Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Vendor advisorySeverity 8.2 high

SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms

SSA-693808 · Siemens · August 12, 2025

Summary

Affected products do not properly restrict access permissions to a local Windows Named Pipe and do not properly sanitize user-controllable input sent to that Named Pipe. This could allow a local authenticated attacker to cause a type confusion and execute arbitrary code within the affected application and its privileges. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

From Siemens (vendor's own words, quoted), quoted as published. Check the source before acting.

What to do

On Desktop systems: Execute affected software on Windows hosts where only a single user is configured On Server systems: Reduce the access on operating system level to administrators only Currently no fix is planned Currently no fix is available

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2024-546788.2 highNo0.2%Deserialization of Untrusted Data (CWE-502)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
SiemensSIMATIC PCS neo V4.1vers:all/*—
SiemensSIMATIC PCS neo V5.0vers:all/*—
SiemensSIMATIC PCS neo V6.0vers:intdot/<6.0.1.1—
SiemensSIMATIC S7-PLCSIM V17vers:all/*—
SiemensSIMATIC STEP 7 V17vers:intdot/<17.0.9—
SiemensSIMATIC STEP 7 V18vers:intdot/<18.0.6—
SiemensSIMATIC STEP 7 V19vers:intdot/<19.0.4—
SiemensSIMATIC STEP 7 V20vers:intdot/<20.0.4—
SiemensSIMATIC WinCC V17vers:intdot/<17.0.9—
SiemensSIMATIC WinCC V18vers:intdot/<18.0.6—
SiemensSIMATIC WinCC V19vers:intdot/<19.0.4—
SiemensSIMATIC WinCC V20vers:intdot/<20.0.4—
SiemensSIMOCODE ES V17vers:all/*—
SiemensSIMOCODE ES V18vers:all/*—
SiemensSIMOCODE ES V19vers:all/*—
SiemensSIMOCODE ES V20vers:all/*—
SiemensSIMOTION SCOUT TIA V5.4vers:all/*—
SiemensSIMOTION SCOUT TIA V5.5vers:all/*—
SiemensSIMOTION SCOUT TIA V5.6vers:intdot/<5.6.1.7—
SiemensSIMOTION SCOUT TIA V5.7vers:all/*—
SiemensSINAMICS Startdrive V17vers:all/*—
SiemensSINAMICS Startdrive V18vers:all/*—
SiemensSINAMICS Startdrive V19vers:all/*—
SiemensSINAMICS Startdrive V20vers:all/*—
SiemensSIRIUS Safety ES V17 (TIA Portal)vers:all/*—
SiemensSIRIUS Safety ES V18 (TIA Portal)vers:all/*—
SiemensSIRIUS Safety ES V19 (TIA Portal)vers:all/*—
SiemensSIRIUS Safety ES V20 (TIA Portal)vers:all/*—
SiemensSIRIUS Soft Starter ES V17 (TIA Portal)vers:all/*—
SiemensSIRIUS Soft Starter ES V18 (TIA Portal)vers:all/*—
SiemensSIRIUS Soft Starter ES V19 (TIA Portal)vers:all/*—
SiemensSIRIUS Soft Starter ES V20 (TIA Portal)vers:all/*—
SiemensTIA Portal Cloud V17vers:all/*—
SiemensTIA Portal Cloud V18vers:intdot/<6.3.0.2—
SiemensTIA Portal Cloud V19vers:intdot/<5.2.1.1—
SiemensTIA Portal Cloud V20vers:intdot/<5.2.2.2—
SiemensTIA Portal Test Suite V20vers:intdot/<20.0.4—

Why it's on these mode pages

  • Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)

Change history

  1. August 12, 2025: Publication Date
  2. October 14, 2025: Added no fix expected for PCS neo V5.0, added fix for TIA Portal V20
  3. December 9, 2025: Added fix for Totally Integrated Automation Portal (TIA Portal) V17
  4. June 9, 2026: Added fix for SIMATIC PCS NEO V6.0
  5. October 13, 2026: Added fix version for SIMATIC STEP 7 V18, TIA Portal Cloud V18 and SIMATIC WinCC V18
  6. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com