Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Vendor advisorySeverity 7.3 high

SSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20

SSA-392859 · Siemens · December 10, 2024

Summary

Affected products contain a local arbitrary code execution vulnerability that could allow an attacker to perform actions against the operation system of that environment. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-52051. See the chapter "Additional Information" below for more details.

From Siemens (vendor's own words, quoted), quoted as published. Check the source before acting.

What to do

Currently no fix is planned Currently no fix is available Update to V17 Update 9 or later version Update to V18 Update 6 or later version

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2024-520517.3 highNo0.2%Improper Input Validation (CWE-20)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
SiemensSIMATIC S7-PLCSIM V17vers:all/*—
SiemensSIMATIC S7-PLCSIM V18vers:all/*—
SiemensSIMATIC STEP 7 Safety V17vers:intdot/<17.0.9—
SiemensSIMATIC STEP 7 Safety V18vers:intdot/<18.0.6—
SiemensSIMATIC STEP 7 Safety V19vers:intdot/<19.0.4—
SiemensSIMATIC STEP 7 V17vers:intdot/<17.0.9—
SiemensSIMATIC STEP 7 V18vers:intdot/<18.0.6—
SiemensSIMATIC STEP 7 V19vers:intdot/<19.0.4—
SiemensSIMATIC WinCC Unified PC Runtime V18vers:all/*—
SiemensSIMATIC WinCC Unified PC Runtime V19vers:intdot/<19.0.4—
SiemensSIMATIC WinCC Unified V17vers:intdot/<17.0.9—
SiemensSIMATIC WinCC Unified V18vers:intdot/<18.0.6—
SiemensSIMATIC WinCC Unified V19vers:intdot/<19.0.4—
SiemensSIMATIC WinCC V17vers:intdot/<17.0.9—
SiemensSIMATIC WinCC V18vers:intdot/<18.0.6—
SiemensSIMATIC WinCC V19vers:intdot/<19.0.4—
SiemensSIMOCODE ES V17vers:all/*—
SiemensSIMOCODE ES V18vers:all/*—
SiemensSIMOCODE ES V19vers:all/*—
SiemensSIMOTION SCOUT TIA V5.4vers:all/*—
SiemensSIMOTION SCOUT TIA V5.5vers:all/*—
SiemensSIMOTION SCOUT TIA V5.6vers:intdot/<5.6.1.7—
SiemensSINAMICS Startdrive V17vers:all/*—
SiemensSINAMICS Startdrive V18vers:all/*—
SiemensSINAMICS Startdrive V19vers:all/*—
SiemensSIRIUS Safety ES V17 (TIA Portal)vers:all/*—
SiemensSIRIUS Safety ES V18 (TIA Portal)vers:all/*—
SiemensSIRIUS Safety ES V19 (TIA Portal)vers:all/*—
SiemensSIRIUS Soft Starter ES V17 (TIA Portal)vers:all/*—
SiemensSIRIUS Soft Starter ES V18 (TIA Portal)vers:all/*—
SiemensSIRIUS Soft Starter ES V19 (TIA Portal)vers:all/*—
SiemensTIA Portal Cloud V17vers:all/*—
SiemensTIA Portal Cloud V18vers:all/*—
SiemensTIA Portal Cloud V19vers:intdot/<5.2.1.1—

Why it's on these mode pages

  • Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)

Change history

  1. December 10, 2024: Publication Date
  2. August 12, 2025: Added fix for Totally Integrated Automation Portal (TIA Portal) V19; Name of SIMOTION SCOUT TIA V5.6 SP1 was updated to SIMOTION SCOUT TIA V5.6 and Name of SIMOTION SCOUT TIA V5.5 SP1 was updated to SIMOTION SCOUT TIA V5.5 and Name of SIMOTION SCOUT TIA V5.4 SP3 was updated to SIMOTION SCOUT TIA V5.4
  3. December 9, 2025: Added fix for Totally Integrated Automation Portal (TIA Portal) V17
  4. October 13, 2026: Added no fix expected for PLCSIM, SIMATIC STEP 7 Safety V18, SIMATIC STEP 7 V18, SIMATIC WinCC Unified V18, SIMATIC WinCC V18
  5. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com