Siemens SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER Insufficiently Qualified Paths (Update A)

An attacker with local access to an engineering workstation could inject malicious code into the software supply chain or escalate privileges to modify control system configurations, potentially affecting PLC logic, process parameters, or HMI settings across connected industrial systems.

Operators of water utilities, municipal electric systems, chemical facilities, and other critical infrastructure that use Siemens engineering workstations to configure or maintain SIMATIC S7 PLCs, safety systems (SIMOTION), and distributed control systems (PCS 7). Any organization relying on these tools to develop or modify control logic is at risk if engineering workstations are not properly isolated from untrusted network access.

An attacker with local or network access to an engineering workstation running affected Siemens software could plant a malicious library or executable in an insufficiently protected directory path. When the application or Windows searches for dependencies, it loads the attacker's code instead of the legitimate component, executing with the application's privileges and potentially allowing modification of control logic or engineering projects before deployment to PLCs and process control systems.