Summary
Siemens heeft kwetsbaarheden verholpen in diverse producten als SIMATIC, SINEC, SIMAC, RUGGEDCOM, SIMOTION, SINAMICS, SIPROTEC en SINUMERIK.
Details
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
* Denial-of-Service (DoS)
* Cross-Site Scripting
* Manipulatie van gegevens
* Omzeilen van een beveiligingsmaatregel
* (Remote) code execution (SYSTEM rechten)
* (Remote) code execution (Gebruikersrechten)
* Toegang tot gevoelige gegevens
* Verhogen van rechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 34
-
Critical 9.1
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not pr…
-
High 8.3
A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versi…
-
High 8.2
Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or re…
-
High 7.8
The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code whe…
-
High 7.8
A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Upd…
-
High 7.8
A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All ve…
-
High 7.8
A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All ve…
-
High 7.8
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected …
-
High 7.6
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGG…
-
High 7.4
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected …
-
High 7.4
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions). The affected applica…
-
High 7.3
gzip integer overflow
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
-
High 7.3
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected …
-
High 7.0
eventfd double close
libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.
-
Medium 6.9
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used …
-
Medium 6.5
Gnutls: vulnerability in gnutls othername san export
A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call as…
-
Medium 6.5
Gnutls: vulnerability in gnutls certtool template parsing
A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write,…
-
Medium 6.5
Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()
A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
-
Medium 6.3
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locat…
-
Medium 6.2
When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the …
-
Medium 6.2
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not pro…
-
Medium 6.2
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POW…
-
Medium 6.2
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POW…
-
Medium 6.1
pam_cap: Fix potential configuration parsing error
The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited ca…
-
Medium 5.6
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial…
-
Medium 5.5
fs/proc: fix softlockup in __read_vmcore (part 2)
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix softlockup in __read_vmcore (part 2) Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the number of softlockups in __read_vmcore at kdump time have gone dow…
-
Medium 5.5
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), …
-
Medium 5.5CVE-2025-40766 Public exploit
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected …
-
Medium 5.3
Gnutls: vulnerability in gnutls sct extension parsing
A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a …
-
Medium 4.3
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it di…
-
Medium 4.1
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGG…
-
Low 3.7
Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601().
A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.
-
Low 3.2
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the e…
-
Low 2.4
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V10.0), SIPROTEC 5 6MD85 (CP300) (All v…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-094954.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-177847.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-186293.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-282044.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-493396.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-493787.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-517338.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-529291.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-665108.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-674084.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-707630.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-894058.html