901 results · Clear filters · Feed
-
Medium max 4.6
Siemens SENTRON 7KM PAC3x20
The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process. An attacker with physical access to the device could read out the data. Siemens has released new versions for the affected products…
first Mar 12, 2024 -
Medium max 6.1
Schneider Electric PowerLogic P5
Schneider Electric is aware of a vulnerability in its PowerLogic P5 products. The PowerLogic P5 is a medium voltage protection relay. Failure to apply the mitigations provided below may risk denial of service, device reboot, or an attacker gaining full contro…
first Jun 11, 2024 -
Medium max 4.3ICSA-24-256-01 1 CVE
Siemens SINEMA Remote Connect Server
SINEMA Remote Connect Server before V3.2 SP2 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version.
-
Medium max 5.5ICSA-24-256-04 1 CVE
Siemens SINUMERIK Systems
SINUMERIK systems, that have been provisioned with Create MyConfig (CMC), are affected by a Insertion of Sensitive Information into Log File vulnerability. When using a CMC package on a NCU or on an IPC the password used in the CMC package or typed in manuall…
-
Medium max 5.4ICSA-25-014-03 1 CVE
Schneider Electric EcoStruxure
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) products. EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power. critical and energy-int…
-
Medium max 6.5ICSA-24-249-01 2 CVEs
Hughes Network Systems WL3000 Fusion Software
Successful exploitation of these vulnerabilities could allow an attacker to obtain read-only access to network configuration information and terminal configuration data.
-
Medium max 5.4ICSA-24-235-01 1 CVE
Rockwell Automation Emulate3D
Successful exploitation of this vulnerability could allow an attacker to perform remote code execution.
-
Medium max 5.3ICSA-24-228-11 1 CVE
PTC Kepware ThingWorx Kepware Server
Successful exploitation of this vulnerability could crash the target device.
-
Medium max 6.9ICSA-24-226-07 1 CVE
Rockwell Automation Micro850/870
Successful exploitation of this vulnerability may cause CIP/Modbus communication to be disrupted for short duration.
-
Medium max 6.7
Siemens TIA Project-Server formerly known as TIA Multiuser Server
TIA Project-Server formerly known as TIA Multiuser Server contains an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path. Siemens has r…
first Feb 14, 2023 -
Medium max 6.7ICSA-24-228-07 3 CVEs
Siemens Location Intelligence
Location Intelligence before V4.4 is affected by multiple vulnerabilities that could allow an attacker in an on-path position to read and modify data passed over the connection between legitimate clients and the affected product or brute force user passwords.…
-
Medium max 5.3ICSA-24-221-01 3 CVEs
Dorsett Controls InfoScan
Successful exploitation of these vulnerabilities could allow an attacker to expose sensitive information, resulting in data theft and misuse of credentials.
-
Medium max 6.8ICSA-24-214-02 1 CVE
Johnson Controls exacqVision Server web service
Successful exploitation of this vulnerability could allow an attacker to send an unauthorized request or access data from an untrusted domain.
-
Medium max 6.8ICSA-24-214-03 1 CVE
Johnson Controls exacqVision Web Service
Successful exploitation of this vulnerability could allow an attacker to perform state-changing operations with administrative privileges.
-
Medium max 6.4ICSA-24-214-04 1 CVE
Johnson Controls exacqVision Web Service
Successful exploitation of this vulnerability could allow an attacker to perform a man-in-the-middle attack and gain access to sensitive information.
-
Medium max 6.4ICSA-24-214-05 1 CVE
Johnson Controls exacqVision Server
Successful exploitation of this vulnerability could allow an attacker to perform a man-in-the-middle attack and intercept communications.
-
Medium max 5.7ICSA-24-214-06 1 CVE
Johnson Controls exacqVision Web Service
Successful exploitation of this vulnerability may allow an attacker to gain sensitive information.
-
Medium max 6.5ICSA-24-200-02 1 CVE
Subnet Solutions PowerSYSTEM Center
Successful exploitation of this vulnerability could allow an authenticated attacker to elevate permissions.
-
Medium max 7.1ICSA-24-193-19 2 CVEs
Rockwell Automation FactoryTalk System Services and Policy Manager
Successful exploitation of these vulnerabilities could allow an attacker to obtain private keys, which would result in impersonating resources on the secured network.
-
Medium max 6.3ICSA-24-193-20 1 CVE
HMS Industrial Networks Anybus-CompactCom 30
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition, exfiltrate data, or obtain a high degree of control over the device and subsequent systems, including remote code execution .
-
Medium max 7.0ICSA-24-191-03 1 CVE
Johnson Controls Illustra Pro Gen 4
Successful exploitation of this vulnerability could impact confidentiality and integrity of the device.
-
Medium max 6.3ICSA-24-193-12 1 CVE
Siemens TIA Portal and SIMATIC STEP 7
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released a new v…
-
Medium max 6.5ICSA-24-193-13 1 CVE
Siemens TIA Portal, SIMATIC, and SIRIUS
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new ver…
-
Medium max 6.8
Johnson Controls Illustra Essentials Gen 4 (Update A)
Successful exploitation of this vulnerability could allow an authenticated user to recover credentials for other Linux users.
first Jun 27, 2024 -
Medium max 6.8
Johnson Controls Illustra Essentials Gen 4 (Update A)
Successful exploitation of this vulnerability may allow an attacker to gain access to Linux user credentials.
first Jun 27, 2024 -
Medium max 6.8
Johnson Controls Illustra Essentials Gen 4 (Update A)
Successful exploitation of this vulnerability may allow web interface user's credentials to be recovered by an authenticated user.
first Jun 27, 2024 -
Medium max 5.8ICSA-24-179-03 2 CVEs
Yokogawa FAST/TOOLS and CI Server
Successful exploitation of these vulnerabilities could allow an attacker to launch a malicious script and take control of affected products.
-
Medium max 6.8ICSA-25-016-06 1 CVE
Hitachi Energy FOX61x, FOXCST, and FOXMAN-UN Products
Hitachi Energy is aware of a vulnerability that affects the FOXMAN-UN/FOXCST versions listed below. If exploited an attacker could potentially intercept or falsify data exchanges between the client and the server. Please refer to the “Recommended Immediate Ac…
-
Medium max 6.9ICSA-25-016-07 1 CVE
Hitachi Energy FOX61x Products
Hitachi Energy is aware of a vulnerability that affects the XMC20 versions listed below. Please refer to the “Recommended Immediate Actions” for information about the remediation.
-
Medium max 6.9ICSA-25-063-04 1 CVE
Hitachi Energy XMC20
Hitachi Energy is aware of a vulnerability that affects the XMC20 versions listed below. Please refer to the “Recommended Immediate Actions” for information about the remediation.
-
Medium max 6.8ICSA-25-063-05 1 CVE
Hitachi Energy UNEM/ECST
Hitachi Energy is aware of a vulnerability that affects the UNEM/ECST versions listed below. If exploited an attacker could potentially intercept or falsify data exchanges between the client and the server. Please refer to the “Recommended Immediate Actions” …
-
Medium max 5.9ICSA-24-165-01 1 CVE
Siemens Mendix Applications
Apps built with Mendix Runtime >= V9.3 could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights. Si…
-
Medium max 5.6ICSA-24-165-05 3 CVEs
Siemens SITOP UPS1600
Multiple out-of-bounds vulnerabilities in third-party components are affecting SITOP UPS1600 before V2.5.4. Attackers could exploit these vulnerabilities and cause limited impact in the affected systems. Siemens has released new versions for the affected prod…
-
MediumICSA-24-158-01 0 CVEs
Emerson PACSystem and Fanuc
Successful exploitation of these vulnerabilities could allow remote code execution, loss of sensitive information, or a denial-of-service condition.
-
Medium max 7.5
Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch (Update A)
Successful exploitation of these vulnerabilities could result in disclosure of information stored in the product by sending specially crafted packets or could cause a denial-of service (DoS) condition by getting a legitimate user to import a specially crafted…
first Oct 5, 2023 -
Medium max 6.9ICSA-24-149-01 2 CVEs
Campbell Scientific CSI Web Server
Successful exploitation of these vulnerabilities could allow an attacker to download files and decode stored passwords.
-
Medium max 6.5
Mitsubishi Electric MELSEC iQ-R Series Safety CPU and SIL2 Process CPU (Update A)
Successful exploitation of this vulnerability could allow a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than themselves.
first Feb 13, 2024 -
Medium max 7.0ICSA-24-135-01 1 CVE
Rockwell Automation FactoryTalk Remote Access
Successful exploitation of this vulnerability could allow an attacker to enter a malicious executable and run it as a system user, resulting in remote code execution.
-
Medium max 5.3
Siemens RUGGEDCOM APE1808
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC before 23.3.0. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version for RUGGEDCOM APE1808 and reco…
first Feb 13, 2024 -
Medium max 6.5ICSA-24-137-04 1 CVE
Siemens Polarion ALM
The Apache Lucene based query engine in Polarion ALM lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects. Siemens has released a new version for Polarion ALM and recommends to update to the la…