CVE:CVE-2016-7165
CNNVD:CNNVD-201611-301
Siemens SIMATIC WinCC等都是德国西门子（Siemens）公司的工业自动化产品。Siemens SIMATIC WinCC是一套自动化的数据采集与监控（SCADA）系统；SIMATIC PCS 7是一套使用了WinCC的分布式过程控制系统。
多款Siemens产品存在非引用Windows搜索路径漏洞，该漏洞源于当程序安装时没有使用%PROGRAMFILES%目录。本地攻击者可借助特制的木马文件利用该漏洞获取特权。以下产品和版本受到影响：Siemens SIMATIC WinCC 7.0 SP2 Upd 12之前的版本，Upd 8之前的7.0 SP3版本，7.2至7.4版本；SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced 14之前的版本；SIMATIC WinCC Runtime Professional；SIMATIC WinCC (TIA Portal) Professional；SIMATIC STEP 7 5.x版本；SIMATIC STEP 7 (TIA Portal) before 14；SIMATIC NET PC-Software 14之前的版本；TeleControl Server Basic 3.0 SP2之前的版本；SINEMA Server 13 SP2之前的版本；SIMATIC PCS 7至8.2版本；SINEMA Remote Connect Client；SIMATIC WinAC RTX 2010 SP2；SIMATIC WinAC RTX F 2010 SP2；SIMATIC IT Production Suite；SOFTNET Security Client 5.0版本；SIMIT 9.0版本；Security Configuration Tool (SCT)；Primary Setup Tool (PST)。
solution:Upgrade siemens primary_setup_tool to a higher version than -; Upgrade siemens security_configuration_tool to a higher version than -; Upgrade siemens simatic_it_production_suite to a higher version than -; Upgrade siemens simatic_net_pc_software to a higher version than 14.0,and avoid the version (,14.0]; Upgrade siemens simatic_pcs_7 to a higher version than 7.1,and avoid the version (,7.1]; Upgrade siemens simatic_pcs7 to a higher version than 8.0,8.1,8.2,and avoid the version 8.0,8.1,8.2; Upgrade siemens simatic_step_7 to a higher version than *:sp4,and avoid the version *:sp4; Upgrade siemens simatic_step_7_(tia_portal) to a higher version than 14.0,and avoid the version (,14.0]; Upgrade siemens simatic_winac_rtx_2010 to a higher version than -; Upgrade siemens simatic_winac_rtx_f_2010 to a higher version than -; Upgrade siemens simatic_wincc to a higher version than *:sp2,7.0:sp3,7.2,7.3,7.4,and avoid the version *:sp2,7.0:sp3,7.2,7.3,7.4; Upgrade siemens simatic_wincc_(tia_portal) to a higher version than 14.0,-,and avoid the version (,14.0]; Upgrade siemens simatic_wincc_runtime to a higher version than -; Upgrade siemens simit to a higher version than 9.0,and avoid the version 9.0; Upgrade siemens sinema_remote_connect to a higher version than -; Upgrade siemens sinema_server to a higher version than *:sp2,and avoid the version *:sp2; Upgrade siemens softnet_security_client to a higher version than 5.0,and avoid the version (,5.0]; Upgrade siemens telecontrol_basic to a higher version than *:sp2,and avoid the version *:sp2