CVE-2022-45147: 
Siemens SIMATIC STEP 7 vulnerability analysis and mitigation

A vulnerability (CVE-2022-45147) has been identified in multiple Siemens SIMATIC products, including PCS neo V4.0, STEP 7 V16, V17, and V18 (versions prior to V18 Update 2). The vulnerability was disclosed on July 9, 2024, and involves improper restriction of the .NET BinaryFormatter when deserializing user-controllable input (Siemens Advisory).

The vulnerability is classified as a Deserialization of Untrusted Data (CWE-502) issue. It has received a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and a CVSS v4.0 base score of 8.5 with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability is related to the same issue that exists for .NET BinaryFormatter as documented in Microsoft's code quality guidelines (Siemens Advisory, CISA Advisory).

If successfully exploited, this vulnerability could allow an attacker to cause type confusion and execute arbitrary code within the affected application. The vulnerability affects critical manufacturing sectors and has potential worldwide impact (CISA Advisory).

The vulnerability requires local access and user interaction for exploitation. No known public exploitation specifically targeting this vulnerability has been reported, and it is not exploitable remotely (CISA Advisory).

Siemens has released an update for SIMATIC STEP 7 (TIA Portal) V18 and recommends updating to V18 Update 2 or later version. For products where fixes are not available, Siemens recommends avoiding opening untrusted files from unknown sources in affected products. Additionally, users should protect network access to devices with appropriate mechanisms and configure the environment according to Siemens' operational guidelines for industrial security (Siemens Advisory).