IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20

HIGH
CVSS 7.3
Date 2026-10-13T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

Affected products contain a local arbitrary code execution vulnerability that could allow an attacker to perform actions against the operation system of that environment. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-52051. See the chapter "Additional Information" below for more details.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2024-52051 7.3 high
CVE-2024-52051. The affected devices do not properly sanitize user-controllable input when parsing user settings. This could allow an attacker to locally execute arbitrary commands in the host operating system with the privileges of the user.

// Affected Products (25)

Vendor Product Asset Type Purdue Level Firmware
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown plc
L1
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown plc
L1
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--

// Remediations (20)

Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version
TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version
TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version
Patch: Update to V5.6 SP1 HF7 or later version
Update to V5.6 SP1 HF7 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V5.6 SP1 HF7 or later version
Update to V5.6 SP1 HF7 or later version

// References