter RD&LV8.0—No fix listedCNA
SiemensSIMATIC IT LMSbefore V2.6V2.6Patch availableCNA
SiemensSIMATIC IT Production Suitebefore V8.0V8.0Patch availableCNA
SiemensSIMATIC Notifier Server for WindowsAll versions—No fix listedCNA
SiemensSIMATIC PCS neoAll versions < V3.0 SP1—No fix listedCNA
SiemensSIMATIC STEP 7 (TIA Portal) V15All versions < V15.1 Update 5—No fix listedCNA
SiemensSIMATIC STEP 7 (TIA Portal) V16All versions < V16 Update 2—No fix listedCNA
SiemensSIMOCODE ES V15.1All versions < V15.1 Update 4—No fix listedCNA
SiemensSIMOCODE ES V16All versions < V16 Update 1—No fix listedCNA
SiemensSoft Starter ES V15.1All versions < V15.1 Update 3—No fix listedCNA
SiemensSoft Starter ES V16All versions < V16 Update 1—No fix listedCNA
  • Opcenter Execution Discrete VendorSiemens Affected before V3.2 Fixed in V3.2 Patch available CNA
  • Opcenter Execution Foundation VendorSiemens Affected before V3.2 Fixed in V3.2 Patch available CNA
  • Opcenter Execution Process VendorSiemens Affected before V3.2 Fixed in V3.2 Patch available CNA
  • Opcenter Intelligence VendorSiemens Affected before V3.3 Fixed in V3.3 Patch available CNA
  • Opcenter Quality VendorSiemens Affected before V11.3 Fixed in V11.3 Patch available CNA
  • Opcenter RD&L VendorSiemens Affected V8.0 Fixed in — No fix listed CNA
  • SIMATIC IT LMS VendorSiemens Affected before V2.6 Fixed in V2.6 Patch available CNA
  • SIMATIC IT Production Suite VendorSiemens Affected before V8.0 Fixed in V8.0 Patch available CNA
  • SIMATIC Notifier Server for Windows VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC PCS neo VendorSiemens Affected All versions < V3.0 SP1 Fixed in — No fix listed CNA
  • SIMATIC STEP 7 (TIA Portal) V15 VendorSiemens Affected All versions < V15.1 Update 5 Fixed in — No fix listed CNA
  • SIMATIC STEP 7 (TIA Portal) V16 VendorSiemens Affected All versions < V16 Update 2 Fixed in — No fix listed CNA
  • SIMOCODE ES V15.1 VendorSiemens Affected All versions < V15.1 Update 4 Fixed in — No fix listed CNA
  • SIMOCODE ES V16 VendorSiemens Affected All versions < V16 Update 1 Fixed in — No fix listed CNA
  • Soft Starter ES V15.1 VendorSiemens Affected All versions < V15.1 Update 3 Fixed in — No fix listed CNA
  • Soft Starter ES V16 VendorSiemens Affected All versions < V16 Update 1 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:siemens:opcenter_execution_discrete:*:*:*:*:*:*:*:*before 3.2VulnerableSiemens
cpe:2.3:a:siemens:opcenter_execution_foundation:*:*:*:*:*:*:*:*before 3.2VulnerableSiemens
cpe:2.3:a:siemens:opcenter_execution_process:*:*:*:*:*:*:*:*before 3.2VulnerableSiemens
cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:opcenter_quality:*:*:*:*:*:*:*:*before 11.3VulnerableSiemens
cpe:2.3:a:siemens:opcenter_rd\&l:8.0:*:*:*:*:*:*:*8.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_it_lms:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:simatic_it_production_suite:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:simatic_notifier_server:*:*:*:*:*:windows:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
  • cpe:2.3:a:siemens:opcenter_execution_discrete:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:opcenter_execution_foundation:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:opcenter_execution_process:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:opcenter_quality:*:*:*:*:*:*:*:* Versions before 11.3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:opcenter_rd\&l:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_it_lms:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_it_production_suite:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_notifier_server:*:*:*:*:*:windows:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:*15 – 15.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_step_7:16:-:*:*:*:*:*:*16VulnerableSiemens
cpe:2.3:a:siemens:simatic_step_7:16:update_1:*:*:*:*:*:*16 update_1VulnerableSiemens
cpe:2.3:a:siemens:simocode_es:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:a:siemens:soft_starter_es:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
  • cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:* Versions 15 – 15.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_step_7:16:-:*:*:*:*:*:* Versions 16 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_step_7:16:update_1:*:*:*:*:*:* Versions 16 update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simocode_es:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:a:siemens:soft_starter_es:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens

Remediation

  • Fix · CNA Opcenter Execution Discrete (Siemens) Fixed in V3.2
  • Fix · CNA Opcenter Execution Foundation (Siemens) Fixed in V3.2
  • Fix · CNA Opcenter Execution Process (Siemens) Fixed in V3.2
  • Fix · CNA Opcenter Intelligence (Siemens) Fixed in V3.3
  • Fix · CNA Opcenter Quality (Siemens) Fixed in V11.3
  • Fix · CNA SIMATIC IT LMS (Siemens) Fixed in V2.6
  • Fix · CNA SIMATIC IT Production Suite (Siemens) Fixed in V8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7588
  2. 2026-10-03 Alias added: GHSA-jgfm-rcjw-3pmx

References

Advisory 1

  • TI-2020-06109 Uncontrolled resource consumption in Siemens Opcenter Execution Discrete CVSS 3.1HIGH 8.2
  • TI-2020-06104 A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2)… CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences