CVE-2023-32737: 
Siemens SIMATIC STEP 7 vulnerability analysis and mitigation

A vulnerability (CVE-2023-32737) has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). The vulnerability stems from applications not properly restricting the .NET BinaryFormatter when deserializing user-controllable input. This vulnerability was disclosed on July 9, 2024, and affects the SIMATIC STEP 7 Safety software system (Siemens Advisory).

The vulnerability is classified as a Deserialization of Untrusted Data (CWE-502) issue. The affected applications fail to properly restrict the .NET BinaryFormatter during the deserialization of user-controllable input, which can lead to type confusion. The vulnerability has been assigned a CVSS v3.1 base score of 6.3 (MEDIUM) with the vector string AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H, and a CVSS v4.0 base score of 7.0 (HIGH) with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (CISA Advisory).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code within the affected application. The vulnerability affects confidentiality, integrity, and availability of the system, with all three aspects rated as High in the CVSS scoring (CISA Advisory).

The vulnerability requires local access and is not exploitable remotely. It requires high privileges and user interaction for successful exploitation. No known public exploitation specifically targeting this vulnerability has been reported (CISA Advisory).

Siemens has released several mitigations and recommendations: 1) Update to SIMATIC STEP 7 Safety V18 Update 2 or later version, 2) Avoid uploading PLC software from untrusted devices or MMC cards, 3) Protect network access to devices with appropriate mechanisms, and 4) Configure the environment according to Siemens' operational guidelines for industrial security (Siemens Advisory).