IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20

HIGH
CVSS 7.8
Date 2026-10-13T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter "Additional Information" below for more details.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2024-49849 7.8 high
CVE-2024-49849. Affected products do not properly sanitize user-controllable input when parsing log files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

// Affected Products (28)

Vendor Product Asset Type Purdue Level Firmware
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown plc
L1
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown plc
L1
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--

// Remediations (21)

Patch: TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version
TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V5.6 SP1 HF7 or later version
Update to V5.6 SP1 HF7 or later version
Mitigation: Avoid opening untrusted files from unknown sources in affected products
Avoid opening untrusted files from unknown sources in affected products
Patch: TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version
TIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Mitigation: Avoid opening untrusted files from unknown sources in affected products
Avoid opening untrusted files from unknown sources in affected products
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V5.6 SP1 HF7 or later version
Update to V5.6 SP1 HF7 or later version
Patch: Update to V6.3.0.2 or later version
Update to V6.3.0.2 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version

// References