CVE record · CVE-2020-7580

Unquoted search path in Siemens SIMATIC Automation Tool and others

No CVSS scoreEPSS 0.0046 · 40th percentile

Published by the CVE Program (CNA: siemens) at 10 Jun 2020, 00:00 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Siemens	SIMATIC Automation Tool	affected All versions < V4 SP2
Siemens	SIMATIC NET PC Software V14	affected All versions < V14 SP1 Update 14
Siemens	SIMATIC NET PC Software V15	affected All versions
Siemens	SIMATIC NET PC Software V16	affected All versions < V16 Upd3
Siemens	SIMATIC PCS neo	affected All versions < V3.0 SP1
Siemens	SIMATIC ProSave	affected All versions < V17
Siemens	SIMATIC S7-1500 Software Controller	affected All versions < V21.8
Siemens	SIMATIC STEP 7 (TIA Portal) V13	affected All versions < V13 SP2 Update 4
Siemens	SIMATIC STEP 7 (TIA Portal) V14	affected All versions < V14 SP1 Update 10
Siemens	SIMATIC STEP 7 (TIA Portal) V15	affected All versions < V15.1 Update 5
Siemens	SIMATIC STEP 7 (TIA Portal) V16	affected All versions < V16 Update 2
Siemens	SIMATIC STEP 7 V5	affected All versions < V5.6 SP2 HF3
Siemens	SIMATIC WinCC OA V3.16	affected All versions < V3.16 P018
Siemens	SIMATIC WinCC OA V3.17	affected All versions < V3.17 P003
Siemens	SIMATIC WinCC Runtime Advanced	affected All versions < V16 Update 2
Siemens	SIMATIC WinCC Runtime Professional V13	affected All versions < V13 SP2 Update 4
Siemens	SIMATIC WinCC Runtime Professional V14	affected All versions < V14 SP1 Update 10
Siemens	SIMATIC WinCC Runtime Professional V15	affected All versions < V15.1 Update 5
Siemens	SIMATIC WinCC Runtime Professional V16	affected All versions < V16 Update 2
Siemens	SIMATIC WinCC V7.4	affected All versions < V7.4 SP1 Update 14
Siemens	SIMATIC WinCC V7.5	affected All versions < V7.5 SP1 Update 3
Siemens	SINAMICS STARTER	affected All Versions < V5.4 HF2
Siemens	SINAMICS Startdrive	affected All Versions < V16 Update 3
Siemens	SINEC NMS	affected All versions < V1.0 SP2
Siemens	SINEMA Server	affected All versions < V14 SP3
Siemens	SINUMERIK ONE virtual	affected All Versions < V6.14
Siemens	SINUMERIK Operate	affected All Versions < V6.14

Identifiers: CVE-2020-7580
CNA: siemens
Weakness (CWE): CWE-428
Tags: Siemens SIMATIC Automation Tool
Siemens SIMATIC NET PC Software V14
Siemens SIMATIC NET PC Software V15
Siemens SIMATIC NET PC Software V16
Siemens SIMATIC PCS neo
Siemens SIMATIC ProSave
Siemens SIMATIC S7-1500 Software Controller
Siemens SIMATIC STEP 7 (TIA Portal) V13
CWE-428
Published: 10 Jun 2020
Updated: 4 Aug 2024

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0046, the 40th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 10 Jun 2020. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.