CVE-2024-52051 is a local arbitrary command execution vulnerability affecting numerous Siemens TIA Portal engineering platforms, including SIMATIC S7-PLCSIM, STEP 7, WinCC Unified, and others across various versions. The vulnerability stems from improper sanitization of user-controllable input when parsing user settings. With a CVSS score of 7.3 (High), an attacker with local user privileges can execute arbitrary commands on the host operating system, leading to high impact on confidentiality, integrity, and availability. There is no public exploit code available, nor is it listed on the CISA KEV catalog, indicating it is not actively exploited. However, it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Siemens | SIMATIC S7-PLCSIM V17 | >= 0, < *CNA affecteddefault unknown | |
| Siemens | SIMATIC S7-PLCSIM V18 | >= 0, < *CNA affecteddefault unknown | |
| Siemens | SIMATIC STEP 7 Safety V17 | >= 0, < V17 Update 9CNA affecteddefault unknown | |
| Siemens | SIMATIC STEP 7 Safety V18 | >= 0, < *CNA affecteddefault unknown | |
| Siemens | SIMATIC STEP 7 Safety V19 | >= 0, < V19 Update 4CNA affecteddefault unknown |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.