Siemens SIMATIC STEP 7 DLL Vulnerability

An attacker with access to a user's engineering workstation could execute arbitrary code with the privileges of that user, potentially allowing modification of PLC programs or control system configurations.

Engineering staff and automation engineers who use SIMATIC STEP 7 (versions before 5.5 SP1) or SIMATIC PCS 7 (version 7.1 SP3 or earlier) on their workstations to develop, test, or modify PLC and control system logic for water treatment plants, SCADA systems, or manufacturing processes.

An attacker would need to trick a user into opening a malicious file (likely a DLL or project file) on an engineering workstation running SIMATIC STEP 7 or PCS 7. When the software processes the file, the attacker's code executes within the engineering environment, potentially allowing them to modify control logic or steal configuration data.