Summary
Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDOM, SIMATIC, SINEMA, SIPROTEC en de Engineering Platforms voor diverse systemen.
Details
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Manipulatie van gegevens
- (Remote) code execution (Administrator/Root rechten)
- (Remote) code execution (Gebruikersrechten)
- Toegang tot systeemgegevens
- Toegang tot gevoelige gegevens
- Verhoogde gebruikersrechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
Vulnerabilities 53
-
Critical 9.6
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
Critical 9.0
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…
-
High 8.8
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications ar…
-
High 8.8
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications ar…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3…
-
High 8.8
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
High 8.8
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
High 7.8
Siemens Teamcenter Visualization and JT2Go Out-of-bounds Read
The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application is vulnerable t…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain a stac…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out…
-
High 7.8
A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (…
-
High 7.8
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of af…
-
High 7.8
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of af…
-
High 7.6
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not …
-
High 7.6
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not …
-
High 7.5
OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability
OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authenticati…
-
High 7.5
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i8…
-
High 7.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
High 7.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
High 7.5
A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the …
-
Medium 6.7
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, Forti…
-
Medium 6.6
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All ve…
-
Medium 6.6
A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of af…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
Medium 6.5
A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected products allow …
-
Medium 6.3
A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications d…
-
Medium 6.3
A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through…
-
Medium 6.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
Medium 6.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do…
-
Medium 6.2
An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in Forti…
-
Medium 5.9
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…
-
Medium 5.9
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Profess…
-
Medium 5.9
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All v…
-
Medium 5.3
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (…
-
Medium 4.3
A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
Medium 4.0
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do…
-
Low 3.3
A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (…
-
Low 1.7CVE-2024-21754 Public exploit
A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 a…
Revision history
-
#0
Initiele versie
References
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-064222.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-088132.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-170375.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-313039.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-364175.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-381581.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-698820.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-722010.pdf
-
Reference - siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-723487.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-750499.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-779936.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-824889.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-868282.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-883918.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-928781.pdf
-
Reference - ncscclear; siemens
https://cert-portal.siemens.com/productcert/pdf/ssa-998949.pdf