A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3),…

Description

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). A buffer overflow vulnerability could allow a local attacker to cause a Denial-of-Service situation. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information.

Scores

EPSS (exploitation in 30 days)

0.42% · top 63% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

• CWE-122: Heap-based Buffer Overflow (opens in a new tab)All about CWE-122 and its CVEs
• CWE-787 (opens in a new tab)All about CWE-787 and its CVEs

Affected products

• Siemens · SIMATIC PCS 7 V8.2 and earlier

  • affected All versions

• Siemens · SIMATIC PCS 7 V9.0

  • affected All versions < V9.0 SP3

• Siemens · SIMATIC PDM

  • affected All versions < V9.2

• Siemens · SIMATIC STEP 7 V5.X

  • affected All versions < V5.6 SP2 HF3

• Siemens · SINAMICS STARTER (containing STEP 7 OEM version)

  • affected All versions < V5.4 HF2

References (3)

• https://cert-portal.siemens.com/productcert/pdf/ssa-689942.pdf (opens in a new tab)x_refsource_MISCx_transferred
• https://www.us-cert.gov/ics/advisories/icsa-20-161-05 (opens in a new tab)x_refsource_MISCx_transferred
• https://us-cert.cisa.gov/ics/advisories/icsa-20-161-05 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-7586](https://trackcve.app/badge/CVE-2020-7586.svg)](https://trackcve.app/cve/CVE-2020-7586)

Record last updated 4 Aug 2024, 09:33 UTC.