CVE-2020-7586

Vulnerability

A heap-based buffer overflow vulnerability (CWE-122) exists in multiple Siemens industrial automation products. Affected versions include: SIMATIC PCS 7 V8.2 and earlier (all versions), SIMATIC PCS 7 V9.0 (all versions prior to V9.0 SP3), SIMATIC PDM (all versions prior to V9.2), SIMATIC STEP 7 V5.X (all versions prior to V5.6 SP2 HF3), and SINAMICS STARTER (containing STEP 7 OEM version) (all versions prior to V5.4 HF2) [1][2]. The vulnerability is triggered locally and requires low complexity to exploit.

Exploitation

An attacker with local access to an affected system and standard user privileges can exploit this vulnerability without any user interaction [1][2]. The attack vector is local (AV:L), and the attack complexity is low (AC:L). No authentication beyond user-level privileges is required, and no user interaction is needed. The exact exploitation steps involve a stack-based buffer overflow (the advisory refers to it as stack-based but the CWE is heap-based buffer overflow as per the CVE description) in the affected software, likely triggered by providing specially crafted input or loading a malicious file.

Impact

Successful exploitation can lead to a denial-of-service (DoS) condition, compromising system availability. Additionally, an attacker could gain access to confidential information [1][2]. The CVSS v3 base score is 7.8, with the vector string AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impact on confidentiality, integrity, and availability, although the description notes that integrity impact is not explicitly mentioned in the summary but the CVSS vector suggests high integrity impact as well [1][2].

Mitigation

Siemens has released fixes for the affected products: SIMATIC PCS 7 V9.0 SP3 or later, SIMATIC PDM V9.2 or later, SIMATIC STEP 7 V5.6 SP2 HF3 or later, and SINAMICS STARTER V5.4 HF2 or later [1][2]. Users should update to these patched versions. For SIMATIC PCS 7 V8.2 and earlier, which are end-of-life, no fix is available, and the advisory recommends upgrading to a supported version [1][2]. No workarounds were disclosed, but the advisory suggests following general security best practices such as limiting local access and applying the principle of least privilege.