CVE-2024-35783: Siemens SIMATIC RCE Vulnerability

CVE-2024-35783 Overview

CVE-2024-35783 affects multiple Siemens SIMATIC industrial automation products. The flaw stems from the database (DB) server running with elevated operating system privileges. An authenticated attacker can leverage this configuration to execute arbitrary OS commands with administrative rights on the host. The vulnerability is classified under [CWE-250: Execution with Unnecessary Privileges] and impacts core components used across process control, batch automation, historian, and HMI environments. Siemens disclosed the issue in advisory SSA-629254. Although exploitation requires authentication, successful abuse compromises confidentiality, integrity, and availability of the underlying Windows host running the affected SIMATIC product.

Critical Impact

Authenticated attackers can execute arbitrary operating system commands with administrative privileges on systems running affected SIMATIC products, enabling full host compromise within industrial control environments.

Affected Products

• SIMATIC BATCH V9.1, SIMATIC PCS 7 V9.1 (prior to V9.1 SP2 UC06)
• SIMATIC Information Server 2020 / 2022 and SIMATIC Process Historian 2020 / 2022 (prior to listed updates)
• SIMATIC WinCC V7.4, V7.5 (prior to SP2 Update 18), V8.0 (prior to Update 5), and WinCC Runtime Professional V18 / V19

Discovery Timeline

• 2024-09-10 - CVE-2024-35783 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-35783

Vulnerability Analysis

The vulnerability resides in how affected SIMATIC products provision their backing database server process. The DB server is configured to run under a Windows account with administrative privileges rather than a least-privilege service account. Any user authenticated to the DB server can issue commands that the database engine executes in the context of that elevated account. Because authentication-only is required and no further user interaction is needed, the attack path leads directly to arbitrary OS command execution with administrative rights. The issue is a configuration and design flaw rather than a memory corruption or injection bug. The affected products are typically deployed on operator workstations, engineering stations, and process control servers within OT networks, increasing the operational impact of successful exploitation.

Root Cause

The root cause is mapped to [CWE-250]: a process executes with privileges that exceed those required for its function. The SIMATIC DB server inherits administrative rights, so any feature it exposes that can spawn child processes or execute OS-level commands inherits the same rights. Functionality intended for legitimate database administration becomes a privilege escalation primitive when reachable by lower-privileged authenticated users.

Attack Vector

The attack is network-reachable and requires high-privilege authentication to the DB server, but no user interaction. After authenticating, the attacker invokes DB server functionality that triggers OS command execution. Because the server runs as an administrator, the resulting commands execute with administrative privileges on the Windows host. From there, the attacker can install persistence, manipulate historian data, disrupt process control logic, or pivot deeper into the OT network. Refer to the Siemens Security Advisory SSA-629254 for vendor-confirmed technical details.

Detection Methods for CVE-2024-35783

Indicators of Compromise

• Unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by the SIMATIC DB server service process.
• Creation of new local administrator accounts or scheduled tasks on engineering and operator workstations running SIMATIC software.
• Outbound network connections originating from the DB server process to non-SIMATIC hosts.

Detection Strategies

• Baseline expected process trees for SIMATIC DB server services and alert on deviations, particularly shell or scripting interpreter children.
• Monitor authentication logs on the DB server for unusual successful logins, off-hours access, or repeated failures preceding success.
• Correlate Windows Security event IDs 4688 (process creation) and 4624 (logon) with DB server account activity to surface lateral movement.

Monitoring Recommendations

• Forward Windows Sysmon, Security, and SIMATIC application logs to a centralized SIEM for retention and analytics across the OT zone.
• Implement file integrity monitoring on SIMATIC installation directories and historian database paths.
• Track service account behavior changes including new module loads or registry modifications by the DB server process.

How to Mitigate CVE-2024-35783

Immediate Actions Required

• Apply the Siemens-supplied updates for each affected product as listed in advisory SSA-629254.
• Restrict network access to the SIMATIC DB server to trusted engineering hosts using firewall rules and OT network segmentation.
• Rotate credentials for accounts with DB server access and enforce strong, unique passwords with multi-factor authentication where supported.

Patch Information

Siemens has released fixed versions including SIMATIC Information Server V2020 SP2 Update 5, Information Server V2022 SP1 Update 2, SIMATIC PCS 7 V9.1 SP2 UC06, Process Historian V2020 SP2 Update 5, Process Historian V2022 SP1 Update 2, WinCC Runtime Professional V18 Update 5, V19 Update 3, WinCC V7.5 SP2 Update 18, and WinCC V8.0 Update 5. No fix is currently listed for SIMATIC BATCH V9.1 or SIMATIC WinCC V7.4. Consult the Siemens Security Advisory SSA-629254 for the authoritative update matrix.

Workarounds

• Limit DB server access to a minimal set of authenticated administrators and remove unnecessary user accounts.
• Deploy the affected systems within an isolated OT cell behind a properly configured industrial firewall following Siemens operational guidelines.
• Continuously monitor DB server hosts for anomalous process creation and outbound network traffic until patches are applied.

# Configuration example
# Windows firewall example to restrict inbound access to the SIMATIC DB server
# port to a defined engineering workstation subnet (adjust port and subnet to environment)
netsh advfirewall firewall add rule name="SIMATIC DB Restrict" ^
  dir=in action=allow protocol=TCP localport=1433 ^
  remoteip=10.20.30.0/24
netsh advfirewall firewall add rule name="SIMATIC DB Block Other" ^
  dir=in action=block protocol=TCP localport=1433