CVE record · CVE-2023-32736

Deserialization of untrusted data in Siemens SIMATIC S7-PLCSIM V16 and others

CVSS 7.0 HighEPSS 0.0022 · 12th percentile

Published by the CVE Program (CNA: siemens) at 12 Nov 2024, 12:49 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Siemens	SIMATIC S7-PLCSIM V16	affected before * custom Other versions: unknown
Siemens	SIMATIC S7-PLCSIM V17	affected before * custom Other versions: unknown
Siemens	SIMATIC STEP 7 Safety V16	affected before * custom Other versions: unknown
Siemens	SIMATIC STEP 7 Safety V17	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIMATIC STEP 7 Safety V18	affected before V18 Update 5 custom Other versions: unknown
Siemens	SIMATIC STEP 7 V16	affected before * custom Other versions: unknown
Siemens	SIMATIC STEP 7 V17	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIMATIC STEP 7 V18	affected before V18 Update 5 custom Other versions: unknown
Siemens	SIMATIC WinCC Unified V16	affected before * custom Other versions: unknown
Siemens	SIMATIC WinCC Unified V17	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIMATIC WinCC Unified V18	affected before V18 SP5 custom Other versions: unknown
Siemens	SIMATIC WinCC V16	affected before * custom Other versions: unknown
Siemens	SIMATIC WinCC V17	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIMATIC WinCC V18	affected before V18 SP5 custom Other versions: unknown
Siemens	SIMOCODE ES V16	affected before * custom Other versions: unknown
Siemens	SIMOCODE ES V17	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIMOCODE ES V18	affected before * custom Other versions: unknown
Siemens	SIMOTION SCOUT TIA V5.4 SP1	affected before * custom Other versions: unknown
Siemens	SIMOTION SCOUT TIA V5.4 SP3	affected before * custom Other versions: unknown
Siemens	SIMOTION SCOUT TIA V5.5 SP1	affected before * custom Other versions: unknown
Siemens	SINAMICS Startdrive V16	affected before * custom Other versions: unknown
Siemens	SINAMICS Startdrive V17	affected before * custom Other versions: unknown
Siemens	SINAMICS Startdrive V18	affected before * custom Other versions: unknown
Siemens	SIRIUS Safety ES V17 (TIA Portal)	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIRIUS Safety ES V18 (TIA Portal)	affected before * custom Other versions: unknown
Siemens	SIRIUS Soft Starter ES V17 (TIA Portal)	affected before V17 Update 8 custom Other versions: unknown
Siemens	SIRIUS Soft Starter ES V18 (TIA Portal)	affected before * custom Other versions: unknown
Siemens	TIA Portal Cloud V16	affected before * custom Other versions: unknown
Siemens	TIA Portal Cloud V17	affected before V4.6.0.1 custom Other versions: unknown
Siemens	TIA Portal Cloud V18	affected before V4.6.1.0 custom Other versions: unknown

Identifiers: CVE-2023-32736
CNA: siemens
Weakness (CWE): CWE-502
Tags: Siemens SIMATIC S7-PLCSIM V16
Siemens SIMATIC S7-PLCSIM V17
Siemens SIMATIC STEP 7 Safety V16
Siemens SIMATIC STEP 7 Safety V17
Siemens SIMATIC STEP 7 Safety V18
Siemens SIMATIC STEP 7 V16
Siemens SIMATIC STEP 7 V17
Siemens SIMATIC STEP 7 V18
Insecure deserialization
Published: 12 Nov 2024
Updated: 14 Jan 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.3	High	3.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	CNA (siemens)
7.0	High	4.0	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	CNA (siemens)Used for this record

CISA KEV Not listed.
EPSS 0.0022, the 12th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 12 Nov 2024. New records show when each source confirmed them.

Sources

References from the CNA

cert-portal.siemens.com/productcert/html/ssa-871035.html

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.