Summary
Multiple Siemens products are affected by a type confusion vulnerability in Google Chrome prior to 138.0.7204.96. This could allow a remote attacker to perform arbitrary code execution via a crafted HTML page.
Siemens has released a new version for Industrial Edge App Publisher and recommends to update to the latest version. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 1
-
High 8.1
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write …
KEV Jul 2, 2025
Revision history
-
#3
Initial Republication of Siemens ProductCERT SSA-365200 advisory
-
#2
Added remediation for HyperLynx
-
#1
Publication Date
References
-
SSA-365200: Google Chrome Type Confusion Vulnerability in Siemens Products - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-365200.html
-
ICS Advisory ICSA-25-289-10 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-10
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b