NCSC-2025-0160 — Kwetsbaarheden verholpen in Siemens producten

Summary

Siemens heeft kwetsbaarheden verholpen in diverse producten als Apogee, BacNet ATEC, Desigo CC, Intralog, OZW, Polarion, RUGGEDCOM, SICAM, SIMATIC, SIPROTEC, SIRIUS, Teamcenter en Versicharge

Details

Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

- Denial-of-Service (DoS)
- Manipulatie van gegevens
- Omzeilen van een beveiligingsmaatregel
- Omzeilen van authenticatie
- (Remote) code execution (root/admin rechten)
- (Remote) code execution (Gebruikersrechten)
- Toegang tot systeemgegevens
- Toegang tot gevoelige gegevens
- Spoofing

De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.

Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.

Vulnerabilities 31

Critical 10.0

CVE-2025-26389

A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in a…

Siemens OZW672 OZW772 ICS / OT

May 13, 2025
Critical 9.8

CVE-2025-26390

A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of a…

Siemens OZW772 OZW672 ICS / OT

May 13, 2025
Critical 9.0

CVE-2024-3596 Public exploit EPSS 15%

RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

IETF RFC krb5 freeradius Debian Ubuntu Alpine

Jul 9, 2024
High 8.8

CVE-2025-31930

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions < V2.135), IEC 1Ph…

Siemens IEC 1Ph 7.4kW Parent cable 7m incl. SIM IEC ERK 3Ph 22 kW Parent socket IEC 3Ph 22kW Parent cable 7m incl. SIM ICS / OT

May 13, 2025
High 8.8

CVE-2025-40566

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All v…

Siemens SIMATIC PCS neo V5.0 SIMATIC PCS neo V4.1 ICS / OT

May 13, 2025
High 8.7

CVE-2024-0056

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Microsoft Microsoft SQL Server 2022 (GDR) Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Jan 9, 2024
High 8.1

CVE-2024-35264

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.8 Ubuntu Alpine NuGet

Jul 9, 2024
High 7.8

CVE-2025-32454

A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.14), Teamcenter Visualiza…

Siemens Teamcenter Visualization V14.3 Teamcenter Visualization V2312 Tecnomatix Plant Simulation V2404 ICS / OT

May 13, 2025
High 7.5

CVE-2024-20672

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

Microsoft .NET 6.0 .NET 7.0 dotnet8-runtime Alpine

Jan 9, 2024
High 7.5

CVE-2024-23815

A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is …

Siemens Desigo CC ICS / OT

May 13, 2025
High 7.5

CVE-2024-30105

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.8 Ubuntu Alpine Wolfi NuGet

Jul 9, 2024
High 7.5

CVE-2024-38095

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.8 Ubuntu Alpine Wolfi NuGet

Jul 9, 2024
High 7.5

CVE-2024-43483

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Oct 8, 2024
High 7.5

CVE-2024-43485

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.8 .NET 6.0 Ubuntu Alpine NuGet

Oct 8, 2024
High 7.5

CVE-2025-24007

A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK…

Siemens SIRIUS Safety Relays 3SK2 SIRIUS 3RK3 Modular Safety System (MSS) ICS / OT

May 13, 2025
High 7.5

CVE-2025-30174

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC …

Siemens SINEC NMS Totally Integrated Automation Portal (TIA Portal) V18 Totally Integrated Automation Portal (TIA Portal) V17 ICS / OT

May 13, 2025
High 7.5

CVE-2025-30175

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC …

Siemens SINEC NMS Totally Integrated Automation Portal (TIA Portal) V17 Totally Integrated Automation Portal (TIA Portal) V18 ICS / OT

May 13, 2025
High 7.5

CVE-2025-30176

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC …

Siemens SINEC NMS Totally Integrated Automation Portal (TIA Portal) V17 Totally Integrated Automation Portal (TIA Portal) V18 ICS / OT

May 13, 2025
High 7.3

CVE-2024-38081

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jul 9, 2024
Medium 6.5

CVE-2024-51444

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The appl…

Siemens Polarion V2404 Polarion V2310 ICS / OT

May 13, 2025
Medium 6.5

CVE-2024-51445

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affe…

Siemens Polarion V2404 Polarion V2310 ICS / OT

May 13, 2025
Medium 6.5

CVE-2024-51446

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file…

Siemens Polarion V2404 Polarion V2310 ICS / OT

May 13, 2025
Medium 6.5

CVE-2025-24008

A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK…

Siemens SIRIUS Safety Relays 3SK2 SIRIUS 3RK3 Modular Safety System (MSS) ICS / OT

May 13, 2025
Medium 6.5

CVE-2025-24510

A vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle spe…

Siemens MS/TP Point Pickup Module ICS / OT

May 13, 2025
Medium 6.5

CVE-2025-40556

A vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet A…

Siemens BACnet ATEC 550-441 BACnet ATEC 550-446 BACnet ATEC 550-440 ICS / OT

May 13, 2025
Medium 5.9

CVE-2025-24009

A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK…

Siemens SIRIUS Safety Relays 3SK2 SIRIUS 3RK3 Modular Safety System (MSS) ICS / OT

May 13, 2025
Medium 5.3

CVE-2024-51447

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The logi…

Siemens Polarion V2404 Polarion V2310 ICS / OT

May 13, 2025
Medium 4.7

CVE-2025-40555

A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). Affected devices start sendi…

Siemens APOGEE PXC+TALON TC Series (BACnet) ICS / OT

May 13, 2025
Medium 4.2

CVE-2025-31929

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions), IEC 1Ph 7.4kW Ch…

Siemens IEC 1Ph 7.4kW Parent socket/ shutter SIM UL Commercial Child 48A BA Compliant IEC 1Ph 7.4kW Child socket ICS / OT

May 13, 2025
Low 3.5

CVE-2024-52963

A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.…

Fortinet FortiOS FortiProxy FortiPAM Network devices

Jan 14, 2025
Low 2.1

CVE-2024-32122

A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS …

Fortinet FortiOS Network devices

Apr 8, 2025

Revision history

2025-05-14 #1.0.0
Initiele versie

References

Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-047424.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-162255.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-222768.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-339086.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-523418.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-542540.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-556937.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-614723.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-668154.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-718393.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-794185.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-828116.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-864900.pdf
Reference - ncscclear
https://cert-portal.siemens.com/productcert/pdf/ssa-901508.pdf

Kwetsbaarheden verholpen in Siemens producten

Summary

Details

Vulnerabilities 31

A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in a…

A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of a…

RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions < V2.135), IEC 1Ph…

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All v…

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.14), Teamcenter Visualiza…

.NET Denial of Service Vulnerability

A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is …

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK…

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC …

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC …

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC …

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The appl…

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affe…

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file…

A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK…

A vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle spe…

A vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet A…

A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK…

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The logi…

A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). Affected devices start sendi…

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions), IEC 1Ph 7.4kW Ch…

A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.…

A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS …

Revision history

References