Deserialization Vulnerability in SIMATIC STEP 7 (TIA Portal) before V18 Update 2

An attacker who can interact with the engineering workstation running SIMATIC STEP 7 or PCS neo could execute arbitrary code on that system, potentially allowing them to modify control logic, alter PLC programs, or insert malicious logic into industrial systems.

This affects engineering teams using SIMATIC STEP 7 (TIA Portal) for PLC programming and configuration. Specifically: organizations running V16 or V17 have no patch available and must rely on operational controls; organizations running V18 can patch to Update 2 or later; and organizations using SIMATIC PCS neo V4.0 have no patch available. The risk is primarily to the engineering workstations themselves, not directly to PLCs or field devices, but a compromised workstation could be used to inject malicious code into production control systems.

An attacker must deliver a specially crafted file or input to a user of the affected TIA Portal application. When the user opens or processes the malicious file, the .NET deserialization vulnerability is triggered, causing the application to instantiate arbitrary code objects. Since this requires user interaction (opening a file), the attack vector is local, not remote network-based.