4,105 results · Feed
-
Critical
Siemens SCALANCE X-300 Switches
Several SCALANCE X-300 switches contain multiple vulnerabilities. An unauthenticated attacker could reboot, cause denial of service conditions and potentially impact the system by other means through heap and buffer overflow vulnerabilities. Siemens has relea…
first Apr 12, 2022 -
Medium
Siemens SICAM A8000
SICAM A8000 CP-8050 and CP-8031 devices contain vulnerabilities that could allow an attacker to access files without authentication. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Apr 12, 2022 -
Critical
Siemens SIMATIC Energy Manager
SIMATIC Energy Manager is affected by multiple vulnerabilities that could allow an attacker to gain local privilege escalation, local code execution or remote code execution. Siemens has released updates for the affected products and recommends to update to t…
first Apr 12, 2022 -
Medium
Siemens SIMATIC STEP 7 (TIA Portal)
An attacker could achieve privilege escalation on the web server of certain devices configured by SIMATIC STEP 7 (TIA Portal) due to incorrect handling of the webserver's user management configuration during downloading. This only affects the S7-1200 and S7-1…
first Apr 12, 2022 -
High
Siemens Simcenter Femap
Siemens Simcenter Femap versions before V2022.1.2 are affected by vulnerabilities that could be triggered when the application reads files in .NEU format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage …
first Apr 12, 2022 -
Low
Siemens Mendix
When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field. Siemens has released updates for the affected products and recommend…
first Apr 12, 2022 -
Critical max 9.8
Siemens SICAM P850 and SICAM P855
Multiple vulnerabilities were identified in the webserver of SICAM P850 and SICAM P855 devices. These include unauthenticated access to web-interface functionality, missing HTTPS or impersonation as well as cross-site scripting related vulnerabilities. Siemen…
first May 10, 2022 -
High
Siemens JT2GO and Teamcenter Visualization
Siemens has released updates for JT2Go and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as CGM, TIFF or TG4) with any of the affected products, this could lead the application to…
first May 10, 2022 -
High
Siemens SIMATIC CP 44x-1 RNA
Siemens has released a new version for the communication processor modules CP 44x-1 RNA that fixes a vulnerability that could allow an attacker to cause a denial of service condition. Siemens has released updates for the affected products and recommends to up…
first May 10, 2022 -
High max 7.5
Siemens Industrial Products
A vulnerability has been identified in the OPC Foundation Local Discovery Server (LDS) [0] of several industrial products. The vulnerability could cause a denial of service condition on the service or the device. Siemens has released new versions for several …
first May 10, 2022 -
High
Siemens Simcenter Femap
Siemens Simcenter Femap versions before V2022.2 are affected by an out of bounds write vulnerability that could be triggered when the application reads files in .NEU format. If a user is tricked to open a malicious file with the affected application, an attac…
first May 10, 2022 -
Medium
Siemens OpenV2G
The open source software OpenV2G contains a buffer overflow vulnerability that could allow an attacker to trigger a memory corruption. Siemens has released an update for the OpenV2G and recommends to update to the latest version.
first May 10, 2022 -
High max 7.8
Siemens Xpedition Designer
A vulnerability in Xpedition Designer could allow an attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges. Siemens has released updates for the affected products and recommends to update …
first Jun 14, 2022 -
Critical max 9.6
Siemens SCALANCE X Switch Devices
Several SCALANCE X switches contain multiple vulnerabilities. An unauthenticated attacker could reboot, cause denial-of-service conditions and potentially impact the system by other means through heap and buffer overflow vulnerabilities. Siemens has released …
first Jul 12, 2022 -
Medium max 5.3
Siemens RUGGEDCOM ROS
RUGGEDCOM ROS-based devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP conn…
first Sep 13, 2022 -
High max 8.6
Siemens SCALANCE and RUGGEDCOM Devices
The products listed below contain a denial of service vulnerability in the TCP event interface that could allow an unauthenticated remote attacker to render the device unusable. Siemens has released updates for the affected products and recommends to update t…
first Oct 11, 2022 -
Critical max 9.9
Siemens SICAM P850 and P855 Devices
Session fixation and multiple incorrect parameter parsing vulnerabilities that could potentially lead to remote code execution were identified in the web server of SICAM P850 and SICAM P855 devices. Siemens has released updates for the affected products and r…
first Oct 11, 2022 -
Medium max 6.5
Siemens Web Server Login Page of Industrial Controllers
The web server login page of affected products does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.. Siemens has released updates for sever…
first Nov 8, 2022 -
High max 7.6
Siemens QMS Automotive
QMS Automotive contains a vulnerability that stores user credentials in plantext within the user database. This could allow an attacker to read credentials from memory. Siemens has released an update for QMS Automotive and recommends to update to the latest v…
first Nov 8, 2022 -
High max 7.8
Siemens Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious TIF, CGM or PDF files. If a user is tricked to open a malicious TIF, CGM or PDF file with the affecte…
first Nov 8, 2022 -
High max 7.5
Siemens Multiple Denial of Service Vulnerabilities in Industrial Products
Affected SIMATIC firmware contains multiple vulnerabilities that could allow an unauthenticated attacker to perform a denial of service attack under certain conditions. Siemens has released updates for the affected products and recommends to update to the lat…
first Dec 13, 2022 -
High max 7.6
Siemens SCALANCE Products
Multiple SCALANCE devices are affected by several vulnerabilities that could allow an attacker to inject code, retrieve data as debug information as well as user CLI passwords or set the CLI to an irresponsive state. Siemens has released updates for the affec…
first Dec 13, 2022 -
High max 7.8
Siemens Simcenter STAR-CCM+
Simcenter STAR-CCM+ contains a privilege escalation vulnerability which could allow a local attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges. Siemens has released an update for Simcen…
first Dec 13, 2022 -
Medium max 5.4
Siemens Polarion ALM
Polarion ALM contains a misconfiguration in its default Apache HTTP Server configuration that could allow an attacker to perform host header injection attacks. Siemens has released an update for Polarion ALM and recommends to update to the latest version.
first Dec 13, 2022 -
High max 7.5
Siemens Parasolid
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitra…
first Dec 13, 2022 -
High
Siemens SISCO MMS-EASE Third Party Component
A vulnerability in the third party component SISCO MMS-EASE could allow attackers to cause a denial of service condition with SIPROTEC 5 devices. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Dec 13, 2022 -
High max 8.8
Siemens APOGEE and TALON
APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities: - CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege acc…
first Dec 13, 2022 -
High max 7.8
Siemens Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads a malicious file in CGM or RAS format. If a user is tricked to open a malicious file with the affected products…
first Dec 13, 2022 -
High max 7.5
Siemens APOGEE/TALON Field Panels
Successful exploitation of this vulnerability could allow an attacker to hijack existing sessions or spoof future sessions.
first Dec 15, 2022 -
High max 7.9
Siemens SIMATIC Industrial Products
Intel has published information on vulnerabilities in Intel products in November 2022. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update ("2022.3 IPU – B…
first Feb 14, 2023 -
Critical max 9.1
Siemens Mendix SAML Module
The Mendix SAML module insufficiently verifies the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. Mendix has provided fix releases for the Mendix SAML module and recommends to upd…
first Mar 14, 2023 -
High max 7.8
Siemens JT Open and JT Utilities
JT Open Toolkit and JT Utilities are affected by a memory corruption vulnerability that could be triggered while parsing JT files. If a user is tricked to open a malicious JT file with any of the affected products, this could cause the application to crash or…
first Apr 11, 2023 -
High max 7.8
Siemens in OPC Foundation Local Discovery Server
A vulnerability was identified in OPC Foundation Local Discovery Server which also affects Siemens products that could allow an attacker to escalate privileges under certain circumstances. Siemens has released new versions for several affected products and re…
first Apr 11, 2023 -
Medium max 6.7
Siemens SCALANCE X-200IRT Devices
The SSH server on SCALANCE X-200IRT devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the aff…
first Apr 11, 2023 -
Critical max 9.8
Siemens SCALANCE XCM332
Multiple vulnerabilities in the third-party components cURL, BusyBox, libtirpc, Expat as well as in the Linux Kernel could allow an attacker to impact the SCALANCE XCM332 device's confidentiality, integrity and availability. Siemens has released an update for…
first Apr 11, 2023 -
High max 7.5
Siemens Industrial Products
Multiple vulnerabilities in the affected products could allow an unauthorized attacker with network access to the webserver of an affected products to perform a denial of service attack. Siemens has released new versions for the affected products and recommen…
first Apr 11, 2023 -
High max 5.5
Siemens Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by a memory corruption vulnerability in the APDFL library from Datalogics. If a user is tricked to open a malicious PDF file with the affected products, this could lead the application to crash or potent…
first Apr 11, 2023 -
Medium max 5.9
Siemens Polarion ALM
Polarion ALM is vulnerable to XML External Entity (XXE) injection attack that could allow an attacker to potentially disclose confidential data. Siemens has released an update for Polarion ALM and recommends to update to the latest version.
first Apr 11, 2023 -
High max 7.3
Siemens Mendix Forgot Password Module
Successful exploitation of the vulnerability could allow an attacker to retrieve sensitive information.
first Apr 18, 2023 -
High max 7.2
Siemens SIMATIC Cloud Connect 7
SIMATIC Cloud Connect 7 contains multiple vulnerabilities that could allow an attacker to impact its confidentiality, integrity and availability. Siemens has released updates for the affected products and recommends to update to the latest versions.
first May 9, 2023