Summary
CADRA is affected by multiple zlib and Foxit vulnerabilities.
Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 11
-
High 8.8
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap cor…
KEV Sep 23, 2025 -
High 8.8CVE-2025-13223 Exploited
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap cor…
KEV Nov 19, 2025 -
Critical 9.8
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…
-
High 8.8
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact …
-
High 8.8
pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is a…
-
High 7.5
Nokogiri affected by zlib's Out-of-bounds Write vulnerability
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
-
Medium 4.6
zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw o…
-
Unscored —
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed strea…
-
Unscored —
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper poin…
-
Unscored —
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point…
-
Unscored —
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (unc…
Revision history
-
#2
Initial CISA Republication of Siemens ProductCERT SSA-470355 advisory
-
#1
Publication Date
References
-
SSA-470355: Zlib and Foxit Vulnerabilities in CADRA - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-470355.html
-
ICS Advisory ICSA-26-202-06 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-06
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b