Siemens SIMATIC PCS neo

An attacker with access to the engineering network could exploit these vulnerabilities to execute code, manipulate process configurations, or extract data from the SIMATIC PCS neo engineering workstations, potentially affecting the design and deployment of control logic to field devices.

Operators of industrial process automation systems using Siemens SIMATIC PCS neo (a process control engineering platform) running versions prior to 4.1. This affects plants and facilities that use PCS neo for designing, configuring, and monitoring automated processes in manufacturing, utilities, and chemical industries.

An attacker must be on the same adjacent network (not internet-reachable) as a SIMATIC PCS neo workstation and trick a user to interact with a malicious input. This could involve sending a specially crafted SQL injection or cross-site scripting payload through the application. Once triggered, the attacker could run commands or modify project data on the engineering workstation.