Read the docs
TI-2023-16002 Aliases CVE-2023-32736GHSA-5355-h7h8-637c

Deserialization of untrusted data in Siemens SIMATIC S7-PLCSIM V16

Priority LOW 32CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 8), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 5), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 8), SIMATIC STEP 7 V18 (All versions < V18 Update 5), SIMATIC WinCC Unified V16 (All versions), SIMATIC WinCC Unified V17 (All versions < V17 Update 8), SIMATIC WinCC Unified V18 (All versions < V18 SP5), SIMATIC WinCC V16 (All versions), SIMATIC WinCC V17 (All versions < V17 Update 8), SIMATIC WinCC V18 (All versions < V18 SP5), SIMOCODE ES V16 (All versions), SIMOCODE ES V17 (All versions < V17 Update 8), SIMOCODE ES V18 (All versions), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions < V17 Update 8), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions < V17 Update 8), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), TIA Portal Cloud V16 (All versions), TIA Portal Cloud V17 (All versions < V4.6.0.1), TIA Portal Cloud V18 (All versions < V4.6.1.0). Affected products do not properly sanitize user-controllable input when parsing user settings. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix Fixed SIMATIC STEP 7 Safety V17 (Siemens): V17 Update 8SIMATIC STEP 7 Safety V18 (Siemens): V18 Update 5+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC S7-PLCSIM V16all versions—No fix listedCNA
SiemensSIMATIC S7-PLCSIM V17all versions—No fix listedCNA
SiemensSIMATIC STEP 7 Safety V16all versions—No fix listedCNA
SiemensSIMATIC STEP 7 Safety V17before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIMATIC STEP 7 Safety V18before V18 Update 5V18 Update 5Patch availableCNA
SiemensSIMATIC STEP 7 V16all versions—No fix listedCNA
SiemensSIMATIC STEP 7 V17before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIMATIC STEP 7 V18before V18 Update 5V18 Update 5Patch availableCNA
SiemensSIMATIC WinCC Unified V16all versions—No fix listedCNA
SiemensSIMATIC WinCC Unified V17before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIMATIC WinCC Unified V18before V18 SP5V18 SP5Patch availableCNA
SiemensSIMATIC WinCC V16all versions—No fix listedCNA
SiemensSIMATIC WinCC V17before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIMATIC WinCC V18before V18 SP5V18 SP5Patch availableCNA
SiemensSIMOCODE ES V16all versions—No fix listedCNA
SiemensSIMOCODE ES V17before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIMOCODE ES V18all versions—No fix listedCNA
SiemensSIMOTION SCOUT TIA V5.4 SP1all versions—No fix listedCNA
SiemensSIMOTION SCOUT TIA V5.4 SP3all versions—No fix listedCNA
SiemensSIMOTION SCOUT TIA V5.5 SP1all versions—No fix listedCNA
SiemensSINAMICS Startdrive V16all versions—No fix listedCNA
SiemensSINAMICS Startdrive V17all versions—No fix listedCNA
SiemensSINAMICS Startdrive V18all versions—No fix listedCNA
SiemensSIRIUS Safety ES V17 (TIA Portal)before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIRIUS Safety ES V18 (TIA Portal)all versions—No fix listedCNA
SiemensSIRIUS Soft Starter ES V17 (TIA Portal)before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIRIUS Soft Starter ES V18 (TIA Portal)all versions—No fix listedCNA
SiemensTIA Portal Cloud V16all versions—No fix listedCNA
SiemensTIA Portal Cloud V17before V4.6.0.1V4.6.0.1Patch availableCNA
SiemensTIA Portal Cloud V18before V4.6.1.0V4.6.1.0Patch availableCNA
  • SIMATIC S7-PLCSIM V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC S7-PLCSIM V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC STEP 7 Safety V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC STEP 7 Safety V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIMATIC STEP 7 Safety V18 VendorSiemens Affected before V18 Update 5 Fixed in V18 Update 5 Patch available CNA
  • SIMATIC STEP 7 V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC STEP 7 V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIMATIC STEP 7 V18 VendorSiemens Affected before V18 Update 5 Fixed in V18 Update 5 Patch available CNA
  • SIMATIC WinCC Unified V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC WinCC Unified V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIMATIC WinCC Unified V18 VendorSiemens Affected before V18 SP5 Fixed in V18 SP5 Patch available CNA
  • SIMATIC WinCC V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC WinCC V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIMATIC WinCC V18 VendorSiemens Affected before V18 SP5 Fixed in V18 SP5 Patch available CNA
  • SIMOCODE ES V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOCODE ES V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIMOCODE ES V18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOTION SCOUT TIA V5.4 SP1 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOTION SCOUT TIA V5.4 SP3 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOTION SCOUT TIA V5.5 SP1 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Safety ES V17 (TIA Portal) VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIRIUS Safety ES V18 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Soft Starter ES V17 (TIA Portal) VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIRIUS Soft Starter ES V18 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • TIA Portal Cloud V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • TIA Portal Cloud V17 VendorSiemens Affected before V4.6.0.1 Fixed in V4.6.0.1 Patch available CNA
  • TIA Portal Cloud V18 VendorSiemens Affected before V4.6.1.0 Fixed in V4.6.1.0 Patch available CNA

CPE names CISA-ADP · 11

CPEVersionsRoleVendor
cpe:2.3:h:siemens:simatic_step_7:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:simatic_s7-plcsim:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:simatic_wincc:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:simatic_wincc_unified:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:simocode_es:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:simotion_scout_tia:v5.4sp1:*:*:*:*:*:*:*v5.4sp1—Siemens
cpe:2.3:a:siemens:simotion_scout_tia:v5.4sp3:*:*:*:*:*:*:*v5.4sp3—Siemens
cpe:2.3:a:siemens:simotion_scout_tia:v5.5sp1:*:*:*:*:*:*:*v5.5sp1—Siemens
cpe:2.3:a:siemens:sinamics_startdrive:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:sirius_safety_es:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:h:siemens:simatic_step_7:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:simatic_s7-plcsim:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_unified:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:simocode_es:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:simotion_scout_tia:v5.4sp1:*:*:*:*:*:*:* Versions v5.4sp1 — ·Siemens
  • cpe:2.3:a:siemens:simotion_scout_tia:v5.4sp3:*:*:*:*:*:*:* Versions v5.4sp3 — ·Siemens
  • cpe:2.3:a:siemens:simotion_scout_tia:v5.5sp1:*:*:*:*:*:*:* Versions v5.5sp1 — ·Siemens
  • cpe:2.3:a:siemens:sinamics_startdrive:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:sirius_safety_es:*:*:*:*:*:*:*:* Versions — — ·Siemens
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:tia_portal_cloud:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:tia_portal_cloud:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA SIMATIC STEP 7 Safety V17 (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIMATIC STEP 7 Safety V18 (Siemens) Fixed in V18 Update 5
  • Fix · CNA SIMATIC STEP 7 V17 (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIMATIC STEP 7 V18 (Siemens) Fixed in V18 Update 5
  • Fix · CNA SIMATIC WinCC Unified V17 (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIMATIC WinCC Unified V18 (Siemens) Fixed in V18 SP5
  • Fix · CNA SIMATIC WinCC V17 (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIMATIC WinCC V18 (Siemens) Fixed in V18 SP5
  • Fix · CNA SIMOCODE ES V17 (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIRIUS Safety ES V17 (TIA Portal) (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIRIUS Soft Starter ES V17 (TIA Portal) (Siemens) Fixed in V17 Update 8
  • Fix · CNA TIA Portal Cloud V17 (Siemens) Fixed in V4.6.0.1
  • Fix · CNA TIA Portal Cloud V18 (Siemens) Fixed in V4.6.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32736
  2. 2026-10-03 Alias added: GHSA-5355-h7h8-637c

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences