CVE-2020-25238: High severity siemens simatic process control system neo vulnerability
A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in specific folders could allow a local attacker to execute code with SYSTEM privileges. The security vulnerability could be exploited by an attacker with a valid account and limited access rights on the system.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID is CVE-2020-25238.
What software versions are affected by this vulnerability?
The affected software versions are PCS neo (Administration Console) versions < V3.1 and TIA Portal versions 15, 15.1, and 16.
What is the severity of CVE-2020-25238?
The severity of CVE-2020-25238 is high with a CVSS score of 7.8.
How can this vulnerability be exploited?
This vulnerability can be exploited by manipulating certain files in specific folders, allowing a local attacker to execute code with SYSTEM privileges.
Are there any references available for more information about this vulnerability?
Yes, you can find more information about this vulnerability at the following references: [Siemens ProductCERT](https://cert-portal.siemens.com/productcert/pdf/ssa-428051.pdf), [CISA ICS Advisory](https://us-cert.cisa.gov/ics/advisories/icsa-21-040-05), [CERT VU](https://www.kb.cert.org/vuls/id/466044)