A split inside one product family
Siemens’ November 10 advisory on the Brotli decoder vulnerability lists a fixed version for WinCC Open Architecture 3.20 and no fix yet for 3.21. An industrial operator looking only at the product name, or assuming a higher branch number includes the repair, could reach the wrong conclusion for either installation. Siemens identifies 3.20 P17.1 as the fixed point on the older branch.
A defined window for batch production
The same advisory gives a different answer for SIMATIC BRAUMAT and SISTAR, systems used to control recipe-based manufacturing in industries including food and beverages. On the 8.2 line, Siemens lists Update 1 through the releases before Update 5 as affected and identifies Update 5 as the remedy. A plant operating both batch control and supervisory visualization therefore has separate maintenance decisions even where its equipment inventory associates both systems with the same supplier.
What can be closed on a maintenance ticket
For affected products awaiting a fix, Siemens describes temporarily disabling Brotli compression and decompression where the function is unnecessary. That caveat matters to a plant team scheduling work around production. Recording a fixed product build, confirming a temporary mitigation and waiting for a vendor release are distinct states with different implications at the next maintenance window. The advisory identifies potentially affected products and remedies. It reports no resulting production outage.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
