Introduction
When an attacker compromises an engineering workstation in an industrial environment, operators can lose control of critical infrastructure and production lines. CVE-2024-54678 is a type confusion vulnerability in the interprocess communication of a broad range of Siemens SIMATIC, TIA Portal, and related products, and it exposes them to arbitrary code execution.
About Siemens and Its Industrial Automation Portfolio: Siemens is a dominant vendor in industrial automation, and its SIMATIC and TIA Portal platforms are deployed in manufacturing, utilities, and infrastructure worldwide. Many critical operations run on its engineering and control software, so a vulnerability in these products has a large impact.
Technical Information
CVE-2024-54678 is a type confusion vulnerability caused by improper sanitization of Interprocess Communication (IPC) input received through Windows Named Pipes. The affected Siemens products create Named Pipes that every local user can access, which removes an important security boundary. An attacker with authenticated local access can send specially crafted serialized objects through these pipes. The application does not validate that input when it deserializes it, and the resulting type confusion lets the attacker execute arbitrary code in the application's context.
The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The root cause is that data received through the Named Pipe is neither validated nor sanitized before it reaches unsafe deserialization logic. Exploitation needs local access and no user interaction. It targets shared components that are present in multiple Siemens engineering and automation products.
Affected Systems and Versions
CVE-2024-54678 affects these Siemens products and versions:
- SIMATIC PCS neo V4.1 (All versions)
- SIMATIC PCS neo V5.0 (All versions)
- SIMATIC PCS neo V6.0 (All versions)
- SIMATIC S7-PLCSIM V17 (All versions)
- SIMATIC STEP 7 V17 (All versions)
- SIMATIC STEP 7 V18 (All versions)
- SIMATIC STEP 7 V19 (All versions < V19 Update 4)
- SIMATIC STEP 7 V20 (All versions)
- SIMATIC WinCC V17 (All versions)
- SIMATIC WinCC V18 (All versions)
- SIMATIC WinCC V19 (All versions < V19 Update 4)
- SIMATIC WinCC V20 (All versions)
- SIMOCODE ES V17 (All versions)
- SIMOCODE ES V18 (All versions)
- SIMOCODE ES V19 (All versions)
- SIMOCODE ES V20 (All versions)
- SIMOTION SCOUT TIA V5.4 (All versions)
- SIMOTION SCOUT TIA V5.5 (All versions)
- SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7)
- SIMOTION SCOUT TIA V5.7 (All versions)
- SINAMICS Startdrive V17 (All versions)
- SINAMICS Startdrive V18 (All versions)
- SINAMICS Startdrive V19 (All versions)
- SINAMICS Startdrive V20 (All versions)
- SIRIUS Safety ES V17 (TIA Portal) (All versions)
- SIRIUS Safety ES V18 (TIA Portal) (All versions)
- SIRIUS Safety ES V19 (TIA Portal) (All versions)
- SIRIUS Safety ES V20 (TIA Portal) (All versions)
- SIRIUS Soft Starter ES V17 (TIA Portal) (All versions)
- SIRIUS Soft Starter ES V18 (TIA Portal) (All versions)
- SIRIUS Soft Starter ES V19 (TIA Portal) (All versions)
- SIRIUS Soft Starter ES V20 (TIA Portal) (All versions)
- TIA Portal Cloud V17 (All versions)
- TIA Portal Cloud V18 (All versions)
- TIA Portal Cloud V19 (All versions < V5.2.1.1)
- TIA Portal Cloud V20 (All versions)
- TIA Portal Test Suite V20 (All versions)
Vendor Security History
Siemens has disclosed earlier vulnerabilities in its engineering and automation products, including deserialization flaws and input validation issues. The company runs a ProductCERT team and follows coordinated disclosure practices. Patch response times vary, but Siemens typically issues advisories and guidance for critical vulnerabilities. This vulnerability appears across many products and versions, which shows how hard it is to secure shared components in a large industrial software portfolio.
