901 results · Clear filters · Feed
-
Medium
Siemens SIPROTEC 5 Devices
An information disclosure vulnerability in SIPROTEC 5 products could allow an unauthenticated attacker to read device information. Only devices with the hardware variants CP050, CP100 and CP300 are affected. The DIGSI engineering tool can be used to identify …
first Jan 11, 2022 -
Medium
Siemens SINEMA Remote Connect Server
An open redirect vulnerability in SINEMA Remote Connect Server could allow an attacker to steal logon credentials with a specially crafted malicious link. Siemens has released software update for the SINEMA Remote Connect Server and recommends to update to th…
first Feb 8, 2022 -
Medium
Siemens Spectrum Power 4
A Cross-Site Scripting (XSS) vulnerability is found in the integrated web application "Online Help" of Spectrum Power 4. Siemens has released an update for the Spectrum Power 4 and recommends to update to the latest version.
first Feb 8, 2022 -
Medium
Siemens Climatix POL909
Multiple vulnerabilities have been identified in the Climatix POL909 (AWM and AWB) that could allow an unauthenticated attacker to hijack and redirect users to a malicious webpage, or allow an authenticated attacker to access sensitive files. Siemens has rele…
first Mar 8, 2022 -
Medium
Siemens Polarion ALM
The Subversion Webclient in Polarion ALM contains a cross-site scripting vulnerability, that could be triggered by an attacker by sending crafted links to an administrator user of Polarion ALM. Siemens has released an update for the Subversion Webclient in Po…
first Mar 8, 2022 -
Medium max 6.8
Siemens Mendix
A XPath Constraint vulnerability in the Mendix Runtime was discovered, that can affect the running applications. The vulnerability could allow a malicious user to deduce contents of inaccessible attributes and modify sensitive data. Siemens has released new v…
first Mar 8, 2022 -
Medium
Siemens SICAM A8000
SICAM A8000 CP-8050 and CP-8031 devices contain vulnerabilities that could allow an attacker to access files without authentication. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Apr 12, 2022 -
Medium
Siemens SIMATIC STEP 7 (TIA Portal)
An attacker could achieve privilege escalation on the web server of certain devices configured by SIMATIC STEP 7 (TIA Portal) due to incorrect handling of the webserver's user management configuration during downloading. This only affects the S7-1200 and S7-1…
first Apr 12, 2022 -
Medium
Siemens OpenV2G
The open source software OpenV2G contains a buffer overflow vulnerability that could allow an attacker to trigger a memory corruption. Siemens has released an update for the OpenV2G and recommends to update to the latest version.
first May 10, 2022 -
Medium max 5.3
Siemens RUGGEDCOM ROS
RUGGEDCOM ROS-based devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP conn…
first Sep 13, 2022 -
Medium max 6.5
Siemens Web Server Login Page of Industrial Controllers
The web server login page of affected products does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.. Siemens has released updates for sever…
first Nov 8, 2022 -
Medium max 5.4
Siemens Polarion ALM
Polarion ALM contains a misconfiguration in its default Apache HTTP Server configuration that could allow an attacker to perform host header injection attacks. Siemens has released an update for Polarion ALM and recommends to update to the latest version.
first Dec 13, 2022 -
Medium max 6.7
Siemens SCALANCE X-200IRT Devices
The SSH server on SCALANCE X-200IRT devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the aff…
first Apr 11, 2023 -
Medium max 5.9
Siemens Polarion ALM
Polarion ALM is vulnerable to XML External Entity (XXE) injection attack that could allow an attacker to potentially disclose confidential data. Siemens has released an update for Polarion ALM and recommends to update to the latest version.
first Apr 11, 2023 -
Medium max 4.6
Siemens SIMOTION
SIMOTION contains an information disclosure vulnerability that could allow an unauthenticated attacker to extract confidential technology object (TO) configuration from the device. Siemens has released updates for the affected products and recommends to updat…
first Jun 13, 2023 -
Medium max 5.9
Siemens SIMATIC
Several SIMATIC products are affected by a timing based side channel vulnerability in the OpenSSL RSA Decryption (CVE-2023-4304), as disclosed on 2023-02-07 at https://www.openssl.org/news/secadv/20230207.txt. Siemens has released new versions for several aff…
first Aug 8, 2023 -
Medium max 6.5
Siemens SIMATIC IPCs
Several Intel-CPU based SIMATIC IPCs are affected by an information exposure vulnerability (CVE-2022-40982) in the CPU that could allow an authenticated local user to potentially read other users' data [1]. The issue is also known as "Gather Data Sampling" (G…
first Sep 12, 2023 -
Medium max 5.3
Siemens SIMATIC and SIMIT
Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in several industrial products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to hi…
first Jul 9, 2024 -
Medium max 6.5
Siemens SIMATIC RFID Readers
SIMATIC RFID Readers contain multiple vulnerabilities that could allow an attacker to cause Denial-of-Service, exploit hidden functionality and information exposure. Siemens has released new versions for the affected products and recommends to update to the l…
first Sep 10, 2024 -
Medium max 5.9
Siemens SIMATIC, SIPLUS, and TIM
Multiple NULL pointer dereference vulnerabilities in the affected products could allow an attacker with network access to the webserver, to perform a denial of service attack. Siemens has released new versions for several affected products and recommends to u…
first Sep 10, 2024 -
Medium max 6.7
Siemens Questa and ModelSim
Questa and ModelSim (incl. OEM Editions) are affected by multiple vulnerabilities that could allow a local attacker to inject arbitrary code and escalate privileges. Siemens has released new versions for the affected products and recommends to update to the l…
first Oct 8, 2024 -
Medium max 6.7
Siemens Siveillance Video Camera
Several camera device drivers in the Siveillance Video Device Pack contain a buffer overflow vulnerability that could be exploited under strict conditions. This could allow an attacker to execute code with the permissions of the Recording Server user. Siemens…
first Oct 10, 2024 -
Medium max 5.5
Siemens RUGGEDCOM CROSSBOW
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code or to create a denial of service condition. Siemens has released a new version for R…
first Nov 12, 2024 -
Medium max 6.8
Siemens OZW672 and OZW772 Web Server
OZW672 and OZW772 Web Server versions before V5.2 contain a stored cross-site scripting (XSS) vulnerability that could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with …
first Nov 12, 2024 -
Medium max 4.6
Siemens CPCI85 Central Processing/Communication
The SICAM A8000 CP-8031 and CP-8050 devices are affected by a vulnerability that could allow an attacker with physical access to the device to decrypt the firmware. Siemens has released new firmware and hardware versions for the affected products and recommen…
first Dec 10, 2024 -
Medium max 5.5
Siemens COMOS
COMOS is affected by XXE injection vulnerabilities that could allow an attacker to extract arbitrary application files. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specifi…
first Dec 10, 2024 -
Medium max 5.3
Siemens SIMATIC
The webserver of several SIMATIC products is affected by a user enumeration vulnerability that could allow an unauthenticated remote attacker to identify valid usernames. Siemens has released new versions for several affected products and recommends to update…
first Feb 11, 2025 -
Medium max 6.2
Siemens OpenV2G
The open source software OpenV2G contains a buffer overflow vulnerability that could allow an attacker to trigger a memory corruption. Siemens has released an update for the OpenV2G and recommends to update to the latest version.
first Feb 11, 2025 -
Medium max 6.7
Siemens Questa and ModelSim
Questa and ModelSim (incl. OEM Editions) are affected by a vulnerability that could allow a local attacker to inject arbitrary code and escalate privileges. Siemens has released new versions for the affected products and recommends to update to the latest ver…
first Feb 11, 2025 -
Medium max 6.8
Siemens Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation do not properly limit the access of the simulation model to the filesystem. This could allow an unauthorized attacker to read or delete arbitrary files or the entire filesystem of the device. Siemens has released new versio…
first Mar 11, 2025 -
Medium max 6.7
Siemens License Server (SLS)
Siemens License Server before V4.3 contains various vulnerabilities that could allow a low-privileged local user to escalate privileges or perform arbitrary code execution. Siemens has released a new version for Siemens License Server (SLS) and recommends to …
first Apr 8, 2025 -
Medium max 6.2
Subnet Solutions PowerSYSTEM Center
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.
first Apr 10, 2025 -
Medium max 6.8ICSA-25-126-02 1 CVE
Milesight UG65-868M-EA
Successful exploitation of this vulnerability could allow any user with admin privileges to inject arbitrary shell commands.
-
Medium max 6.8ICSA-25-107-01 3 CVEs
Schneider Electric Trio Q Licensed Data Radio
Schneider Electric is aware of a vulnerability in its Trio™ Q Licensed Data Radio product. The Trio Q Licensed Data Radios product is an advanced, high-speed licensed digital data radios, providing both Ethernet and serial communications for complex and deman…
-
Medium max 6.5ICSA-25-093-02 3 CVEs
Hitachi Energy TRMTracker
Hitachi Energy is aware of the multiple vulnerabilities that affect the TRMTracker product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality and integrity impacts. Please refer to the Recomme…
-
Medium max 6.5ICSA-25-079-04 1 CVE
SMA Sunny Portal
Successful exploitation of this vulnerability could allow an attacker to upload and remotely execute code.
-
Medium max 6.8ICSA-25-077-01 1 CVE
Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI)
Successful exploitation of this vulnerability could allow an attacker to bypass device authentication, potentially gain access to sensitive information, or execute arbitrary code.
-
Medium max 6.0ICSA-25-077-04 1 CVE
Schneider Electric EcoStruxure Panel Server
Schneider Electric is aware of a vulnerability in its EcoStruxure Panel Server product, all models. The EcoStruxure Panel Server https://www.se.com/us/en/product-range/40739468-ecostruxure-panel-server/#products is a modular gateway with enhanced cybersecurit…
-
Medium max 9.1ICSA-25-072-02 2 CVEs
Siemens SINEMA Remote Connect Server
SINEMA Remote Connect Server before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.
-
Medium max 6.7ICSA-25-063-03 1 CVE
Hitachi Energy MACH PS700
Hitachi Energy is aware of a vulnerability in third party component Intel Chipset Device Software, that affects MACH PS700 v2 product versions listed in this document. Authenticated malicious clients successfully exploiting this vulnerability could escalate t…