[UPDATE] Siemens SIMATIC: Vulnerability allows execution of arbitrary code with user privileges
A BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
The BSI report, marked as an update, provides neither a CVE ID nor a CVSS score, so severity and exploit status remain unclear without the underlying Siemens advisory.
Description
The BSI WID report identifies a vulnerability in Siemens SIMATIC that could allow a remote anonymous attacker to bypass security controls and execute arbitrary code with user privileges. The SIMATIC product family is therefore affected, as it is used in industrial control and automation environments. The report is marked as an update but contains no CVE ID, no CVSS score, and no information on whether a proof-of-concept or exploitation in the wild exists. Without these details, severity and patch status cannot be fully assessed; further details are available in the Siemens security advisory.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational