{"answers":{"affected":"It affects 17 products.","exploited":"There is no known exploitation of CVE-2020-7580 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2020-7580 yet. Limit exposure of the affected software until one is available.","what":"CVE-2020-7580 is a medium-severity command injection vulnerability in Siemens SIMATIC Automation Tool, published on 10 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-7580 and fix it if it is affected.\n\nWhat it is: CVE-2020-7580 is a medium-severity command injection vulnerability in Siemens SIMATIC Automation Tool, published on 10 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2020-7580 in the wild and no public exploit code.\n\nAffected product: Siemens SIMATIC Automation Tool. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-7580/ (Markdown: https://insights.sbomify.com/CVE-2020-7580/index.md)","id":"CVE-2020-7580","markdown":"https://insights.sbomify.com/CVE-2020-7580/index.md","name":"CVE-2020-7580","record":{"aliases":["GHSA-gw48-mf2p-74mv"],"analysis":{"component_type":"ics_ot","fix_type":"upgrade","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Siemens SIMATIC software","requires_auth":"high_privilege","summary":"Local attackers can execute arbitrary code with SYSTEM privileges due to unquoted paths in helper binary calls within Siemens SIMATIC applications.","user_interaction":"not_required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"siemens","cpe":[{"product":"simatic_automatic_tool","vendor":"siemens"},{"product":"simatic_net_pc","vendor":"siemens"},{"product":"simatic_pcs_7","vendor":"siemens"},{"product":"simatic_pcs_neo","vendor":"siemens"},{"product":"simatic_prosave","vendor":"siemens"},{"product":"simatic_s7-1500_software_controller","vendor":"siemens"},{"product":"simatic_step_7","vendor":"siemens"},{"product":"simatic_wincc","vendor":"siemens"},{"product":"simatic_wincc_open_architecture","vendor":"siemens"},{"product":"simatic_wincc_runtime_advanced","vendor":"siemens"},{"product":"simatic_wincc_runtime_professional","vendor":"siemens"},{"product":"sinamics_startdrive","vendor":"siemens"},{"product":"sinamics_starter_commissioning_tool","vendor":"siemens"},{"product":"sinec_network_management_system","vendor":"siemens"},{"product":"sinema_server","vendor":"siemens"},{"product":"sinumerik_one_virtual","vendor":"siemens"},{"product":"sinumerik_operate","vendor":"siemens"}],"cvss":{"score":6.7,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-428","name":"Unquoted Search Path or Element"}],"description":"A vulnerability has been identified in SIMATIC Automation Tool (All versions \u003c V4 SP2), SIMATIC NET PC Software V14 (All versions \u003c V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions \u003c V16 Upd3), SIMATIC PCS neo (All versions \u003c V3.0 SP1), SIMATIC ProSave (All versions \u003c V17), SIMATIC S7-1500 Software Controller (All versions \u003c V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions \u003c V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions \u003c V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions \u003c V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions \u003c V16 Update 2), SIMATIC STEP 7 V5 (All versions \u003c V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions \u003c V3.16 P018), SIMATIC WinCC OA V3.17 (All versions \u003c V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions \u003c V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions \u003c V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions \u003c V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions \u003c V16 Update 2), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions \u003c V7.5 SP1 Update 3), SINAMICS STARTER (All Versions \u003c V5.4 HF2), SINAMICS Startdrive (All Versions \u003c V16 Update 3), SINEC NMS (All versions \u003c V1.0 SP2), SINEMA Server (All versions \u003c V14 SP3), SINUMERIK ONE virtual (All Versions \u003c V6.14), SINUMERIK Operate (All Versions \u003c V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Command injection in SIMATIC Automation Tool","id":"CVE-2020-7580","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"command_injection","year":"2020"},"n_packages":0,"n_references":2,"next":{"headline":"Privilege escalation in Opcenter Execution Discrete","id":"CVE-2020-7581"},"packages":[],"prev":{"headline":"Cross-site scripting in Spectrum Power™ 5","id":"CVE-2020-7579"},"products":["SIMATIC Automation Tool","SIMATIC NET PC Software V14","SIMATIC NET PC Software V15","SIMATIC NET PC Software V16","SIMATIC PCS neo","SIMATIC ProSave","SIMATIC S7-1500 Software Controller","SIMATIC STEP 7 (TIA Portal) V13","SIMATIC STEP 7 (TIA Portal) V14","SIMATIC STEP 7 (TIA Portal) V15","SIMATIC STEP 7 (TIA Portal) V16","SIMATIC STEP 7 V5","SIMATIC WinCC OA V3.16","SIMATIC WinCC OA V3.17","SIMATIC WinCC Runtime Advanced","SIMATIC WinCC Runtime Professional V13","SIMATIC WinCC Runtime Professional V14","SIMATIC WinCC Runtime Professional V15","SIMATIC WinCC Runtime Professional V16","SIMATIC WinCC V7.4","SIMATIC WinCC V7.5","SINAMICS STARTER","SINAMICS Startdrive","SINEC NMS","SINEMA Server","SINUMERIK ONE virtual","SINUMERIK Operate"],"published":"2020-06-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["Siemens"]},"summary":"Local attackers can execute arbitrary code with SYSTEM privileges due to unquoted paths in helper binary calls within Siemens SIMATIC applications.","url":"https://insights.sbomify.com/CVE-2020-7580/"}