Read the docs
TI-2023-26225 Aliases CVE-2023-48364GHSA-m3wg-jr4x-9483

NULL pointer dereference in Siemens OpenPCS 7 V9.1

Priority LOW 31CWE-476Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC Route Control V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 Update 4). The implementation of the RPC (Remote Procedure call) communication protocol in the affected products do not properly handle certain malformed RPC messages. An attacker could use this vulnerability to cause a denial of service condition in the RPC server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed SIMATIC PCS 7 V9.1 (Siemens): V9.1 SP2 UC05SIMATIC WinCC Runtime Professional V18 (Siemens): V18 Update 4+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensOpenPCS 7 V9.1All versions < V9.1 SP2 UC05—No fix listedCNA
SiemensSIMATIC BATCH V9.1All versions < V9.1 SP2 UC05—No fix listedCNA
SiemensSIMATIC PCS 7 V9.1before V9.1 SP2 UC05V9.1 SP2 UC05Patch availableCNA
SiemensSIMATIC Route Control V9.1All versions < V9.1 SP2 UC05—No fix listedCNA
SiemensSIMATIC WinCC Runtime Professional V18before V18 Update 4V18 Update 4Patch availableCNA
SiemensSIMATIC WinCC Runtime Professional V19before V19 Update 2V19 Update 2Patch availableCNA
SiemensSIMATIC WinCC V7.4all versions—No fix listedCNA
SiemensSIMATIC WinCC V7.5before V7.5 SP2 Update 15V7.5 SP2 Update 15Patch availableCNA
SiemensSIMATIC WinCC V8.0before V8.0 Update 4V8.0 Update 4Patch availableCNA
  • OpenPCS 7 V9.1 VendorSiemens Affected All versions < V9.1 SP2 UC05 Fixed in — No fix listed CNA
  • SIMATIC BATCH V9.1 VendorSiemens Affected All versions < V9.1 SP2 UC05 Fixed in — No fix listed CNA
  • SIMATIC PCS 7 V9.1 VendorSiemens Affected before V9.1 SP2 UC05 Fixed in V9.1 SP2 UC05 Patch available CNA
  • SIMATIC Route Control V9.1 VendorSiemens Affected All versions < V9.1 SP2 UC05 Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Professional V18 VendorSiemens Affected before V18 Update 4 Fixed in V18 Update 4 Patch available CNA
  • SIMATIC WinCC Runtime Professional V19 VendorSiemens Affected before V19 Update 2 Fixed in V19 Update 2 Patch available CNA
  • SIMATIC WinCC V7.4 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected before V7.5 SP2 Update 15 Fixed in V7.5 SP2 Update 15 Patch available CNA
  • SIMATIC WinCC V8.0 VendorSiemens Affected before V8.0 Update 4 Fixed in V8.0 Update 4 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:siemens:openpcs_7:*:*:*:*:*:*:*:*up to 9.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_batch:*:*:*:*:*:*:*:*up to 9.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*up to 9.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_route_control:*:*:*:*:*:*:*:*up to 9.1VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*7.4VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*7.5VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc:8.0:*:*:*:*:*:*:*8.0VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*up to 18VulnerableSiemens
cpe:2.3:a:siemens:simatic_wincc_runtime_professional:19:*:*:*:*:*:*:*19VulnerableSiemens
  • cpe:2.3:a:siemens:openpcs_7:*:*:*:*:*:*:*:* Versions up to 9.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_batch:*:*:*:*:*:*:*:* Versions up to 9.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:* Versions up to 9.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_route_control:*:*:*:*:*:*:*:* Versions up to 9.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:* Versions up to 18 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:simatic_wincc_runtime_professional:19:*:*:*:*:*:*:* Versions 19 Vulnerable ·Siemens

Remediation

  • Fix · CNA SIMATIC PCS 7 V9.1 (Siemens) Fixed in V9.1 SP2 UC05
  • Fix · CNA SIMATIC WinCC Runtime Professional V18 (Siemens) Fixed in V18 Update 4
  • Fix · CNA SIMATIC WinCC Runtime Professional V19 (Siemens) Fixed in V19 Update 2
  • Fix · CNA SIMATIC WinCC V7.5 (Siemens) Fixed in V7.5 SP2 Update 15
  • Fix · CNA SIMATIC WinCC V8.0 (Siemens) Fixed in V8.0 Update 4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SIMATIC PCS 7 V9.1, SIMATIC WinCC Runtime Professional V18 and 3 more products V18 Update 4, V19 Update 2 and 3 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2023-26224 NULL pointer dereference in Siemens OpenPCS 7 V9.1Priority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48364
  2. 2026-10-03 Alias added: GHSA-m3wg-jr4x-9483

References

Advisory 1

  • TI-2018-03409 Improper input validation in Siemens OpenPCS 7 V7.1 and earlier CVSS 3.1HIGH 7.5
  • TI-2019-13902 A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All… CVSS 3.1HIGH 7.5
  • TI-2023-26224 NULL pointer dereference in Siemens OpenPCS 7 V9.1 CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences