Summary
Siemens heeft kwetsbaarheden verholpen in diverse producten als Questa/ModelSIM, RUGGEDCOM, SENTRON, SIMATIC, SINEC, Tecnomatix en Teamcenter.
Details
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Manipulatie van gegevens
- Omzeilen van een beveiligingsmaatregel
- Omzeilen van authenticatie
- (Remote) code execution (Administrator/Root rechten)
- (Remote) code execution (Gebruikersrechten)
- Toegang tot systeemgegevens
- Verhoogde gebruikersrechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
Vulnerabilities 33
-
Critical 9.9
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does no…
-
Critical 9.8
A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN …
-
High 8.8
An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70. An improper bounds c…
-
High 8.8
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does no…
-
High 7.8
A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (…
-
High 7.8
A vulnerability has been identified in JT2Go (All versions < V2406.0003). The affected application contains a stack-bas…
-
High 7.8
A vulnerability has been identified in Simcenter Femap V2306 (All versions), Simcenter Femap V2401 (All versions), Simc…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
-
High 7.8
A vulnerability has been identified in Simcenter Femap V2306 (All versions), Simcenter Femap V2401 (All versions), Simc…
-
High 7.5
Zigbee Unauthenticated DoS via NWK Sequence number manipulation
Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). vish2.exe in…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). gdb.exe in a…
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2025.2), Questa (All versions < V2025.2). vsimk.exe in…
-
Medium 6.0
Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0
An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited privileges. If a logged-in user with reporting privileges learns how to create a specific application…
-
Medium 5.5
An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds ch…
-
Medium 5.3
The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' …
-
Medium 5.3
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does no…
-
Medium 4.7
The web server of affected devices does not properly validate input that is used for a user redirection. This could all…
-
Medium 4.3
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does no…
-
Low 3.3
A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (…
-
Low 3.3
A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualiza…
Revision history
-
#0
Initiele versie
References
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-054046.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-254396.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-340240.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-368868.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-426509.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-430425.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-583523.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-626178.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-850560.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-852501.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-876787.pdf
-
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-959281.pdf