Read the docs
TI-2023-16001 Aliases CVE-2023-32735GHSA-27hg-xg89-rq4f

Deserialization of untrusted data in Siemens SIMATIC STEP 7 Safety V16

Priority LOW 32CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2), SIMATIC STEP 7 V16 (All versions < V16 Update 7), SIMATIC STEP 7 V17 (All versions < V17 Update 7), SIMATIC STEP 7 V18 (All versions < V18 Update 2), SIMATIC WinCC Unified V16 (All versions < V16 Update 7), SIMATIC WinCC Unified V17 (All versions < V17 Update 7), SIMATIC WinCC Unified V18 (All versions < V18 Update 2), SIMATIC WinCC V16 (All versions < V16.7), SIMATIC WinCC V17 (All versions < V17.7), SIMATIC WinCC V18 (All versions < V18 Update 2), SIMOCODE ES V16 (All versions < V16 Update 7), SIMOCODE ES V17 (All versions < V17 Update 7), SIMOCODE ES V18 (All versions < V18 Update 2), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SIRIUS Safety ES V17 (All versions < V17 Update 7), SIRIUS Safety ES V18 (All versions < V18 Update 2), SIRIUS Soft Starter ES V17 (All versions < V17 Update 7), SIRIUS Soft Starter ES V18 (All versions < V18 Update 2), Soft Starter ES V16 (All versions < V16 Update 7), TIA Portal Cloud V3.0 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing hardware configuration profiles. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed SIMATIC STEP 7 Safety V16 (Siemens): V16 Update 7SIMATIC STEP 7 Safety V17 (Siemens): V17 Update 7+19 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC STEP 7 Safety V16before V16 Update 7V16 Update 7Patch availableCNA
SiemensSIMATIC STEP 7 Safety V17before V17 Update 7V17 Update 7Patch availableCNA
SiemensSIMATIC STEP 7 Safety V18before V18 Update 2V18 Update 2Patch availableCNA
SiemensSIMATIC STEP 7 V16before V16 Update 7V16 Update 7Patch availableCNA
SiemensSIMATIC STEP 7 V17before V17 Update 7V17 Update 7Patch availableCNA
SiemensSIMATIC STEP 7 V18before V18 Update 2V18 Update 2Patch availableCNA
SiemensSIMATIC WinCC Unified V16before V16 Update 7V16 Update 7Patch availableCNA
SiemensSIMATIC WinCC Unified V17before V17 Update 7V17 Update 7Patch availableCNA
SiemensSIMATIC WinCC Unified V18before V18 Update 2V18 Update 2Patch availableCNA
SiemensSIMATIC WinCC V16before V16.7V16.7Patch availableCNA
SiemensSIMATIC WinCC V17before V17.7V17.7Patch availableCNA
SiemensSIMATIC WinCC V18before V18 Update 2V18 Update 2Patch availableCNA
SiemensSIMOCODE ES V16before V16 Update 7V16 Update 7Patch availableCNA
SiemensSIMOCODE ES V17before V17 Update 7V17 Update 7Patch availableCNA
SiemensSIMOCODE ES V18before V18 Update 2V18 Update 2Patch availableCNA
SiemensSIMOTION SCOUT TIA V5.4 SP1all versions—No fix listedCNA
SiemensSIMOTION SCOUT TIA V5.4 SP3all versions—No fix listedCNA
SiemensSIMOTION SCOUT TIA V5.5 SP1all versions—No fix listedCNA
SiemensSINAMICS Startdrive V16all versions—No fix listedCNA
SiemensSINAMICS Startdrive V17all versions—No fix listedCNA
SiemensSINAMICS Startdrive V18all versions—No fix listedCNA
SiemensSIRIUS Safety ES V17before V17 Update 7V17 Update 7Patch availableCNA
SiemensSIRIUS Safety ES V18before V18 Update 2V18 Update 2Patch availableCNA
SiemensSIRIUS Soft Starter ES V17before V17 Update 7V17 Update 7Patch availableCNA
SiemensSIRIUS Soft Starter ES V18before V18 Update 2V18 Update 2Patch availableCNA
SiemensSoft Starter ES V16before V16 Update 7V16 Update 7Patch availableCNA
SiemensTIA Portal Cloud V3.0before V18 Update 2V18 Update 2Patch availableCNA
  • SIMATIC STEP 7 Safety V16 VendorSiemens Affected before V16 Update 7 Fixed in V16 Update 7 Patch available CNA
  • SIMATIC STEP 7 Safety V17 VendorSiemens Affected before V17 Update 7 Fixed in V17 Update 7 Patch available CNA
  • SIMATIC STEP 7 Safety V18 VendorSiemens Affected before V18 Update 2 Fixed in V18 Update 2 Patch available CNA
  • SIMATIC STEP 7 V16 VendorSiemens Affected before V16 Update 7 Fixed in V16 Update 7 Patch available CNA
  • SIMATIC STEP 7 V17 VendorSiemens Affected before V17 Update 7 Fixed in V17 Update 7 Patch available CNA
  • SIMATIC STEP 7 V18 VendorSiemens Affected before V18 Update 2 Fixed in V18 Update 2 Patch available CNA
  • SIMATIC WinCC Unified V16 VendorSiemens Affected before V16 Update 7 Fixed in V16 Update 7 Patch available CNA
  • SIMATIC WinCC Unified V17 VendorSiemens Affected before V17 Update 7 Fixed in V17 Update 7 Patch available CNA
  • SIMATIC WinCC Unified V18 VendorSiemens Affected before V18 Update 2 Fixed in V18 Update 2 Patch available CNA
  • SIMATIC WinCC V16 VendorSiemens Affected before V16.7 Fixed in V16.7 Patch available CNA
  • SIMATIC WinCC V17 VendorSiemens Affected before V17.7 Fixed in V17.7 Patch available CNA
  • SIMATIC WinCC V18 VendorSiemens Affected before V18 Update 2 Fixed in V18 Update 2 Patch available CNA
  • SIMOCODE ES V16 VendorSiemens Affected before V16 Update 7 Fixed in V16 Update 7 Patch available CNA
  • SIMOCODE ES V17 VendorSiemens Affected before V17 Update 7 Fixed in V17 Update 7 Patch available CNA
  • SIMOCODE ES V18 VendorSiemens Affected before V18 Update 2 Fixed in V18 Update 2 Patch available CNA
  • SIMOTION SCOUT TIA V5.4 SP1 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOTION SCOUT TIA V5.4 SP3 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOTION SCOUT TIA V5.5 SP1 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Safety ES V17 VendorSiemens Affected before V17 Update 7 Fixed in V17 Update 7 Patch available CNA
  • SIRIUS Safety ES V18 VendorSiemens Affected before V18 Update 2 Fixed in V18 Update 2 Patch available CNA
  • SIRIUS Soft Starter ES V17 VendorSiemens Affected before V17 Update 7 Fixed in V17 Update 7 Patch available CNA
  • SIRIUS Soft Starter ES V18 VendorSiemens Affected before V18 Update 2 Fixed in V18 Update 2 Patch available CNA
  • Soft Starter ES V16 VendorSiemens Affected before V16 Update 7 Fixed in V16 Update 7 Patch available CNA
  • TIA Portal Cloud V3.0 VendorSiemens Affected before V18 Update 2 Fixed in V18 Update 2 Patch available CNA

CPE names CISA-ADP · 14

CPEVersionsRoleVendor
cpe:2.3:a:siemens:simatic_step_7_safety:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:simatic_wincc_unified:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:simocode_es:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:simotion_scout_tia:v5.4sp1:*:*:*:*:*:*:*v5.4sp1—Siemens
cpe:2.3:a:siemens:simotion_scout_tia:v5.4sp3:*:*:*:*:*:*:*v5.4sp3—Siemens
cpe:2.3:a:siemens:simotion_scout_tia:v5.5sp1:*:*:*:*:*:*:*v5.5sp1—Siemens
cpe:2.3:a:siemens:sinamics_startdrive:v17:*:*:*:*:*:*:*v17—Siemens
cpe:2.3:a:siemens:sinamics_startdrive:v18:*:*:*:*:*:*:*v18—Siemens
  • cpe:2.3:a:siemens:simatic_step_7_safety:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:simatic_step_7:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_unified:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:simocode_es:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:simotion_scout_tia:v5.4sp1:*:*:*:*:*:*:* Versions v5.4sp1 — ·Siemens
  • cpe:2.3:a:siemens:simotion_scout_tia:v5.4sp3:*:*:*:*:*:*:* Versions v5.4sp3 — ·Siemens
  • cpe:2.3:a:siemens:simotion_scout_tia:v5.5sp1:*:*:*:*:*:*:* Versions v5.5sp1 — ·Siemens
  • cpe:2.3:a:siemens:sinamics_startdrive:v17:*:*:*:*:*:*:* Versions v17 — ·Siemens
  • cpe:2.3:a:siemens:sinamics_startdrive:v18:*:*:*:*:*:*:* Versions v18 — ·Siemens
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:sirius_safety_es:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:sirius_soft_starter_es:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:soft_starter_es:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:tia_portal_cloud_v3.0:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:sirius_safety_es:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:sirius_soft_starter_es:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:soft_starter_es:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:tia_portal_cloud_v3.0:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA SIMATIC STEP 7 Safety V16 (Siemens) Fixed in V16 Update 7
  • Fix · CNA SIMATIC STEP 7 Safety V17 (Siemens) Fixed in V17 Update 7
  • Fix · CNA SIMATIC STEP 7 Safety V18 (Siemens) Fixed in V18 Update 2
  • Fix · CNA SIMATIC STEP 7 V16 (Siemens) Fixed in V16 Update 7
  • Fix · CNA SIMATIC STEP 7 V17 (Siemens) Fixed in V17 Update 7
  • Fix · CNA SIMATIC STEP 7 V18 (Siemens) Fixed in V18 Update 2
  • Fix · CNA SIMATIC WinCC Unified V16 (Siemens) Fixed in V16 Update 7
  • Fix · CNA SIMATIC WinCC Unified V17 (Siemens) Fixed in V17 Update 7
  • Fix · CNA SIMATIC WinCC Unified V18 (Siemens) Fixed in V18 Update 2
  • Fix · CNA SIMATIC WinCC V16 (Siemens) Fixed in V16.7
  • Fix · CNA SIMATIC WinCC V17 (Siemens) Fixed in V17.7
  • Fix · CNA SIMATIC WinCC V18 (Siemens) Fixed in V18 Update 2
  • Fix · CNA SIMOCODE ES V16 (Siemens) Fixed in V16 Update 7
  • Fix · CNA SIMOCODE ES V17 (Siemens) Fixed in V17 Update 7
  • Fix · CNA SIMOCODE ES V18 (Siemens) Fixed in V18 Update 2
  • Fix · CNA SIRIUS Safety ES V17 (Siemens) Fixed in V17 Update 7
  • Fix · CNA SIRIUS Safety ES V18 (Siemens) Fixed in V18 Update 2
  • Fix · CNA SIRIUS Soft Starter ES V17 (Siemens) Fixed in V17 Update 7
  • Fix · CNA SIRIUS Soft Starter ES V18 (Siemens) Fixed in V18 Update 2
  • Fix · CNA Soft Starter ES V16 (Siemens) Fixed in V16 Update 7
  • Fix · CNA TIA Portal Cloud V3.0 (Siemens) Fixed in V18 Update 2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SIMATIC STEP 7 V18 V18 Update 2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-22222 Deserialization of untrusted data in Siemens SIMATIC PCS neo V4.0Priority LOW 38
    Show all 2 records →
  • Release ·

    Siemens SIMATIC STEP 7 Safety V18 V18 Update 2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2023-16003 Deserialization of untrusted data in Siemens SIMATIC STEP 7 Safety V18Priority LOW 32
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32735
  2. 2026-10-03 Alias added: GHSA-27hg-xg89-rq4f

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences