Summary
Siemens heeft kwetsbaarheden verholpen in diverse producten als Building X, COMOS, Energy Services, Gridscale X, NX, RUGGEDCOM, SICAM, SIMATIC, SINEC, SINEMA, SIPLUS en Solid Edge.
Details
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Manipulatie van gegevens
- Omzeilen van een beveiligingsmaatregel
- (Remote) code execution (root/admin rechten)
- Toegang tot systeemgegevens
- Toegang tot gevoelige gegevens
- Verhogen van rechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
Vulnerabilities 124
-
High 8.3
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allo…
KEV Mar 27, 2025 -
High 7.8
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. T…
KEV Jun 2, 2026 -
High 7.8
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in co…
KEV Apr 25, 2022 -
Critical 10.0CVE-2024-47875 Public exploit
DOMPurify nesting-based mXSS
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.
-
Critical 9.9
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER …
-
Critical 9.8
out-of-bounds write when there are many bzip2 selectors
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
-
Critical 9.8
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate paramet…
-
Critical 9.8
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…
-
Critical 9.8
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA0…
-
Critical 9.8
gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CO…
-
Critical 9.1
cifs: potential buffer overflow in handling symlinks
In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max…
-
High 8.8
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate paramet…
-
High 8.8
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with …
-
High 8.8
cifs: fix double free race when mount fails in cifs_get_root()
In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free…
-
High 8.8
net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free.
-
High 8.8
net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free.
-
High 8.8
NFC: nci: Bounds check struct nfc_target arrays
In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Bounds check struct nfc_target arrays While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target->sens…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versi…
-
High 8.6
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandl…
-
High 8.1
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT B…
-
High 8.1
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive in…
-
High 7.8
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_…
-
High 7.8CVE-2021-38185 Public exploit
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_…
-
High 7.8
staging: greybus: uart: fix tty use after free
In the Linux kernel, the following vulnerability has been resolved: staging: greybus: uart: fix tty use after free User space can hold a tty open indefinitely and tty drivers must not release the underlying structures until the last user is gone. Switch to us…
-
High 7.8
A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl funct…
-
High 7.8
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
-
High 7.5
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challeng…
-
High 7.5
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA0…
-
High 7.5
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message …
-
High 7.5
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versi…
-
High 7.5CVE-2024-6232 Public exploit
Regular-expression DoS when parsing TarFile headers
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
-
High 7.5
Quadratic complexity parsing cookies with backslashes
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic compl…
-
High 7.5
Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within…
-
High 7.4
Memory race condition in ssl.SSLContext certificate store methods
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates…
-
High 7.4
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V…
-
High 7.2
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versi…
-
High 7.2
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versi…
-
High 7.2
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versi…
-
High 7.2
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versi…
-
High 7.1
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input…
-
High 7.1
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files cor…
-
High 7.1
A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…
-
Medium 6.8
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Suppo…
-
Medium 6.8
On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inse…
-
Medium 6.7
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is u…
-
Medium 6.7
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does n…
-
Medium 6.5
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input i…
-
Medium 6.5
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than …
-
Medium 6.5
Buffer overread when using an empty list with SSLContext.set_npn_protocols()
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vu…
-
Medium 6.5
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks …
-
Medium 6.3
Improper validation of IPv6 and IPvFuture addresses
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one U…
-
Medium 6.3
URL parser allowed square brackets in domain names
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture…
-
Medium 6.3
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerab…
-
Medium 6.2
A vulnerability has been identified in Building X - Security Manager Edge Controller (ACC-AP) (All versions). Affected …
-
Medium 5.9
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …
-
Medium 5.9CVE-2024-50602 Public exploit
An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_Sto…
-
Medium 5.5
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…
-
Medium 5.5
Email header injection due to unquoted newlines
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
-
Medium 5.3
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported…
-
Medium 5.3CVE-2021-35559 EPSS 16%
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported…
-
Medium 5.3
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Support…
-
Medium 5.3
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Support…
-
Medium 5.3
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …
-
Medium 5.3
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …
-
Medium 5.3
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Support…
-
Medium 5.3
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected de…
-
Medium 5.3
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated …
-
Medium 5.3
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wro…
-
Medium 5.3
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …
-
Medium 5.3
Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to s…
-
Medium 5.3
Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a r…
-
Medium 5.3
predictable WebSocket mask
curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious se…
-
Medium 5.3
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerab…
-
Medium 4.9
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits incon…
-
Medium 4.7
Shadow-utils: possible password leak during passwd(1) change
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enoug…
-
Medium 4.6
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device contains a USB port…
-
Medium 4.3
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected de…
-
Medium 4.3
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do…
-
Medium 4.3
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All ve…
-
Medium 4.3
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server inf…
-
Low 3.7
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …
-
Low 3.4
netrc and redirect credential leak
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that …
-
Low 3.3CVE-2024-28085 Public exploit
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to oth…
-
Low 3.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications co…
-
Low 3.1
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Support…
-
Unscored —
binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bou…
-
Unscored —
remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excess…
-
Unscored —
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be plac…
-
Unscored —
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify ke…
-
Unscored —
libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (…
-
Unscored —
The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service v…
-
Unscored —
Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_r…
-
Unscored —
In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.
-
Unscored —
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermissi…
-
Unscored —
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classper…
-
Unscored —
The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set…
-
Unscored —
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_chec…
-
Unscored —
mcb: fix error handling in mcb_alloc_bus()
In the Linux kernel, the following vulnerability has been resolved: mcb: fix error handling in mcb_alloc_bus() There are two bugs: 1) If ida_simple_get() fails then this code calls put_device(carrier) but we haven't yet called get_device(carrier) and probably…
-
Unscored —
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with…
-
Unscored —
A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.
-
Unscored —
A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a lo…
-
Unscored —
A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free b…
-
Unscored —
In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local esca…
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
-
Unscored —CVE-2022-2639 Public exploit
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…
-
Unscored —
In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and migh…
-
Unscored —
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
-
Unscored —
A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The…
-
Unscored —CVE-2022-30594 Public exploit
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass in…
-
Unscored —
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyri…
-
Unscored —
The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen P…
-
Unscored —CVE-2022-37032 Public exploit
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of serv…
-
Unscored —
moxart: fix potential use-after-free on remove path
In the Linux kernel, the following vulnerability has been resolved: moxart: fix potential use-after-free on remove path It was reported that the mmc host structure could be accessed after it was freed in moxart_remove(), so fix this by saving the base registe…
-
Unscored —
usb: gadget: rndis: add spinlock for rndis response list
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: add spinlock for rndis response list There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below…
-
Unscored —
usb: gadget: uvc: Prevent buffer overflow in setup handler
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stag…
-
Unscored —
ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write o…
-
Unscored —
net: mvneta: Prevent out of bounds read in mvneta_config_rss()
In the Linux kernel, the following vulnerability has been resolved: net: mvneta: Prevent out of bounds read in mvneta_config_rss() The pp->indir[0] value comes from the user. It is passed to: if (cpu_online(pp->rxq_def)) inside the mvneta_percpu_elect() funct…
-
Unscored —
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finge…
-
Unscored —
ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory …
-
Unscored —
An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
-
Unscored —
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mand…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-202008.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-212953.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-356310.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-416652.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-420375.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-471761.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-626856.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-710408.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-734261.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-763474.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-868571.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-882673.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-912274.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-915282.html