A critical code injection vulnerability in multiple Siemens SIMATIC controllers enables attackers to execute arbitrary code through the manipulation of trace files via social engineering.

The vulnerability (CWE-95) stems from improper neutralization of directives in dynamically evaluated code within trace files. An attacker can leverage this by social engineering a legitimate user into importing a crafted file, leading to arbitrary code execution on the controller.

Exploitation allows an attacker to gain full control over critical industrial control systems (ICS). With a CVSS score of 9.6, the potential for unauthorized process modification, safety hazards, and prolonged operational disruption is severe, necessitating urgent attention in OT environments.

Immediate Action: Update the affected Siemens SIMATIC devices to the specified patched firmware versions (V3.1.6, V2.9.9, or V4.1.2) as documented in the vendor advisory.

Proactive Monitoring: Review system logs for unauthorized trace file imports and monitor for unexpected configuration changes or anomalous controller behavior.

Compensating Controls: Enforce strict access control policies regarding the import of files from untrusted sources and maintain air-gapped or segmented networks for critical controllers.

Public Exploit Available: Unknown.

Due to the critical nature of the affected industrial hardware, administrators must perform a risk assessment and schedule firmware updates during the next available maintenance window. Preventing unauthorized file imports is paramount until patching is complete.