4,105 results · Feed
-
Critical max 10.0
Siemens SIMATIC STEP 7 and Derived Products
SIMATIC STEP 7 and PCS 7 contain a database management system that could allow remote users to use embedded functions of the database (local or in a network share) that have impact on the server. An attacker with network access to the server network could lev…
first Jun 13, 2023 -
Critical max 9.8
Siemans WIBU Systems CodeMeter
WIBU Systems published information about a heap buffer overflow vulnerability and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products for license management. The vulnerability is des…
first Sep 12, 2023 -
High max 8.8
Siemens RUGGEDCOM APE180
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC before V22.6.2. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeas…
first Oct 10, 2023 -
High max 8.8
Siemens RUGGEDCOM APE1808 Devices
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC before V22.6.3 and 23.1.0. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific …
first Nov 14, 2023 -
High max 7.5
Siemens Simantic S7-1500 CPU family
A vulnerability has been identified in the SIMATIC S7-1500 CPU family and related products that could allow an attacker to cause a denial of service condition. In order to exploit the vulnerability, an attacker must have access to the affected devices on port…
first Dec 12, 2023 -
Medium max 5.3
Siemens RUGGEDCOM APE1808
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC before 23.3.0. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version for RUGGEDCOM APE1808 and reco…
first Feb 13, 2024 -
High max 7.8
Siemens Polarion ALM
Polarion ALM is affected by incorrect default path permissions in installation path, and improper authentication in the REST API endpoints of DOORS connector. An attacker could exploit the vulnerabilities for unauthenticated access, or privilege escalation. S…
first Feb 13, 2024 -
High max 7.8
Siemens Solid Edge
Solid Edge is affected by an out of bounds read vulnerability that could be triggered when the application reads files that contains XT parts. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnera…
first Mar 12, 2024 -
Critical max 10.0
Siemens Sinteso EN Cerberus PRO EN Fire Protection Systems
Several products used in Sinteso EN and Cerberus PRO EN Fire Protection Systems contain buffer overflow vulnerabilities in the network communication stack. Successful exploitation of the vulnerabilities could allow an unauthenticated attacker, who gained acce…
first Mar 12, 2024 -
High max 7.8ICSA-24-137-01 3 CVEs
Siemens Parasolid
Parasolid is affected by out of bounds read and null pointer dereference vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could le…
-
High max 7.8ICSA-24-137-03 2 CVEs
Siemens Teamcenter Visualization and JT2Go
Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious CGM or XML files. If a user is tricked to open a malicious file with the affected products, this could lead t…
-
Medium max 6.5ICSA-24-137-04 1 CVE
Siemens Polarion ALM
The Apache Lucene based query engine in Polarion ALM lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects. Siemens has released a new version for Polarion ALM and recommends to update to the la…
-
High max 7.8ICSA-24-137-05 1 CVE
Siemens Simcenter Nastran
Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a malicious string, an attack…
-
Critical max 10.0ICSA-24-137-06 3 CVEs
Siemens SIMATIC CN 4100
SIMATIC CN 4100 is vulnerable to use of hard coded credentials including root user and contains an unrestricted USB port that could be misused for insecure boot. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest ver…
-
High max 7.8ICSA-24-137-08 11 CVEs
Siemens PS/IGES Parasolid Translator Component
PS/IGES Parasolid Translator Component contains multiple file parsing vulnerabilities that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this could lea…
-
High max 7.8ICSA-24-137-09 8 CVEs
Siemens Solid Edge
Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application is parsing PAR files. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability t…
-
Critical max 9.8ICSA-24-137-10 9 CVEs
Siemens RUGGEDCOM CROSSBOW
The RUGGEDCOM CROSSBOW server application before V5.5 contains multiple vulnerabilities that could allow an attacker to execute arbitrary database queries via SQL injection attacks, or upload of arbitrary files to the application's file system. The majority o…
-
High max 7.5ICSA-24-137-11 2 CVEs
Siemens RUGGEDCOM APE1808
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC before 23.4.1. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version for RUGGEDCOM APE1808 and reco…
-
Critical max 10.0ICSA-24-137-12 3 CVEs
Siemens Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems
Several products used in Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems contain buffer overflow vulnerabilities in the network communication stack. Successful exploitation of the vulnerabilities could allow an unauthenticated attacker, who …
-
High max 8.6
Rockwell Automation ControlLogix and GuardLogix (Update A)
Successful exploitation of this vulnerability could allow an attacker to cause a major nonrecoverable fault (MNRF) resulting in the product to become unavailable.
first Apr 16, 2024 -
High max 7.5ICSA-24-130-01 2 CVEs
Rockwell Automation FactoryTalk Historian SE
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.
-
High max 8.3ICSA-24-130-02 1 CVE
alpitronic Hypercharger EV charger
Successful exploitation of this vulnerability could result in an attacker disabling the device, bypassing payment, or accessing payment data.
-
Critical max 10.0
Delta Electronics InfraSuite Device Master
Successful exploitation of this vulnerability could allow remote code execution.
-
High max 7.1ICSA-24-128-01 1 CVE
PTC Codebeamer
Successful exploitation of this vulnerability could allow an attacker to inject malicious code in the application.
-
High max 8.4ICSA-24-128-02 1 CVE
SUBNET Substation Server
Successful exploitation of the vulnerabilities in components used by Substation Server could allow privilege escalation, denial-of-service, or arbitrary code execution.
-
Medium max 4.3
Chirp Systems Chirp Access (Update C)
Successful exploitation of this vulnerability could allow an attacker to adjust the Beacon configuration settings and/or disable the Bluetooth functionality of doors where non-networked Beacons are deployed.
first Mar 7, 2024 -
High max 8.8ICSA-24-123-02 3 CVEs
Delta Electronics DIAEnergie
Successful exploitation of these vulnerabilities could allow an authenticated attacker with limited privileges to escalate privileges, retrieve confidential information, upload arbitrary files, backdoor the application, and compromise the system on which DIAE…
-
High max 8.0ICSA-24-354-02 2 CVEs
Hitachi Energy SDM600
Hitachi Energy is aware of multiple vulnerabilities that affect the SDM600 versions listed below. An attacker who managed to be authenticated to SDM600 and successfully exploit these vulnerabilities could elevate privileges and gain unauthorized access to the…
-
Medium max 5.5
SEW-EURODRIVE MOVITOOLS MotionStudio
Successful exploitation of this vulnerability could result in open access to file information.
first Jan 16, 2024 -
High max 7.5
Unitronics Vision Legacy series (Update A)
Successful exploitation of this vulnerability could allow an attacker to log in to the Remote HMI feature, where the PLC may be factory reset, stopped, and restarted.
first Apr 18, 2024 -
Critical max 10.0
Mitsubishi Electric MELSEC Series CPU module (Update D)
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition or execute malicious programs on a target product by sending specially crafted packets.
first May 23, 2023 -
High max 7.5
Rockwell Automation 5015-AENFTXT (Update A)
Successful exploitation of this vulnerability could allow an attacker to crash the device and impact availability for the affected system.
first Apr 11, 2024 -
High max 8.2ICSA-24-116-01 2 CVEs
Hitachi Energy RTU500 Series
Successful exploitation of these vulnerabilities could allow the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
-
Critical max 9.1ICSA-24-116-04 16 CVEs
Honeywell Experion PKS, Experion LX, PlantCruise by Experion, Safety Manager, Safety Manager SC
Successful exploitation of these vulnerabilities could disclose sensitive information, allow privilege escalation, or allow remote code execution.
-
Critical max 9.8
Mitsubishi Electric Electrical discharge machines
Successful exploitation of this vulnerability could allow an attacker to disclose, tamper with, destroy, or delete information in the products, or cause a denial-of-service condition on the products.
first Feb 20, 2024 -
Critical max 9.1
Mitsubishi Electric MELSEC iQ-R Series
Successful exploitation of this vulnerability could allow a remote attacker to be able to log in to the CPU module by obtaining credentials.
first Aug 6, 2021 -
High
Mitsubishi Electric MELSEC iQ-R Series
Successful exploitation of these vulnerabilities could allow a remote attacker unauthorized access to legitimate usernames, CPU module access, or the ability to deny access to legitimate users.
first Sep 7, 2021 -
Medium max 5.5ICSA-24-107-01 1 CVE
Measuresoft ScadaPro
Successful exploitation of this vulnerability could allow an attacker to escalate their privileges from unprivileged to SYSTEM privileges.
-
High max 8.8ICSA-24-107-02 7 CVEs
Electrolink FM/DAB/TV Transmitter
Successful exploitation of these vulnerabilities could allow an attacker to obtain full system access, keep the device from transmitting, escalate privileges, change credentials, and execute arbitrary code.
-
Low max 3.3ICSA-24-107-04 1 CVE
RoboDK RoboDK
Successful exploitation of this vulnerability could result in an attacker crashing the program through heap-based buffer overflow.