Skip to Content

SiePortal

The integrated platform for your product selection, buying and support workflow - bringing together Industry Mall and Online Support.

SiePortalDeutsch

Search

Home
Support Support
{{(apiData.Support | filter:{'rank':1}:true)[0].title}} Support
- Menu temporary not available
- Menu temporary not available
- Menue temporary not available
- {{item.title}}

Products & Services
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
Support Support
{{(apiData.Support | filter:{'rank':1}:true)[0].title}} Support
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
MySiePortal MySiePortal
{{(apiData.MySiePortal | filter:{'rank':1}:true)[0].title}} MySiePortal
- Menu temporary not available
- Menue temporary not available
- {{item.title}}
Cart ({{apiData.CartCount}})

Navigation

WinCC Apache Log4j Vulnerabilities “Log4Shell” - What happened with the line "All versions < V7.4 SP1" ?

Created by: koco747 at: 12/16/2021 11:40 AM (4 Replies)

Rating (0)

Thanks 0

5 Entries

12/16/2021 11:40 AM	Rate (0)
koco747 Advanced Member Joined: 6/2/2009 Last visit: 12/5/2025 Posts: 7 Rating: (1)	Siemens removed WinCC v7.4 from the list. That is correct But what about all the versions before v7.4. What happened with the line "All versions < V7.4 SP1" ? ------------------------------------------------------------------------------------------ Split from WinCC Apache Log4j Vulnerabilities “Log4Shell”.
	Last edited by: Jen_Moderator at: 12/16/2021 13:30:55 New subject after splitting
Suggestion To thank Quote Answer

12/16/2021 2:02 PM	Rate (0)
bg2492 Posts: 7298 Rating: (2188)	Hello ko_co, the last information is, only with WinCC V7.4 (without Servicepack) "Log4J" was used. You should upgrade it to V7.4 SP1. All older versions and newer versions are not involved. Regards Georg Berghof
bg2492 Posts: 7298 Rating: (2188)
Suggestion To thank Quote Answer

12/16/2021 2:39 PM	Rate (0)
koco747 Advanced Member Joined: 6/2/2009 Last visit: 12/5/2025 Posts: 7 Rating: (1)	Hello Georg Berghof Thanks for the info. Where did you find this information or did you get this info directly from Siemens? So for versions v7.0 - v7.3 log4j was never used? BR ko_co

Suggestion To thank Quote Answer

12/17/2021 4:24 PM	Rate (0)
bg2492 Posts: 7298 Rating: (2188)	Hello ko_co, see the pdf-Dokument: https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf the newest information is: Note: the following products were temporarily listed as affected. They were removed after closer investigation showed that they are not affected: • SIMATIC WinCC V7.4 (listed as affected in V1.0-V1.1 of the advisory) • LOGO! Soft Comfort (listed as affected in V1.0-V1.2 of the advisory) For more details regarding the Log4j vulnerabilities refer to https://logging.apache.org/log4j/2.x/security.html That means no version of WinCC is affected. Regards Georg Berghof
bg2492 Posts: 7298 Rating: (2188)
Suggestion To thank Quote Answer

12/17/2021 5:33 PM	Rate (0)
Jen_Moderator Posts: 8171 Rating: (174)	Dear users and customers, thank you for your question. This is the information we got from Product Management CERT: Product Management CERT WinCC V7.4 < V7.4 SP1 was listed in the Advisory. There was an suspicion that it is affected. The suspicion has not been confirmed. This is the reason why the hint was canceled. We will keep you up to date with all the relevant information within our cert advisories. Best regards, Jen_Moderator
Jen_Moderator Posts: 8171 Rating: (174)
Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on