CVE-2023-32735

MEDIUM

6.5

CVSS Score

Published: July 9, 2024 at 12:04 PM UTC

Updated: June 17, 2026 at 05:59 AM UTC

13 products affected across 1 vendorSINAMICS StartdriveSIMOTION SCOUT TIASIMATIC WinCC

Using SIMATIC STEP 7 Safety V16 by Siemens?

Get instant alerts when new vulnerabilities affect SIMATIC STEP 7 Safety V16 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2), SIMATIC STEP 7 V16 (All versions < V16 Update 7), SIMATIC STEP 7 V17 (All versions < V17 Update 7), SIMATIC STEP 7 V18 (All versions < V18 Update 2), SIMATIC WinCC Unified V16 (All versions < V16 Update 7), SIMATIC WinCC Unified V17 (All versions < V17 Update 7), SIMATIC WinCC Unified V18 (All versions < V18 Update 2), SIMATIC WinCC V16 (All versions < V16.7), SIMATIC WinCC V17 (All versions < V17.7), SIMATIC WinCC V18 (All versions < V18 Update 2), SIMOCODE ES V16 (All versions < V16 Update 7), SIMOCODE ES V17 (All versions < V17 Update 7), SIMOCODE ES V18 (All versions < V18 Update 2), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SIRIUS Safety ES V17 (All versions < V17 Update 7), SIRIUS Safety ES V18 (All versions < V18 Update 2), SIRIUS Soft Starter ES V17 (All versions < V17 Update 7), SIRIUS Soft Starter ES V18 (All versions < V18 Update 2), Soft Starter ES V16 (All versions < V16 Update 7), TIA Portal Cloud V3.0 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing hardware configuration profiles. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

SINAMICS Startdrive · Siemens

95%

17 18

SIMOTION SCOUT TIA · Siemens

90%

5.4sp1 5.4sp3 5.5sp1

SIMATIC Step 7 · Siemens

60%

v < V16 Update 7v < V17 Update 7v < V18 Update 2v < v16update7v < v17update7v < v18update2

Affected range stops below V16 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V17 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V18 Update 2, so it looks safe — our inference, not a vendor statement

SIMATIC STEP 7 Safety · Siemens

60%

v < V16 Update 7v < V17 Update 7v < V18 Update 2v < v16update7v < v17update7v < v18update2

Affected range stops below V16 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V17 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V18 Update 2, so it looks safe — our inference, not a vendor statement

SIMATIC WinCC · Siemens

60%

v < V16.7v < V18 Update 2v < v17.7v < v18update2

Affected range stops below V16.7, so it looks safe — our inference, not a vendor statement

Affected range stops below V18 Update 2, so it looks safe — our inference, not a vendor statement

Affected range stops below v17.7, so it looks safe — our inference, not a vendor statement

SIMATIC WinCC (TIA Portal)· Siemens

60%

v < V17.7

Affected range stops below V17.7, so it looks safe — our inference, not a vendor statement

SIMATIC Wincc Unified · Siemens

60%

v < V16 Update 7v < V17 Update 7v < V18 Update 2v < v16update7v < v17update7v < v18update2

Affected range stops below V16 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V17 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V18 Update 2, so it looks safe — our inference, not a vendor statement

Simocode Es · Siemens

60%

v < V16 Update 7v < V17 Update 7v < V18 Update 2v < v16update7v < v17update7v < v18update2

Affected range stops below V16 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V17 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V18 Update 2, so it looks safe — our inference, not a vendor statement

SINAMICS Startdrive V17 · Siemens

60%

SIRIUS Safety ES · Siemens

60%

v < V17 Update 7v < V18 Update 2v < v17update7v < v18update2

Affected range stops below V17 Update 7, so it looks safe — our inference, not a vendor statement

Affected range stops below V18 Update 2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

Source: [email protected]

https://cert-portal.siemens.com/productcert/html/ssa-779936.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUMsiemens

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-502

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card