Skip to content
Fencer Vulns
medium 6.7

CVE-2020-7580 json

A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1…

published 2020-06-10 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28705

cvss
6.7
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Upd3), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC ProSave (All versions < V17), SIMATIC S7-1500 Software Controller (All versions < V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMATIC STEP 7 V5 (All versions < V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions < V3.16 P018), SIMATIC WinCC OA V3.17 (All versions < V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions < V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 3), SINAMICS STARTER (All Versions < V5.4 HF2), SINAMICS Startdrive (All Versions < V16 Update 3), SINEC NMS (All versions < V1.0 SP2), SINEMA Server (All versions < V14 SP3), SINUMERIK ONE virtual (All Versions < V6.14), SINUMERIK Operate (All Versions < V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges.

Patch / fix

  • siemens simatic_net_pc 16
  • siemens simatic_s7-1500_software_controller 21.8
  • siemens simatic_step_7 5.6
  • siemens simatic_wincc 7.4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-161-04 updated cvss 8.8

Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update J)

  • Siemens SIMATIC Automation Tool <V4_SP2
    affected: vendor fix, mitigation support.industry.siemens.com
  • Siemens SIMATIC NET PC Software V14 <V14_SP1_Update_14
    affected: fixed in V14, mitigation support.industry.siemens.com
  • Siemens SIMATIC NET PC Software V15
    affected: mitigation, no fix planned
  • Siemens SIMATIC NET PC Software V16 <V16_Upd3
    affected: fixed in V16, mitigation support.industry.siemens.com
  • Siemens SIMATIC PCS neo <V3.0_SP1
    affected: fixed in V3.0, mitigation
  • Siemens SIMATIC ProSave <V17
    affected: fixed in V17, mitigation
  • Siemens SIMATIC S7-1500 Software Controller <V21.8
    affected: fixed in V21.8, mitigation support.industry.siemens.com
  • Siemens SIMATIC STEP 7 (TIA Portal) V13 <V13_SP2_Update_4
    affected: fixed in V13, mitigation support.industry.siemens.com
show 18 more

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Siemens SIMATIC Automation Tool
  • Siemens SIMATIC NET PC Software V14
  • Siemens SIMATIC NET PC Software V15
  • Siemens SIMATIC NET PC Software V16
  • Siemens SIMATIC PCS neo
  • Siemens SIMATIC ProSave
  • Siemens SIMATIC S7-1500 Software Controller
  • Siemens SIMATIC STEP 7 (TIA Portal) V13
  • Siemens SIMATIC STEP 7 (TIA Portal) V14
  • Siemens SIMATIC STEP 7 (TIA Portal) V15
  • Siemens SIMATIC STEP 7 (TIA Portal) V16
  • Siemens SIMATIC STEP 7 V5
  • Siemens SIMATIC WinCC OA V3.16
  • Siemens SIMATIC WinCC OA V3.17
  • Siemens SIMATIC WinCC Runtime Advanced
  • Siemens SIMATIC WinCC Runtime Professional V13
  • Siemens SIMATIC WinCC Runtime Professional V14
  • Siemens SIMATIC WinCC Runtime Professional V15
  • Siemens SIMATIC WinCC Runtime Professional V16
  • Siemens SIMATIC WinCC V7.4
  • Siemens SIMATIC WinCC V7.5
  • Siemens SINAMICS STARTER
  • Siemens SINAMICS Startdrive
  • Siemens SINEC NMS
  • Siemens SINEMA Server
  • Siemens SINUMERIK ONE virtual
  • Siemens SINUMERIK Operate

Classification

Weakness
  • CWE-428 Unquoted Search Path or Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.