4,105 results · Feed
-
High max 7.5
Hitachi Energy Relion 670/650 and SAM600-IO Series (Update A)
Hitachi Energy is aware of a vulnerability that affects the Relion 670/650 and SAM600-IO series IED device versions that are listed in this document. An authenticated attacker successfully exploiting this vulnerability via FTP access can cause the device to r…
first Jun 24, 2025 -
Critical max 9.8
Remote Code Execution Vulnerability in Hitachi Energy Service Suite Product
Hitachi Energy is aware of a remote code execution vulnerability that affects the Oracle WebLogic component in the Service Suite product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, int…
-
High max 8.8ICSA-25-261-04 6 CVEs
Multiple Open-Source Software Vulnerabilities in Hitachi Energy Asset Suite Product
Hitachi Energy is aware of multiple reported vulnerabilities that affect the Asset Suite product versions mentioned in this document below. If exploited these vulnerabilities can potentially impact on confidentiality, integrity and availability of the product…
-
High max 8.7
Danfoss AK-SM 8xxA Series (Update A)
Successful exploitation of these vulnerabilities could enable a remote attacker to bypass authentication and remotely execute arbitrary code.
first May 20, 2025 -
High max 7.8ICSA-25-238-01 9 CVEs
INVT VT-Designer and HMITool
Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code in the context of the current process.
-
High max 8.1VA-25-239-01 4 CVEs
Agiloft multiple vulnerabilities
Agiloft is a web-based contract management platform. Multiple vulnerabilities were found in Agiloft that could allow an attacker to gain administrative access to Agiloft, execute operating system commands, or modify update packages.
-
Medium max 4.3ICSMA-25-233-01 1 CVE
FUJIFILM Healthcare Americas Synapse Mobility
Successful exploitation of this vulnerability could allow an attacker to access information beyond their assigned roles.
-
Critical max 9.3
Tigo Energy Cloud Connect Advanced (Update A)
Successful exploitation of these vulnerabilities could allow attackers to gain unauthorized administrative access using hard-coded credentials, escalate privileges to take full control of the device, modify system settings, disrupt solar energy production, in…
first Aug 5, 2025 -
High max 8.5
Rockwell Automation FactoryTalk Action Manager
Successful exploitation of this vulnerability could allow a local unauthenticated attacker to listen to communications and manipulate the device.
first Aug 14, 2025 -
High max 8.5ICSA-25-226-23 1 CVE
Rockwell Automation FactoryTalk Viewpoint
Successful exploitation of this vulnerability could result in full privilege escalation.
-
Critical max 8.4ICSA-25-226-24 1 CVE
Rockwell FactoryTalk Linx
Successful exploitation of this vulnerability could allow an attacker to to create, update, and delete FTLinx drivers.
-
Critical max 9.3ICSA-25-226-25 4 CVEs
Rockwell Automation Micro800
Successful exploitation of these vulnerabilities could result in remote code execution or may lead to privilege escalation.
-
High max 8.8ICSA-25-226-27 2 CVEs
Rockwell Automation ArmorBlock 5000 I/O - Webserver
Successful exploitation of these vulnerabilities could allow an attacker to predict session numbers or perform privileged actions.
-
Critical max 9.3ICSA-25-226-28 1 CVE
Rockwell Automation ControlLogix Ethernet Modules
Successful exploitation of this vulnerability could allow remote attackers to perform memory dumps, modify memory, and control execution flow.
-
High max 7.3ICSA-25-226-29 1 CVE
Rockwell Automation Studio 5000 Logix Designer
Successful exploitation of this vulnerability could allow an attacker to crash the device or execute malicious code.
-
High max 8.2ICSA-25-231-01 1 CVE
Siemens Desigo CC Product Family and SENTRON Powermanager
Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems…
-
Critical max 9.8
MegaSys Computer Technologies Telenium Online Web Application (Update A)
Successful exploitation of this vulnerability could allow an attacker to inject arbitrary Perl code through a crafted HTTP request, leading to remote code execution on the server.
first Sep 19, 2024 -
High max 7.8ICSA-25-224-01 4 CVEs
Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
Successful exploitation of these vulnerabilities could allow an attacker to disclose information and execute arbitrary code.
-
High max 7.1ICSA-25-224-04 2 CVEs
AVEVA PI Integrator
Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, or upload and execute files.
-
High max 7.5ICSMA-25-224-01 5 CVEs
Santesoft Sante PACS Server
Successful exploitation of these vulnerabilities could allow an attacker to create arbitrary files, cause a denial-of-service condition, obtain sensitive information, and steal a user's cookie information.
-
Medium max 6.7ICSA-25-240-03 1 CVE
Schneider Electric Saitel DR & Saitel DP Remote Terminal Unit
Schneider Electric is aware of a vulnerability in its Saitel DR & Saitel DP RTU (Remote Terminal Unit) products. The Saitel DR RTU is a field device, offering a solid and powerful platform for data acquisition, communication, automation and IED integration fo…
-
High max 8.8
Siemens Ruggedcom ROS, SCALANCE
The RUGGEDCOM RCDP protocol is not properly configured after commissioning of RUGGEDCOM ROS based devices and some SCALANCE X switch models and could allow unauthenticated remote users to perform administrative operations. An attacker must be in the same adja…
first Sep 28, 2017 -
Medium max 6.7
Siemens RUGGEDCOM Devices
The SSH server on RUGGEDCOM ROS devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affecte…
first Mar 8, 2022 -
Critical max 9.6
Siemens RUGGEDCOM ROS
Multiple vulnerabilities affect various third-party components of the RUGGEDCOM Operating System (ROS). If exploited, an attacker could cause a denial-of-service, act as a man-in-the-middle or retrieval of sensitive information or gain privileged functions. S…
first Mar 8, 2022 -
High max 8.0
Siemens RUGGEDCOM ROS Code Injection
RUGGEDCOM ROS-based devices are vulnerable to a web-based code injection attack. To execute this attack, it is necessary to access the system via the Command Line Interface (CLI). Siemens has released new versions for several affected products and recommends …
first Jul 12, 2022 -
Medium max 5.3
Siemens RUGGEDCOM ROS
RUGGEDCOM ROS-based devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP conn…
first Nov 8, 2022 -
High max 7.5
Siemens RUGGEDCOM ROS Devices
A denial of service vulnerability could allow an unauthorized attacker to cause total loss of availability in the web server of the affected devices. Siemens has released new versions for several affected products and recommends to update to the latest versio…
first Aug 8, 2023 -
Critical max 9.1
Siemens RUGGEDCOM ROS
A vulnerability was identified in RUGGEDCOM ROS devices with mirror port enabled, that could allow an attacker to inject information into the network via the mirror port. Siemens has released new versions for several affected products and recommends to update…
first Aug 8, 2023 -
Critical max 9.8
Siemens SIMATIC S7-1500
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally ide…
first Dec 12, 2023 -
Medium max 4.9
Siemens SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family
SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG Family is affected by multiple vulnerabilities. CVE-2023-44318 and CVE-2023-44321 were previously published as part of SSA-699386. Siemens has released new versions for several affected products and recommends t…
first Mar 12, 2024 -
High max 8.8
Siemens RUGGEDCOM
Multiple vulnerabilities affect the RUGGEDCOM Operating System (ROS). The common denominator to all vulnerabilities is the leak of confidential information. Siemens has released new versions for several affected products and recommends to update to the latest…
first Jul 9, 2024 -
Medium max 5.3
Siemens Mendix Runtime
Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions f…
first Sep 10, 2024 -
Medium max 5.3
Siemens Mendix Runtime
The basic authentication mechanism of Mendix Runtime contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures. Siemens has released new versions for several affected products and…
first Nov 12, 2024 -
High max 7.8
Siemens Siemens Engineering Platforms
Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected pr…
first Dec 10, 2024 -
High max 7.5
Siemens SIPROTEC 5 Devices
An information disclosure vulnerability in SIPROTEC 5 devices could allow an unauthenticated, remote attacker to retrieve sensitive information of the device. Siemens has released new versions for the affected products and recommends to update to the latest v…
first Feb 11, 2025 -
Critical max 10.0
Siemens SIMATIC IPC RS-828A
SIMATIC IPC RS-828A is affected by an authentication bypass vulnerability in the Redfish interface of its Baseboard Management Controller (BMC) that could allow an attacker to gain unauthorized access and compromise confidentiality, integrity and availability…
first May 13, 2025 -
Medium max 4.3
Siemens TIA Project-Server and TIA Portal
A vulnerability in TIA Project Server and TIA Portal could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further …
first Jul 8, 2025 -
Medium max 6.3ICSA-25-226-01 2 CVEs
Siemens SIMATIC RTLS Locating Manager
Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version.
-
High max 8.1ICSA-25-226-02 1 CVE
Siemens COMOS
COMOS before V10.6 is affected by a local arbitrary code execution vulnerability in the integrated Open Design Alliance Drawings SDK. Siemens has released a new version for COMOS and recommends to update to the latest version.
-
High max 7.8ICSA-25-226-04 2 CVEs
Siemens Simcenter Femap
Simcenter Femap contains a file parsing vulnerability that could be triggered when the application reads files in STP or BMP file format. If a user is tricked to open a malicious file with the affected application, this could lead the application to crash or …