CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2024-33698
https://notcve.org/view.php?id=CVE-2024-33698
A vulnerability has been identified in SIMATIC Information Server 2022 (All versions), SIMATIC Information Server 2024 (All versions), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code. • https://cert-portal.siemens.com/productcert/html/ssa-039007.html • CWE-122: Heap-based Buffer Overflow •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-45147
https://notcve.org/view.php?id=CVE-2022-45147
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300. Se ha identificado una vulnerabilidad en SIMATIC PCS neo V4.0 (todas las versiones), SIMATIC STEP 7 V16 (todas las versiones), SIMATIC STEP 7 V17 (todas las versiones), SIMATIC STEP 7 V18 (todas las versiones < V18 Update 2). Las aplicaciones afectadas no restringen adecuadamente .NET BinaryFormatter al deserializar la entrada controlable por el usuario. • https://cert-portal.siemens.com/productcert/html/ssa-825651.html • CWE-502: Deserialization of Untrusted Data •