TI-2023-11164 Aliases CVE-2023-25910 GHSA-5wm3-c83x-cqpq

Code injection in Siemens SIMATIC PCS 7

MEDIUM 45CWE-94Published 2023-06-13 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7-PM (All versions < V5.7 SP2 HF1), SIMATIC STEP 7 V5 (All versions < V5.7). The affected product contains a database management system that could allow remote users with low privileges to use embedded functions of the database (local or in a network share) that have impact on the server. An attacker with network access to the server network could leverage these embedded functions to run code with elevated privileges in the database management system's server.

Why it matters now

EPSS 0.01 63rd percentileScored 2026-11-07

Fix Fixed SIMATIC PCS 7 (Siemens): V9.1 SP2 UC04SIMATIC S7-PM (Siemens): V5.7 SP1 HF1, V5.7 SP2 HF1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	SIMATIC PCS 7	before V9.1 SP2 UC04	V9.1 SP2 UC04	Patch available	CNA
Siemens	SIMATIC S7-PM	before V5.7 SP1 HF1	V5.7 SP1 HF1	Patch available	CNA
Siemens	SIMATIC S7-PM	before V5.7 SP2 HF1	V5.7 SP2 HF1	Patch available	CNA
Siemens	SIMATIC STEP 7 V5	before V5.7	V5.7	Patch available	CNA

SIMATIC PCS 7 VendorSiemens Affected before V9.1 SP2 UC04 Fixed in V9.1 SP2 UC04 Patch available CNA
SIMATIC S7-PM VendorSiemens Affected before V5.7 SP1 HF1 Fixed in V5.7 SP1 HF1 Patch available CNA
SIMATIC S7-PM VendorSiemens Affected before V5.7 SP2 HF1 Fixed in V5.7 SP2 HF1 Patch available CNA
SIMATIC STEP 7 V5 VendorSiemens Affected before V5.7 Fixed in V5.7 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:simatic_pcs_7::::::::	all versions	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_s7-pm::::::::	all versions	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_step_7::::::::	before 5.7	Vulnerable	Siemens

cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_s7-pm:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:* Versions before 5.7 Vulnerable ·Siemens

Remediation

Fix · CNA SIMATIC PCS 7 (Siemens) Fixed in V9.1 SP2 UC04
Fix · CNA SIMATIC S7-PM (Siemens) Fixed in V5.7 SP1 HF1
Fix · CNA SIMATIC S7-PM (Siemens) Fixed in V5.7 SP2 HF1
Fix · CNA SIMATIC STEP 7 V5 (Siemens) Fixed in V5.7

Timeline

2026-10-02 Threatist record created from CVE-2023-25910
2026-10-03 Alias added: GHSA-5wm3-c83x-cqpq

References

Patch 1

https://cert-portal.siemens.com/productcert/pdf/ssa-968170.pdf

Other 1

https://cert-portal.siemens.com/productcert/html/ssa-968170.html

TI-2014-07026 The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3… CVSS 2.0HIGH 10.0
TI-2019-08143 Missing authentication in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1CRITICAL 9.8
TI-2021-17429 Path traversal in Siemens SIMATIC PCS 7 V8.2 CVSS 3.1CRITICAL 9.9
TI-2019-08139 A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions)… CVSS 3.1HIGH 8.8
TI-2019-08137 SQL injection in Siemens SIMATIC PCS 7 V8.0 and earlier CVSS 3.1HIGH 8.8
TI-2021-17431 Information disclosure in Siemens SIMATIC PCS 7 V8.2 CVSS 3.1HIGH 8.8

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences