4,105 results · Feed
-
Critical max 9.1
Siemens SCALANCE
SCALANCE W-700 IEEE 802.11n family before V6.6.0 are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11n family and recommends to update to the latest version.
first Apr 14, 2026 -
High max 7.2
Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC)
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains a vulnerability that could allow an attacker to achieve arbitrary code execution and to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access …
first Apr 14, 2026 -
High max 8.8
Siemens SINEC NMS
SINEC NMS before V4.0 SP3 contains an Authorization Bypass vulnerability that could allow an attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account. Siemens has released a new version for SINEC NMS …
first Apr 14, 2026 -
High max 7.1
Siemens Industrial Edge Management
Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens…
first Apr 14, 2026 -
Critical max 9.8ICSA-26-111-10 13 CVEs
Silex Technology SD-330AC and AMC Manager
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause a denial-of-service, or configuration information may be altered without authentication.
-
Critical max 9.8ICSA-26-111-12 11 CVEs
SenseLive X3050
Successful exploitation of these vulnerabilities could allow an attacker to take complete control of the device.
-
Critical max 9.8
GE UR Family (Update A)
Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, reboot the UR, gain privileged access, or cause a denial-of-service condition.
first Mar 16, 2021 -
High max 7.5
Siemens PROFINET Devices
A vulnerability in affected devices could allow an attacker to perform a denial ofservice attack if a large amount of Profinet Discovery and Configuration Protocol (DCP) reset packets is sent to the affected devices. Siemens has released new versions for seve…
first Jul 13, 2021 -
Medium max 5.3
Siemens SCALANCE FragAttacks
Twelve vulnerabilities in the implementation of frame aggregation and fragmentation of the 802.11 standard, under the name of FragAttacks, have been published. Successful exploitation of these vulnerabilities could allow an attacker within Wi-Fi range to forg…
first Jul 13, 2021 -
High max 7.4
Siemens OpenSSL Vulnerability in Industrial Products
OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1l and 1.0.2 < 1.0.2za that allows an attacker to cause a denial of service (DoS) or to disclose private memory content. Siemens has released updates for sever…
first Feb 8, 2022 -
High max 7.5
Siemens OpenSSL Affected Industrial Products
A vulnerability in the openSSL component (CVE-2022-0778, [0]) could allow an attacker to create a denial of service condition by providing specially crafted elliptic curve certificates to products that use a vulnerable version of openSSL. Siemens has released…
first Jun 14, 2022 -
Critical max 9.1
Siemens SCALANCE
SCALANCE devices contain multiple vulnerabilities in MSPS based product lines that could allow authenticated remote attackers to execute custom code or create a XSS situation, as well as unauthenticated remote attackers to create a denial of service condition…
first Aug 9, 2022 -
High max 8.8
Siemens SCALANCE and RUGGEDCOM Products
The products listed below do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Siemens has released updates for several affected products and recommends to update to t…
first Oct 11, 2022 -
High max 7.5
Siemens Products affected by OpenSSL 3.0
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitra…
first Dec 13, 2022 -
High max 7.5
Siemens RADIUS Client of SIPROTEC 5 Devices
The RADIUS client implementation of the VxWorks platform in SIPROTEC 5 devices contains a denial of service vulnerability that could be triggered when a specially crafted packet is sent by a RADIUS server. Siemens has released new versions for the affected pr…
first Mar 14, 2023 -
Low max 2.2
Siemens Mendix OIDC SSO
The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development. Siemens has released new versions for several affe…
first May 13, 2025 -
Medium max 5.5
Siemens SIMOTION SCOUT, SIMOTION SCOUT TIA, and SINAMICS STARTER
SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER are affected by an XXE injection vulnerability that could allow an attacker to access arbitrary application files. Siemens has released new versions for several affected products and recommends to update…
first Aug 12, 2025 -
High max 7.8
Siemens SINEC NMS
Multiple Siemens products are affected by two local privilege escalation vulnerabilities which could allow an low privileged attacker to load malicious DLLs, potentially leading to arbitrary code execution with elevated privileges. Siemens has released new ve…
first Feb 10, 2026 -
High max 8.1
OC Messaging and Custom Messaging Gateway
Successful exploitation of this vulnerability could allow an authenticated low-privileged user to gain access to SMS messages outside of their authorized tenant scope via a crafted company or tenant identifier parameter.
first Mar 26, 2026 -
High max 7.8ICSA-26-106-01 1 CVE
Delta Electronics ASDA-Soft
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code.
-
Critical max 9.1ICSA-26-106-02 1 CVE
Horner Automation Cscape and XL4, XL7 PLC
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to systems and services.
-
Critical max 9.8ICSA-26-106-03 12 CVEs
Anviz Multiple Products
Successful exploitation of these vulnerabilities could allow attackers to conduct reconnaissance, capture or decrypt sensitive data, alter device configurations, gain unauthorized administrative or root‑level access, execute arbitrary code, compromise credent…
-
Critical max 9.3ICSA-26-106-04 1 CVE
AVEVA Pipeline Simulation
Successful exploitation of this vulnerability could allow an unauthenticated attacker to modify simulation parameters, training configuration and training records.
-
High max 9.2
OpenPLC_V3 (Update A)
Successful exploitation of these vulnerabilities could result in the alteration of PLC settings, upload of malicious programs, access to credentials, or bypass authentication.
first Dec 11, 2025 -
Critical max 9.8ICSA-26-099-01 1 CVE
Contemporary Controls BASC 20T
Successful exploitation of this vulnerability could allow an attacker to enumerate the functionality of each component associated with the PLC, reconfigure, rename, delete, perform file transfers, and make remote procedure calls.
-
High max 8.6ICSA-26-099-02 1 CVE
GPL Odorizers GPL750
Successful exploitation of this vulnerability could allow a low privileged remote attacker to manipulate register values, which would result in too much or too little odorant being injected into a gas line.
-
Medium max 4.3VA-26-097-02 1 CVE
IBM Maximo Application Suite Sensitive Tokens without 'Secure' Attribute
IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. An unauthenticated attacker can steal cookies by directing users to a malicious http:// link and snooping user traffic.
-
High max 6.8VA-26-097-01 1 CVE
Thales Sentinel LDK Runtime Stored XSS
Thales Sentinel LDK Runtime on Windows allows Stored Cross-site Scripting.
-
High max 7.8
Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update C)
Successful exploitation of these vulnerabilities could allow a local attacker to execute an arbitrary code by storing a specially crafted DLL in a specific folder or tampering with a specially crafted DLL. This could lead to disclose information in the affect…
first Dec 3, 2024 -
High max 9.3
Mitsubishi Electric GENESIS64 and ICONICS Suite products
Successful exploitation of these vulnerabilities could allow a local attacker to disclose SQL Server credentials used by the affected products and use them to disclose, tamper with, or destroy data, or to cause a denial-of-service (DoS) condition on the syste…
-
Medium max 6.5
Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update F)
Successful exploitation of this vulnerability could allow a local attacker to make an unauthorized write to arbitrary files by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file, enabling…
first May 20, 2025 -
Medium max 5.9
Mitsubishi Electric Iconics Digital Solutions Multiple Products (Update B)
Successful exploitation of this vulnerability could allow a local attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the processes of the affected products to a target file. This c…
first Aug 5, 2025 -
Medium max 6.5VA-26-092-01 1 CVE
Bentley Systems iTwin Platform exposed access token
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets.
-
High max 8.5
Schneider Electric EcoStruxure (Update D)
Schneider Electric is aware of a vulnerability disclosed on Revenera FlexNet Publisher component. Many vendors, including Schneider Electric, embed Revenera FlexNet Publisher in their offers. Failure to apply the remediation/mitigations provided below may ris…
first Jan 14, 2025 -
Critical max 8.7
Hitachi Energy Ellipse
Hitachi Energy is aware of a Jasper Report vulnerability that affects the Ellipse product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Recomm…
first Feb 24, 2026 -
High max 7.5
Siemens SICAM 8 Products
Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - RTUM85 for CP-8010/CP-8012 - SICAM EGS Device firmware -…
first Mar 26, 2026 -
Medium max 2.1ICSA-26-092-02 1 CVE
Yokogawa CENTUM VP
Successful exploitation of this vulnerability could allow an attacker to login as the PROG user and modify permissions.
-
Medium max 6.5
Nanoleaf Lines unauthenticated firmware file store
Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources.
first Mar 25, 2026 -
Critical max 9.3ICSA-26-090-01 1 CVE
Anritsu Remote Spectrum Monitor
Successful exploitation of this vulnerability could allow attackers with network access to alter operational settings, obtain sensitive signal data, or disrupt device availability.
-
Critical max 9.8ICSA-26-090-02 1 CVE
PX4 Autopilot
Successful exploitation of this vulnerability could allow an attacker with access to the MAVLink interface to execute arbitrary shell commands without cryptographic authentication.