Read the docs
TI-2023-24901 Aliases CVE-2023-46280GHSA-g3gv-9xvr-p3r6

Out-of-bounds read in Siemens Security Configuration Tool

Priority LOW 35CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 Upd5), SIMATIC NET PC Software V16 (All versions < V16 Update 8), SIMATIC NET PC Software V17 (All versions), SIMATIC NET PC Software V18 (All versions < V18 SP1), SIMATIC NET PC Software V19 (All versions < V19 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PDM V9.2 (All versions < V9.2 SP2 Upd3), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 Upd3), SIMATIC S7-PCT (All versions < V3.5 SP3 Update 6), SIMATIC STEP 7 V5 (All versions < V5.7 SP3), SIMATIC WinCC OA V3.17 (All versions), SIMATIC WinCC OA V3.18 (All versions < V3.18 P025), SIMATIC WinCC OA V3.19 (All versions < V3.19 P010), SIMATIC WinCC Runtime Advanced (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 6), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5), SINAMICS Startdrive (All versions < V19 SP1), SINEC NMS (All versions < V3.0), SINUMERIK ONE virtual (All versions < V6.23), SINUMERIK PLC Programming Tool (All versions < V3.3.12), TIA Portal Cloud Connector (All versions < V2.0), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 4), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 2), SINEC NMS (All versions < V3.0 SP1). The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed SIMATIC Automation Tool (Siemens): V5.0 SP2SIMATIC BATCH V9.1 (Siemens): V9.1 SP2 Upd5+25 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSecurity Configuration Tool (SCT)all versions—No fix listedCNA
SiemensSIMATIC Automation Toolbefore V5.0 SP2V5.0 SP2Patch availableCNA
SiemensSIMATIC BATCH V9.1before V9.1 SP2 Upd5V9.1 SP2 Upd5Patch availableCNA
SiemensSIMATIC NET PC Software V16before V16 Update 8V16 Update 8Patch availableCNA
SiemensSIMATIC NET PC Software V17all versions—No fix listedCNA
SiemensSIMATIC NET PC Software V18before V18 SP1V18 SP1Patch availableCNA
SiemensSIMATIC NET PC Software V19before V19 Update 2V19 Update 2Patch availableCNA
SiemensSIMATIC PCS 7 V9.1before V9.1 SP2 UC05V9.1 SP2 UC05Patch availableCNA
SiemensSIMATIC PDM V9.2before V9.2 SP2 Upd3V9.2 SP2 Upd3Patch availableCNA
SiemensSIMATIC Route Control V9.1before V9.1 SP2 Upd3V9.1 SP2 Upd3Patch availableCNA
SiemensSIMATIC S7-PCTbefore V3.5 SP3 Update 6V3.5 SP3 Update 6Patch availableCNA
SiemensSIMATIC STEP 7 V5before V5.7 SP3V5.7 SP3Patch availableCNA
SiemensSIMATIC WinCC OA V3.17all versions—No fix listedCNA
SiemensSIMATIC WinCC OA V3.18before V3.18 P025V3.18 P025Patch availableCNA
SiemensSIMATIC WinCC OA V3.19before V3.19 P010V3.19 P010Patch availableCNA
SiemensSIMATIC WinCC Runtime Advancedbefore V17 Update 8V17 Update 8Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V16before V16 Update 6V16 Update 6Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V17before V17 Update 8V17 Update 8Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V18before V18 Update 4V18 Update 4Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V19before V19 Update 2V19 Update 2Patch availableCNA
SiemensSIMATIC WinCC V7.4all versions—No fix listedCNA
SiemensSIMATIC WinCC V7.5before V7.5 SP2 Update 17V7.5 SP2 Update 17Patch availableCNA
SiemensSIMATIC WinCC V8.0before V8.0 Update 5V8.0 Update 5Patch availableCNA
SiemensSINAMICS Startdrivebefore V19 SP1V19 SP1Patch availableCNA
SiemensSINEC NMSbefore V3.0V3.0Patch availableCNA
SiemensSINUMERIK ONE virtualbefore V6.23V6.23Patch availableCNA
SiemensSINUMERIK PLC Programming Toolbefore V3.3.12V3.3.12Patch availableCNA
SiemensTIA Portal Cloud Connectorbefore V2.0V2.0Patch availableCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V15.1all versions—No fix listedCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V16all versions—No fix listedCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V17before V17 Update 8V17 Update 8Patch availableCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V18before V18 Update 4V18 Update 4Patch availableCNA
SiemensTotally Integrated Automation Portal (TIA Portal) V19before V19 Update 2V19 Update 2Patch availableCNA
SiemensSINEC NMSbefore V3.0 SP1V3.0 SP1Patch availableCNA
  • Security Configuration Tool (SCT) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC Automation Tool VendorSiemens Affected before V5.0 SP2 Fixed in V5.0 SP2 Patch available CNA
  • SIMATIC BATCH V9.1 VendorSiemens Affected before V9.1 SP2 Upd5 Fixed in V9.1 SP2 Upd5 Patch available CNA
  • SIMATIC NET PC Software V16 VendorSiemens Affected before V16 Update 8 Fixed in V16 Update 8 Patch available CNA
  • SIMATIC NET PC Software V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC NET PC Software V18 VendorSiemens Affected before V18 SP1 Fixed in V18 SP1 Patch available CNA
  • SIMATIC NET PC Software V19 VendorSiemens Affected before V19 Update 2 Fixed in V19 Update 2 Patch available CNA
  • SIMATIC PCS 7 V9.1 VendorSiemens Affected before V9.1 SP2 UC05 Fixed in V9.1 SP2 UC05 Patch available CNA
  • SIMATIC PDM V9.2 VendorSiemens Affected before V9.2 SP2 Upd3 Fixed in V9.2 SP2 Upd3 Patch available CNA
  • SIMATIC Route Control V9.1 VendorSiemens Affected before V9.1 SP2 Upd3 Fixed in V9.1 SP2 Upd3 Patch available CNA
  • SIMATIC S7-PCT VendorSiemens Affected before V3.5 SP3 Update 6 Fixed in V3.5 SP3 Update 6 Patch available CNA
  • SIMATIC STEP 7 V5 VendorSiemens Affected before V5.7 SP3 Fixed in V5.7 SP3 Patch available CNA
  • SIMATIC WinCC OA V3.17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC WinCC OA V3.18 VendorSiemens Affected before V3.18 P025 Fixed in V3.18 P025 Patch available CNA
  • SIMATIC WinCC OA V3.19 VendorSiemens Affected before V3.19 P010 Fixed in V3.19 P010 Patch available CNA
  • SIMATIC WinCC Runtime Advanced VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIMATIC WinCC Runtime Professional V16 VendorSiemens Affected before V16 Update 6 Fixed in V16 Update 6 Patch available CNA
  • SIMATIC WinCC Runtime Professional V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • SIMATIC WinCC Runtime Professional V18 VendorSiemens Affected before V18 Update 4 Fixed in V18 Update 4 Patch available CNA
  • SIMATIC WinCC Runtime Professional V19 VendorSiemens Affected before V19 Update 2 Fixed in V19 Update 2 Patch available CNA
  • SIMATIC WinCC V7.4 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected before V7.5 SP2 Update 17 Fixed in V7.5 SP2 Update 17 Patch available CNA
  • SIMATIC WinCC V8.0 VendorSiemens Affected before V8.0 Update 5 Fixed in V8.0 Update 5 Patch available CNA
  • SINAMICS Startdrive VendorSiemens Affected before V19 SP1 Fixed in V19 SP1 Patch available CNA
  • SINEC NMS VendorSiemens Affected before V3.0 Fixed in V3.0 Patch available CNA
  • SINUMERIK ONE virtual VendorSiemens Affected before V6.23 Fixed in V6.23 Patch available CNA
  • SINUMERIK PLC Programming Tool VendorSiemens Affected before V3.3.12 Fixed in V3.3.12 Patch available CNA
  • TIA Portal Cloud Connector VendorSiemens Affected before V2.0 Fixed in V2.0 Patch available CNA
  • Totally Integrated Automation Portal (TIA Portal) V15.1 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Totally Integrated Automation Portal (TIA Portal) V16 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Totally Integrated Automation Portal (TIA Portal) V17 VendorSiemens Affected before V17 Update 8 Fixed in V17 Update 8 Patch available CNA
  • Totally Integrated Automation Portal (TIA Portal) V18 VendorSiemens Affected before V18 Update 4 Fixed in V18 Update 4 Patch available CNA
  • Totally Integrated Automation Portal (TIA Portal) V19 VendorSiemens Affected before V19 Update 2 Fixed in V19 Update 2 Patch available CNA
  • SINEC NMS VendorSiemens Affected before V3.0 SP1 Fixed in V3.0 SP1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA SIMATIC Automation Tool (Siemens) Fixed in V5.0 SP2
  • Fix · CNA SIMATIC BATCH V9.1 (Siemens) Fixed in V9.1 SP2 Upd5
  • Fix · CNA SIMATIC NET PC Software V16 (Siemens) Fixed in V16 Update 8
  • Fix · CNA SIMATIC NET PC Software V18 (Siemens) Fixed in V18 SP1
  • Fix · CNA SIMATIC NET PC Software V19 (Siemens) Fixed in V19 Update 2
  • Fix · CNA SIMATIC PCS 7 V9.1 (Siemens) Fixed in V9.1 SP2 UC05
  • Fix · CNA SIMATIC PDM V9.2 (Siemens) Fixed in V9.2 SP2 Upd3
  • Fix · CNA SIMATIC Route Control V9.1 (Siemens) Fixed in V9.1 SP2 Upd3
  • Fix · CNA SIMATIC S7-PCT (Siemens) Fixed in V3.5 SP3 Update 6
  • Fix · CNA SIMATIC STEP 7 V5 (Siemens) Fixed in V5.7 SP3
  • Fix · CNA SIMATIC WinCC OA V3.18 (Siemens) Fixed in V3.18 P025
  • Fix · CNA SIMATIC WinCC OA V3.19 (Siemens) Fixed in V3.19 P010
  • Fix · CNA SIMATIC WinCC Runtime Advanced (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIMATIC WinCC Runtime Professional V16 (Siemens) Fixed in V16 Update 6
  • Fix · CNA SIMATIC WinCC Runtime Professional V17 (Siemens) Fixed in V17 Update 8
  • Fix · CNA SIMATIC WinCC Runtime Professional V18 (Siemens) Fixed in V18 Update 4
  • Fix · CNA SIMATIC WinCC Runtime Professional V19 (Siemens) Fixed in V19 Update 2
  • Fix · CNA SIMATIC WinCC V7.5 (Siemens) Fixed in V7.5 SP2 Update 17
  • Fix · CNA SIMATIC WinCC V8.0 (Siemens) Fixed in V8.0 Update 5
  • Fix · CNA SINAMICS Startdrive (Siemens) Fixed in V19 SP1
  • Fix · CNA SINEC NMS (Siemens) Fixed in V3.0
  • Fix · CNA SINUMERIK ONE virtual (Siemens) Fixed in V6.23
  • Fix · CNA SINUMERIK PLC Programming Tool (Siemens) Fixed in V3.3.12
  • Fix · CNA TIA Portal Cloud Connector (Siemens) Fixed in V2.0
  • Fix · CNA Totally Integrated Automation Portal (TIA Portal) V17 (Siemens) Fixed in V17 Update 8
  • Fix · CNA Totally Integrated Automation Portal (TIA Portal) V18 (Siemens) Fixed in V18 Update 4
  • Fix · CNA Totally Integrated Automation Portal (TIA Portal) V19 (Siemens) Fixed in V19 Update 2
  • Fix · CNA SINEC NMS (Siemens) Fixed in V3.0 SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46280
  2. 2026-10-03 Alias added: GHSA-g3gv-9xvr-p3r6

References

Other 3

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences