1,185 results · Clear filters · Feed
-
Critical max 9.8
Siemens RUGGEDCOM ROX
Devices based on RUGGEDCOM ROX before V2.16 contain multiple high severity vulnerabilities, including the third-party vulnerabilities: CVE-2022-24903, CVE-2022-2068, CVE-2021-22946, CVE-2022-22576, CVE-2022-27781, CVE-2022-27782, CVE-2022-32207, CVE-2022-1292…
first Jul 11, 2023 -
Critical max 9.9
Siemens SIMATIC CN 4100
SIMATIC CN 4100 is vulnerable to improper access control and insecure default configurations that could allow an attacker to gain privilege escalation, and bypass network isolation. Siemens has released an update for SIMATIC CN 4100 and recommends to update t…
first Jul 11, 2023 -
Critical max 9.8
Siemens SIMATIC MV500 Devices
SIMATIC MV500 devices before V3.3.4 are affected by multiple vulnerabilities in the web server and several third-party components. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Jul 11, 2023 -
Critical max 9.8
Siemens RUGGEDCOM CROSSBOW
The RUGGEDCOM CROSSBOW server application before V5.4 contains multiple vulnerabilities that could allow an attacker to execute arbitrary database queries via SQL injection attacks, to create a denial of service condition, or to write arbitrary files to the a…
first Aug 8, 2023 -
Critical max 9.8
Delta Electronics InfraSuite Device Master
Successful exploitation of these vulnerabilities could allow an attacker to remotely execute arbitrary code and obtain plaintext credentials.
first Nov 28, 2023 -
Critical max 9.1
Siemens SCALANCE W700
Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Sep 10, 2024 -
Critical max 10.0
Siemens InterMesh Subscriber Devices
InterMesh Subscriber devices contain multiple vulnerabilities that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. Siemens has released new versions for the affected products and recommends to update to the lates…
first Oct 23, 2024 -
Critical max 10.0
Siemens TeleControl Server
TeleControl Server Basic V3.1 contains a deserialization vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the device. Siemens has released new versions for the affected products and recommends to update to the latest ver…
first Nov 12, 2024 -
Critical max 9.8
Siemens SCALANCE W700 IEEE 802.11ax
SCALANCE W-700 IEEE 802.11ax family devices are affected by multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Feb 11, 2025 -
Critical max 10.0
Siemens Opcenter Intelligence
The Tableau Server component in Opcenter Intelligence contains multiple vulnerabilities as described below. Siemens has released a new version for Opcenter Intelligence and recommends to update to the latest version and to install the latest available version…
first Feb 11, 2025 -
Critical max 9.1
Siemens SiPass Integrated
SiPass integrated is affected by a directory traversal vulnerability in the third-party component DotNetZip. The vulnerability could allow an attacker to execute arbitrary code on the application server, if a specially crafted backup set is used for a restore…
first Feb 17, 2025 -
Critical max 9.1
Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP
SiPass integrated ACC (Advanced Central Controller) devices contain multiple vulnerabilities that could allow attackers to execute commands on the devices with root privileges and access sensitive data. Siemens has released new versions for the affected produ…
first Mar 11, 2025 -
Critical max 9.8
Siemens Industrial Edge Devices
Siemens Industrial Edge Devices contain a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for several affected product…
first Apr 8, 2025 -
Critical max 9.8
Growatt Cloud Applications
Successful exploitation of these vulnerabilities could allow an attacker to compromise confidentiality, achieve cross-site scripting, or code execution on affected devices.
first Apr 15, 2025 -
Critical max 9.8
Mitsubishi Electric Europe B.V. smartRTU
Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to disclose, tamper with, destroy or delete information in the product, or cause a denial-of service condition on the product.
first Apr 15, 2025 -
Critical max 9.8
Siemens TeleControl Server Basic SQL
TeleControl Server Basic before V3.1.2.2 contains multiple SQL Injection vulnerabilities that could allow an attacker to read and write to the application's DB, cause denial of service and execute code in an OS shell with limited "NT AUTHORITY\NetworkService"…
first Apr 16, 2025 -
Critical max 9.8
Nice Linear eMerge E3
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands.
first Apr 24, 2025 -
Critical max 9.3
Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code.
first Apr 24, 2025 -
Critical max 9.8
Planet Technology Network Products
Successful exploitation of these vulnerabilities could allow an attacker to read or manipulate device data, gain administrative privileges, or alter database entries.
first Apr 24, 2025 -
Critical max 9.3ICSA-25-126-01 1 CVE
Optigo Networks ONS NC600
Successful exploitation of this vulnerability could allow an attacker to establish an authenticated connection with the hard-coded credentials and perform OS command executions.
-
Critical max 9.8
CentralSquare eTRAKiT.Net SQL injection vulnerability
eTRAKiT is a public online portal that provides the public with easily accessible information related to permits, projects, licenses, code compliance, land, and inspections. An SQL injection vulnerability in the CRM feature of eTRAKiT.net release 3.2.1.77 all…
first Mar 20, 2025 -
Critical max 9.8
Lantronix XPort (Update A)
Successful exploitation of this vulnerability could allow an attacker unauthorized access to the configuration interface and cause disruption to monitoring and operations.
first Apr 15, 2025 -
Critical max 9.3
SicommNet multiple vulnerabilities
SicommNet BASEC is an online eProcurement solution used by governments and other entities. Multiple vulnerabilities have been found in BASEC. These vulnerabilities allow a remote, unauthenticated attacker to gain administrative privileges, read user passwords…
first Apr 15, 2025 -
Critical max 9.8ICSA-25-107-04 1 CVE
Yokogawa Recorder Products
Successful exploitation of this vulnerability could allow an attacker to manipulate information on the affected products.
-
Critical max 9.8ICSA-25-100-05 5 CVEs
Siemens Insights Hub Private Cloud
Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to …
-
Critical max 10.0ICSA-25-100-06 9 CVEs
Siemens SENTRON 7KT PAC1260 Data Manager
SENTRON 7KT PAC1260 Data Manager is affected by multiple vulnerabilities as listed below. Software fixes can no longer be provided for The SENTRON 7KT PAC1260 Data Manager. This advisory documents the known open vulnerabilities. To fix the vulnerabilities, Si…
-
Critical max 9.9ICSA-25-091-01 1 CVE
Rockwell Automation Lifecycle Services with Veeam Backup and Replication
Successful exploitation of this vulnerability could allow an attacker with administrative privileges to execute code on the target system.
-
Critical max 8.8
Hitachi Energy MicroSCADA Pro/X SYS600 (Update A)
Hitachi Energy is aware of the multiple vulnerabilities that affect the MicroSCADA Pro/X SYS600 product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability impacts. …
first Aug 27, 2024 -
Critical max 7.5ICSA-25-084-02 1 CVE
Rockwell Automation Verve Asset Manager
Successful exploitation of this vulnerability could allow an attacker with administrative access to run arbitrary commands in the context of the container running the service.
-
Critical max 9.8ICSA-25-084-04 4 CVEs
Inaba Denki Sangyo CHOCO TEI WATCHER mini
Successful exploitation of these vulnerabilities could allow an attacker to obtain the product's login password, gain unauthorized access, tamper with product's data, and/or modify product settings.
-
Critical max 9.3
Rockwell Automation Lifecycle Services with VMware
Successful exploitation of these vulnerabilities could allow an attacker with local administrative privileges to execute code.
-
Critical max 9.8ICSA-25-077-03 1 CVE
Schneider Electric EcoStruxure Power Automation System
Schneider Electric is aware of a vulnerability in its WebHMI component used in EcoStruxure Power Automation System User Interface product and EcoStruxure Microgrid Operation Large (EMO-L) solution. EcoStruxure Power Automation System User Interface https://ww…
-
Critical max 9.8ICSA-25-072-05 1 CVE
Siemens SINAMICS S200
A specific range of produced SINAMICS S200 devices contains an unlocked bootloader vulnerability that could allow an attacker to download untrusted firmware that could damage or compromise the device. For delivered products listed below Siemens recommends cou…
-
Critical max 9.8ICSA-25-072-10 6 CVEs
Siemens SINEMA Remote Connect Client
SINEMA Remote Connect Client before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version.
-
Critical max 9.8ICSA-25-063-07 4 CVEs
GMOD Apollo
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges, bypass authentication, upload malicious files, or disclose sensitive information.
-
Critical max 9.8
Edimax IC-7100 IP Camera
Successful exploitation of this vulnerability could allow an attacker to send specially crafted requests to achieve remote code execution on the device.
-
Critical max 9.8ICSA-25-133-01 16 CVEs
Hitachi Energy Service Suite
Hitachi Energy is aware of the multiple vulnerabilities related to open-source Apache Tomcat components that affect the Service Suite product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality…
-
Critical max 8.8ICSA-25-133-03 4 CVEs
Hitachi Energy MACH GWS products
Hitachi Energy is aware of the multiple vulnerabilities that affect the MACH GWS product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability impacts. Please refer to…
-
Critical max 9.8
Contec Health CMS8000 Patient Monitor (Update A)
Successful exploitation of these vulnerabilities could allow an attacker to remotely send specially formatted UDP requests or connect to an unknown external network that would allow them to write arbitrary data, resulting in remote code execution. The device …
first Jan 30, 2025 -
Critical max 9.1
Ivanti Connect Secure and Ivanti Policy Secure external file control vulnerability
Ivanti Connect Secure and Ivanti Policy Secure contain a vulnerability that allows a remote, authenticated attacker to write arbitrary files. These vulnerabilities are addressed in Ivanti Connect Secure version 22.7R2.4 and Ivanti Policy Secure version 22.7R1…
first Feb 12, 2025