4,105 results · Feed
-
Medium
Siemens Embedded TCP/IP Stack Vulnerabilities-AMNESIA:33 (Update C)
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as "AMNESIA:33" vulnerabilities. This advisory describes the impact of one of these vulnerabilities (CVE-2020-13988) to Siem…
first Dec 8, 2020 -
Critical
Siemens Products using TightVNC (Update A)
Multiple TightVNC (V1.x) vulnerabilities could allow remote code execution and Denial-of-Service attacks under certain conditions. Siemens has previously released this advisory containing a set of products that were considered to be affected. Through Siemens'…
first Dec 8, 2020 -
Critical
Siemens SCALANCE X Products (Update B)
Several SCALANCE X switches contain vulnerabilities in the web server of the affected devices. An unauthenticated attacker could reboot, cause denial-of-service conditions and potentially impact the system by other means through heap and buffer overflow vulne…
first Jan 12, 2021 -
Medium
dnsmasq by Simon Kelley (Update A)
Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component "dnsmasq", also known as "DNSpooq" vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affe…
first Jan 19, 2021 -
High
Siemens TIA Administrator (Update A)
The latest update for TIA Administrator, installed together with TIA Portal and PCS neo, fixes a privilege escalation vulnerability that could allow local users to escalate privileges and execute code as local SYSTEM user. Siemens has released updates for the…
first Feb 9, 2021 -
High
Open Design Alliance Drawings SDK (Update A)
Siemens has released version V13.1.0.1 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in different file formats (BMP, TIFF, CGM, TGA, PCT, HPG, PLT, RAS, PAR, ASM, DXF, DWG). If a us…
first Feb 9, 2021 -
High
Siemens SCALANCE and RUGGEDCOM Devices SSH (Update A)
Some firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the SSH authentication that could allow an attacker to cause a Denial-of-Service under certain conditions. Siemens has released updates for the affect…
first Mar 9, 2021 -
High max 6.5
Siemens SCALANCE and RUGGEDCOM Devices (Update A)
Several firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the passive listening feature that could allow an attacker to cause a reboot or, under specific circumstances, attain remote code execution of the …
first Mar 9, 2021 -
Medium
Siemens TCP/IP Stack Vulnerabilities-AMNESIA:33 in SENTRON PAC / 3VA Devices (Update C)
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as "AMNESIA:33" vulnerabilities. This advisory describes the impact of two of these vulnerabilities (CVE-2020-13987, CVE-202…
first Mar 9, 2021 -
High
Siemens Solid Edge File Parsing
Siemens has released new versions for Solid Edge to fix multiple vulnerabilities that could be triggered when the application reads files in different file formats (PAR, DFT, XML extensions). If a user is tricked to open a malicious file with the affected app…
first Mar 9, 2021 -
High max 8.1
Siemens Nucleus Products DNS Module (Update A)
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerabilities described in this advisory are from this set. The DNS client of the networking component (Nucleus N…
first Apr 13, 2021 -
High
Siemens Solid Edge File Parsing (Update A)
Siemens has released a new version for Solid Edge to fix multiple vulnerabilities that could be triggered when the application reads files in different file formats (PAR, DFT extensions). If a user is tricked to open a malicious file with the affected applica…
first Apr 13, 2021 -
Critical
Siemens Web Server of SCALANCE X200 (Update A)
Several SCALANCE X-200 switches contain buffer overflow vulnerabilities in the web server. In the most severe case an attacker could potentially remotely execute code. Siemens is preparing updates and recommends specific countermeasures for products where upd…
first Apr 13, 2021 -
High max 7.5
Siemens SINEMA Remote Connect Server
The latest update for SINEMA Remote Connect Server fixes two Denial-of-Service vulnerabilities in the underlying third-party XML parser. Siemens has released updates for the affected product and recommends to update to the latest versions.
first Apr 13, 2021 -
High
Siemens Tecnomatix RobotExpert
Siemens Tecnomatix RobotExpert version V16.1 fixes a vulnerability that could be triggered when the application reads CELL files. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to …
first Apr 13, 2021 -
Medium max 6.5
Siemens SIMOTICS CONNECT 400 (Update A)
SIMOTICS CONNECT 400 is affected by DNS Client vulnerabilities as initially reported in Siemens Security Advisory SSA-705111 (https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf) for the DNS Module in Nucleus RTOS. Siemens has released updates for …
first Apr 13, 2021 -
Medium
Siemens Nucleus DNS (Update A)
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerability described in this advisory is from this set. The DNS client of of the networking component (Nucleus N…
first Apr 13, 2021 -
Critical
Siemens and Milestone Siveillance Video Open Network Bridge
Siemens has released hotfixes for Siveillance Video Open Network Bridge (ONVIF) which fix a security vulnerability related to unsecure storage of ONVIF user credentials. The vulnerability could allow an authenticated remote attacker to retrieve and decrypt al…
first Apr 13, 2021 -
High
Siemens Mendix
The latest updates for Mendix fix a vulnerability in Mendix Applications that could allow malicious authorized users to escalate their privileges. Mendix has released an update for Mendix and recommends to update to the latest version.
first Apr 14, 2021 -
Critical max 9.8
Siemens SINAMICS Medium Voltage Products Remote Access (Update B)
SINAMICS medium voltage products, with Sm@rtServer enabled on SIMATIC comfort HMI Panels, are affected by multiple vulnerabilities that could allow an attacker, under certain conditions, to gain full remote access to the HMI. Note that by default Sm@rtServer …
first May 11, 2021 -
Medium
Siemens Mendix Database Replication Module
The latest update of Mendix Database Replication module fixes a infomation disclosure vulnerability. Mendix has released an update for the Mendix Database Replication module and recommends to update to the latest version.
first May 11, 2021 -
Medium
Siemens SNMP Implementation of WinCC Runtime
A denial-of-service vulnerability in WinCC Runtime could allow an unauthenticated attacker with network access to cause a denial-of-service condition in the SNMP service by sending crafted SNMP packets to port 161/udp. Siemens has released updates for the aff…
first May 11, 2021 -
High
Siemens SIMATIC NET CP343-1
A vulnerability in SIMATIC CP343-1 devices could allow an attacker to cause a Denial-of-Service condition on TCP port 102 of the affected devices by sending specially crafted packets. Siemens recommends specific countermeasures for products where updates are …
first May 11, 2021 -
High
Siemens Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation has released an update for version V16.0 that fixes multiple vulnerabilities that could be triggered when the application reads SPP files. If a user is tricked to open a malicious file using the affected application, this c…
first May 11, 2021 -
Medium
Siemens Mendix Excel Importer Module
The latest update of Mendix Excel Importer module fixes an infomation disclosure vulnerability. Mendix has released an update for the Mendix Excel Importer module and recommends to update to the latest version.
first May 11, 2021 -
High
Siemens SCALANCE XM-400 and XR-500 Devices
SCALANCE XM-400 and XR-500 devices contain a vulnerability in the OSPF protocol implementation that could allow an unauthenticated remote attacker to create a permanent denial-of-service condition. Siemens has released updates for the affected products and re…
first May 11, 2021 -
Critical
Siemens SIMATIC UltraVNC HMI WinCC Products
UltraVNC vulnerabilities in the affected products listed below could allow remote code execution, information disclosure and Denial-of-Service attacks under certain conditions. Siemens has released updates for the affected products and recommends to update to…
first May 11, 2021 -
Critical max 9.8
Siemens SIMATIC SmartVNC HMI WinCC Products (Update B)
Multiple SmartVNC vulnerabilities in the affected products listed below could allow remote code execution and Denial-of-Service attacks under certain conditions. Siemens has released updates for the affected products and recommends to update to the latest ver…
first May 11, 2021 -
Critical
Siemens SCALANCE W1750D (Update B)
The Scalance W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or trigger buffer overflows. Siemens has released updates for the affected products and recommends to update to the latest versions.
first May 11, 2021 -
High
Siemens SIMATIC S7-1500
Intel has published information on vulnerabilities in Intel products in November 2020. This advisory lists the Siemens Controllers that are affected by these vulnerabilities. In this advisory we take a representative CVE from each advisory: - “Intel CSME, SPS…
first May 11, 2021 -
High
ICSA-21-040-06_Siemens JT2Go and Teamcenter Visualization (Update A)
Siemens has released version V13.1.0.2 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in ASM and PAR file formats. If a user is tricked to opening of a malicious file with the affect…
first May 17, 2021 -
High max 9.8
Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update A)
SIMATIC S7-1200 and S7-1500 CPU products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks. Siemens has released updates fo…
first May 28, 2021 -
High
Siemens Mendix SAML Module
The latest update of Mendix SAML module fixes a privilege escalation vulnerability. Mendix has released an update for the Mendix SAML module and recommends to update to the latest version.
first Jun 8, 2021 -
High
Siemens TIM 1531 IRC
The latest update for TIM 1531 IRC fixes a vulnerability that could allow a remote attacker to cause a denial-of-service under certain circumstances. Siemens has released an update for the TIM 1531 IRC and recommends to update to the latest version.
first Jun 8, 2021 -
High
Siemens Solid Edge
Siemens has released a new version for Solid Edge to fix two vulnerabilities that could be triggered when the application read files in DFT file format. If a user is tricked to opening of a malicious file with the affected products, this could lead to applica…
first Jun 8, 2021 -
High
Siemens SIMATIC TIM libcurl
SIMATIC TIM 1531 IRC devices are vulnerable to multiple vulnerabilities in the third party component libcurl that could allow an attacker to extract sensitive information and pass a revoked certificate as valid. Siemens has released an update for SIMATIC TIM …
first Jun 8, 2021 -
Critical max 3.7
Siemens SIMATIC NET CP 443-1 OPC UA
All versions of the SIMATIC CP 443-1 OPC UA contain multiple vulnerabilities in the underlying third party component NTP. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
first Jun 8, 2021 -
High
Siemens Simcenter Femap
Siemens Simcenter Femap is affected by two vulnerabilities that could be triggered when the application reads modfem files. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to arbitr…
first Jun 8, 2021 -
High
Siemens SIMATIC RFID (Update B)
The latest updates for SIMATIC RF products fix a vulnerability that could allow an unauthorized attacker to crash the OPC UA service of the affected devices. Siemens has released updates for the affected products and recommends to update to the latest version…
first Jun 8, 2021 -
High
Siemens JT2Go and Teamcenter Visualization
Siemens has released version V13.1.0.3 for JT2Go and Teamcenter Visualization to fix a vulnerability that could be triggered when the products read files in TIFF file format. If a user is tricked to opening of a malicious file with the affected products, this…
first Jun 8, 2021