NewsSiemens ProductCERT

    SSA-800126 V1.0: Deserialization Vulnerability in Siemens Engineering Platforms before V20

    Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. Siemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter “Additional Information” below for more details.

    Linked advisories

    Affected vendors and products

    More on SSA-800126

    Other advisories

    Source: https://cert-portal.siemens.com/productcert/html/ssa-800126.html

    ID