{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SIMATIC WinCC V7 is affected by a vulnerability that could allow a local attacker to inject arbitrary code and escalate privileges, if a non-default installation path was chosen during installation.\n\nSiemens has released an update for SIMATIC WinCC and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-914026: Local Code Execution Vulnerability in SIMATIC WinCC V7 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-914026.html"
      },
      {
        "category": "self",
        "summary": "SSA-914026: Local Code Execution Vulnerability in SIMATIC WinCC V7 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-914026.json"
      },
      {
        "category": "self",
        "summary": "SSA-914026: Local Code Execution Vulnerability in SIMATIC WinCC V7 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-914026.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-914026: Local Code Execution Vulnerability in SIMATIC WinCC V7 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-914026.txt"
      }
    ],
    "title": "SSA-914026: Local Code Execution Vulnerability in SIMATIC WinCC V7",
    "tracking": {
      "current_release_date": "2023-06-13T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-914026",
      "initial_release_date": "2023-06-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-06-13T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV7.5.2.13",
                "product": {
                  "name": "SIMATIC WinCC",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-30897",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected applications fail to set proper access rights for their installation folder if a non-default installation path was chosen during installation.\r\n\r\nThis could allow an authenticated local attacker to inject arbitrary code and escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application server to prevent local access by untrusted personnel",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "After installation to a non-default folder, ensure that the access permissions of that folder are equal to the permissions of the \nProgram Files folder",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Always use the default installation path when installing SIMATIC WinCC V7",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V7.5.2.13 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793460/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-30897"
    }
  ]
}