Siemens COMOS

Summary

Vulnerabilities 2

• Critical 9.4
  CVE-2023-45133

  Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

  Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution duri…

  babel babel node-babel7 node-babel7 Debian Ubuntu npm
  Oct 12, 2023
• High 8.7
  CVE-2024-0056

  Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

  Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

  Microsoft Microsoft SQL Server 2022 (GDR) Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet
  Jan 9, 2024

Revision history

1. 2025-11-11 #1

   Publication Date

References

• SSA-682326: Multiple Vulnerabilities in COMOS before V10.4.5 - HTML Version
  https://cert-portal.siemens.com/productcert/html/ssa-682326.html
• ICS Advisory ICSA-25-317-15 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-15
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b