4,105 results · Feed
-
Medium max 7.8
Mitsubishi Electric MELSOFT MaiLab and MELSOFT VIXIO (Update A)
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition in the target product.
first Jul 18, 2024 -
Medium max 4.6ICSA-25-135-20 1 CVE
Schneider Electric EcoStruxure Power Build Rapsody
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code.
-
Medium max 5.5ICSA-25-140-05 1 CVE
Siemens Siveillance Video
The installer of Siveillance Video V2024 R1 resets the system configuration password when updating from older versions of Siveillance Video. This could inadvertently remove the password protection from system configuration files, also affecting backup data se…
-
High max 7.3
Schneider Electric EcoStruxure Power Monitoring Expert (PME) (Update B)
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) product. EcoStruxure™ Power Monitoring Expert (PME) https://www.se.com/us/en/product-range/65404-ecostruxure-power-monitoring-expert/#overview is an on-premises s…
first Oct 8, 2024 -
Medium max 4.6
Schneider Electric EcoStruxure Power Build Rapsody
Schneider Electric is aware of a vulnerability in its EcoStruxure Power Build Rapsody software. The EcoStruxure Power Build Rapsody is used to enter or import the single line diagram, to get the extensive bill of material of your switchboard, including all de…
first Jan 14, 2025 -
Critical max 9.8ICSA-25-140-06 1 CVE
Schneider Electric PrismaSeT Active - Wireless Panel Server
Schneider Electric is aware of a vulnerability disclosed in the Silicon Labs Gecko Bootloader used in the PrismaSet Active - Wireless Panel Server. The PrismaSeT Active - Wireless Panel Server https://www.se.com/ww/en/product-range/39982243-prismaset-p-active…
-
Medium max 4.6ICSA-25-153-02 1 CVE
Schneider Electric EcoStruxure Power Build Rapsody
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Build Rapsody software. EcoStruxure Power Build Rapsody product is used to enter or import the single line diagram, to get the extensive bill of material of switchboards, including all d…
-
High max 8.1
Siemens RUGGEDCOM ROS
The latest update for RUGGEDCOM ROS devices fixes a buffer overflow vulnerability in the third party component that could allow an attacker with network access to an affected device to cause a remote code execution condition. Siemens has released updates for …
first Jul 13, 2021 -
High max 7.5
Siemens APOGEE, TALON and Desigo PXC/PXM Products
A denial of service vulnerability has been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-313313: https://cert-portal.siemens.com/productcert/html/ssa-313313.html. The products listed below use af…
first Oct 11, 2022 -
Critical max 9.8
Siemens RUGGEDCOM APE1808
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version of Palo Alto Networks Virtual NGFW for RUGGEDCOM A…
first Apr 9, 2024 -
High max 8.6
Siemens Automation License Manager
A vulnerability was identified in the Automation License Manager software that could be triggered by sending specially crafted packets to port 4410/tcp of an affected system. This could cause a denial-of-service preventing legitimate users from using the syst…
first Sep 10, 2024 -
Critical max 9.8
Siemens Industrial Edge Device Kit
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains a weak authentication vulnerability that could f…
first Apr 8, 2025 -
High max 8.7ICSA-25-135-02 8 CVEs
Siemens INTRALOG WMS
INTRALOG WMS before V5 is affected by multiple vulnerabilities in the Microsoft .NET implementation as described below. Siemens has released a new version for INTRALOG WMS and recommends to update to the latest version. Please approach your INTRALOG WMS conta…
-
Medium max 6.5ICSA-25-135-03 1 CVE
Siemens BACnet ATEC Devices
BACnet ATEC devices are affected by a denial of service vulnerability that could be triggered by an attacker residing in the same BACnet network by sending a specially crafted MSTP message. A power cycle is required to restore the device's normal operation. S…
-
High max 7.5ICSA-25-135-04 1 CVE
Siemens Desigo
Desigo CC deployments that use Installed Client are impacted by an information disclosure vulnerability which could result in information leak from the Desigo CC server. The other Desigo CC client options, Windows App Client and Flex Client, are not affected …
-
High max 7.8ICSA-25-135-06 1 CVE
Siemens Teamcenter Visualization
Siemens Teamcenter Visualization contains a out-of-bound read vulnerability that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the applicatio…
-
High max 8.8ICSA-25-135-08 2 CVEs
Siemens VersiCharge AC Series EV Chargers
VersiCharge AC Series EV Chargers contain two vulnerabilities that could allow an attacker to gain control of the chargers through default Modbus port or execute arbitrary code by manipulating the M0 firmware. Siemens has released new versions for several aff…
-
Critical max 10.0ICSA-25-135-10 2 CVEs
Siemens OZW Web Servers
OZW672 and OZW772 Web Server versions contain vulnerabilities that could allow an attacker to execute arbitrary code on the device with root privileges (in versions before V8.0) or to authenticate as Administrator user (in versions before V6.0). Siemens has r…
-
Medium max 6.5ICSA-25-135-11 4 CVEs
Siemens Polarion
Polarion before V2410 contains multiple vulnerabilities that could allow attackers to extract data, conduct cross-site scripting attacks or find out valid usernames. Siemens strongly recommends to update Polarion to V2410 or later versions, not only to fix th…
-
High max 8.8ICSA-25-135-12 1 CVE
Siemens SIMATIC PCS
Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Siemens has released …
-
High max 7.5ICSA-25-135-13 3 CVEs
Siemens SIRIUS
SIRIUS 3SK2 Safety Relays and 3RK3 Modular Safety Systems only provide weak password obfuscation. An attacker with access to the PROFINET or serial interface of the device could eavesdrop or read the stored password from the device and de-obfuscate it. The sa…
-
Medium max 4.7ICSA-25-135-14 1 CVE
Siemens APOGEE PXC and TALON TC Series
APOGEE PXC and TALON TC Series (BACnet) Devices devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted m…
-
Medium max 6.5ICSA-25-135-16 1 CVE
Siemens MS/TP Point Pickup Module
MS/TP Point Pickup Module devices are affected by a denial of service vulnerability that could be triggered by an attacker residing in the same BACnet network by sending a specially crafted MSTP message. A power cycle is required to restore the device's norma…
-
High max 7.5ICSA-25-148-02 1 CVE
Siemens SiPass Integrated
SiPass integrated versions before V2.95.3.18 contain an out of bounds read vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition. Siemens has released a new version for SiPass integrated and recommends to up…
-
High max 8.4ICSA-25-128-01 1 CVE
Horner Automation Cscape
Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code.
-
High max 7.5ICSMA-25-128-01 3 CVEs
Pixmeo OsiriX MD
Successful exploitation of these vulnerabilities could allow an attacker to cause memory corruption, resulting in a denial-of-service condition or to steal credentials.
-
High
Siemens OPC UA Protocol Stack Discovery Service (Update E)
Various industrial products use the Discovery Service of the OPC UA protocol stack by the OPC foundation https://github.com/OPCFoundation/UA-.NETStandard and could therefore be affected by the remote resource consumption attacks (CVE-2017-12069).
first Aug 30, 2017 -
Critical max 9.8
Siemens Desigo PXC (Update C)
Several Desigo PXC/PXM devices contain a vulnerability that could allow unauthenticated remote attackers to upload malicious firmware without prior authentication. Siemens has released updates for the affected products and recommends to update to the latest v…
first Jan 24, 2018 -
High
Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module (Update D)
SIPROTEC 4 and SIPROTEC Compact devices could allow access authorization passwords to be reconstructed or overwritten via engineering mechanisms that involve DIGSI 4 and EN100 Ethernet communication modules. Siemens has released updates for several affected p…
first Mar 8, 2018 -
High
Siemens SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional, and SIMATIC NET PC Software (Update G)
A Denial-of-Service vulnerability has been identified in SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional and SIMATIC NET PC-Software. Siemens has released updates for several affected products and recommends to update to the latest versions. …
first Mar 27, 2018 -
High max 7.5
Siemens SIMATIC, SIMOCODE, SINAMICS, SITOP, and TIM (Update I)
A vulnerability in the affected devices could allow an unauthorized attacker with network access to the webserver of an affected device to perform a denial of service attack. Siemens has released updates for several affected products and recommends to update …
first Apr 9, 2019 -
High max 7.5
Siemens Industrial Real-Time (IRT) Devices
A vulnerability in the affected products could allow an unauthorized attacker with network access to perform a denial-of-service attack resulting in loss of real-time synchronization. Siemens has released new versions for several affected products and recomme…
first Oct 8, 2019 -
Low
Siemens SIMATIC Products (Update C)
A message integrity protection bypass vulnerability has been identified in several SIMATIC products. The vulnerability could allow an attacker in a Man-in-the-Middle position to modify network traffic exchanged on port 102/tcp to PLCs of the SIMATIC S7-1200, …
first Dec 10, 2019 -
Critical
Siemens SPPA-T3000 (Update A)
SPPA-T3000 Application Server and MS3000 Migration Server are affected by multiple vulnerabilities. Some of the vulnerabilities can allow an attacker to execute arbitrary code on the server. Exploitation of the vulnerabilities described in this advisory requi…
first Dec 10, 2019 -
High max 7.5
Siemens Industrial Products SNMP (Update F)
Several industrial products are affected by a vulnerability that could allow remote attackers to conduct a denial of service attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released updates for several affected products and rec…
first Feb 11, 2020 -
High
Siemens SCALANCE S-600 (Update B)
The firmware for SCALANCE S-600 family devices contains multiple web vulnerabilities. The vulnerabilities could allow an remote attacker to conduct Denial-of-Service attacks or perform Cross-Site Scripting attacks. Siemens has released updates for the affecte…
first Feb 11, 2020 -
High max 7.5
Siemens SCALANCE and SIMATIC (Update H)
The products listed below contain a vulnerability that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet w…
first Apr 14, 2020 -
High
Siemens SIMATIC, SINAMICS (Update C)
Multiple SIMATIC Software products are affected by two vulnerabilities that could allow an attacker to manipulate project files that may lead to Remote Code Execution or Denial-of-Service attacks. Siemens has released updates to some of the affected products …
first Jun 9, 2020 -
Medium max 9.8
Siemens SIMATIC HMI Products (Update A)
SIMATIC HMI Products are affected by two vulnerabilities that could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Siemens has released updates for the affected products and recommends to upd…
first Sep 8, 2020 -
Medium
Siemens Industrial Products (Update F)
Security researchers published information on a vulnerability known as Crosstalk (INTEL-SA-00320). This vulnerability affects modern Intel processors to a varying degree. Several Siemens Industrial Products contain processors that are affected by the vulnerab…
first Sep 8, 2020