4,108 results · Feed
-
Medium max 5.9
Siemens OpenSSL Vulnerabilities in Industrial Products
OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1k, that allows an unauthenticated attacker to cause a Denial-of-Service (DoS) if a maliciously crafted renegotiation message is sent. Siemens has released new…
first Jul 13, 2021 -
Critical max 9.9
Siemens SICAM Q100
SICAM Q100 devices contain multiple vulnerabilities that could allow an attacker to take over the session of a logged in user or to inject custom code. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Nov 8, 2022 -
Medium max 5.5
Siemens SICAM Q100 Devices
The web server of SICAM Q100 devices, versions before V2.60, contains a Cross Site Request Forgery (CSRF) vulnerability and is missing cookie protection flags. This could allow an attacker to perform arbitrary actions on the device on behalf of a legitimate u…
first Dec 12, 2023 -
High max 7.8ICSA-24-011-06 4 CVEs
Siemens Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious CGM files. If a user is tricked to open a malicious CGM file with the affected products, this could l…
-
High max 7.8ICSA-24-011-07 1 CVE
Siemens Spectrum Power 7
Spectrum Power 7 is affected by a vulnerability that could allow an authenticated local attacker to inject arbitrary code and gain root access. Siemens has released an update for Spectrum Power 7 and recommends to update to the latest version.
-
Medium max 6.6ICSA-24-011-08 1 CVE
Siemens SICAM A8000
The CPCI85 firmware of SICAM A8000 CP-8031 and CP-8050 is affected by a command injection vulnerability that could allow an authenticated remote attacker to inject commands that are executed on the device with root privileges during device startup. Siemens ha…
-
Critical max 9.8ICSA-24-011-09 3 CVEs
Siemens SIMATIC CN 4100
SIMATIC CN 4100 is vulnerable to authorization bypass through user-controlled key, use of default credentials and unauthenticated IP address change that could allow an attacker to remotely login as root or cause denial of service condition of the device. Siem…
-
Critical max 10.0ICSA-24-011-10 1 CVE
Siemens SIMATIC
MaxView Storage Manager shipped with affected SIMATIC IPCs contains a Redfish Server Vulnerability that could provide unauthorized access. Microchip has released new versions for the affected products and recommends to update to the latest versions.
-
High max 7.8ICSA-24-011-11 11 CVEs
Siemens Solid Edge
Siemens Solid Edge 2023 has released Update 10, that fixes multiple vulnerabilities that could be triggered when the application reads PAR files. If a user is tricked to open a malicious file using the affected application, this could lead to a crash, and pot…
-
Critical max 9.8
Unitronics Vision and Samba Series (Update A)
Successful exploitation of this vulnerability could allow an unauthenticated attacker to take administrative control of Unitronics Vision and Samba series systems and use a default administrative password.
first Dec 14, 2023 -
Critical max 9.8ICSA-24-004-01 2 CVEs
Rockwell Automation FactoryTalk Activation
Successful exploitation of these vulnerabilities could result in a buffer overflow and allow the attacker to gain full access to the system.
-
High max 7.5ICSA-24-004-02 3 CVEs
Mitsubishi Electric Factory Automation Products
Successful exploitation of these vulnerabilities could disclose information in the product or could cause denial-of-service (DoS) condition.
-
High max 8.8
FXC AE1021/AE1021PE
Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution on the device via NTP server settings.
-
High max 8.0
QNAP VioStor NVR
Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution by exploiting NTP settings.
-
High max 7.4ICSA-24-331-05 1 CVE
Hitachi Energy RTU500 Scripting Interface
Hitachi Energy is aware of a reported vulnerability in the RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certi…
-
High max 7.5
Johnson Controls Metasys and Facility Explorer (Update A)
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service by sending invalid credentials.
first Dec 7, 2023 -
High max 7.8ICSA-23-353-01 1 CVE
Subnet Solutions Inc. PowerSYSTEM Center
Successful exploitation of this vulnerability could result in an attacker achieving arbitrary code execution and privilege escalation through the unquoted service path.
-
Critical max 9.6ICSA-23-353-02 2 CVEs
EFACEC BCU 500
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product or compromise the web application through a cross-site request forgery (CSRF) vulnerability.
-
Medium max 6.3ICSA-23-353-03 4 CVEs
EFACEC UC 500E
Successful exploitation of these vulnerabilities could allow an attacker to retrieve sensitive information, gain unauthorized access to the product, or redirect users to malicious websites.
-
High max 7.8ICSA-23-353-04 3 CVEs
Open Design Alliance Drawing SDK
Successful exploitation of this vulnerability could allow remote attackers to disclose sensitive information on affected installations of ODA Drawing SDK.
-
Critical max 9.8ICSA-23-353-05 3 CVEs
EuroTel ETL3100 Radio Transmitter
Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to gain full access to the system, disclose sensitive information, or access hidden resources.
-
Medium
Philips Patient Monitoring Devices (Update C)
Successful exploitation of these vulnerabilities could result in unauthorized access, interrupted monitoring, and collection of access information and/or patient data. To successfully exploit these vulnerabilities, an attacker would need to gain either physic…
first Sep 10, 2020 -
High max 7.5ICSA-23-348-02 1 CVE
Johnson Controls Kantech Gen1 ioSmart
An attacker with physical access to the Kantech Gen1 ioSmart card reader in certain circumstances can recover the reader's communication memory between the card and reader.
-
Medium max 5.3ICSA-23-346-01 1 CVE
Schneider Electric Easy UPS Online Monitoring Software
Successful exploitation of this vulnerability could allow elevation of privileges which could result in arbitrary file deletion with system privileges.
-
High
Siemens RUGGEDCOM ROS (Update A)
The boot loader within RUGGEDCOM ROS contains two vulnerabilities in the loading process of the operating system kernel. The more severe of these vulnerabilities could allow an attacker with local access to the device to execute arbitrary code on an affected …
first Dec 10, 2019 -
High max 8.4
Siemens LOGO! Soft Comfort
Two vulnerabilities have been identified in the LOGO! Soft Comfort software. These could allow an attacker to take over a system with the affected software installed. Siemens has released an update for LOGO! Soft Comfort and recommends to update to the latest…
first Apr 13, 2021 -
High max 7.5ICSA-23-348-05 2 CVEs
Siemens SIMATIC and SIPLUS Products
Multiple vulnerabilities in the affected products could allow an unauthorized attacker with network access to the webserver to perform a denial of service attack. Siemens has released a new version for SINAMICS S120 (incl. SIPLUS variants) and recommends to u…
-
High max 7.5ICSA-23-348-06 1 CVE
Siemens OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC
SINUMERIK ONE and SINUMERIK MC products are affected by a denial of service vulnerability in the OPC UA implementation of the integrated S7-1500 CPU. The vulnerability in the integrated S7-1500 CPU is documented in more detail in SSA-711309 [1]. Siemens has r…
-
Medium max 4.2ICSA-23-348-07 1 CVE
Siemens SIMATIC STEP 7 (TIA Portal)
Siemens has released a new version of STEP 7 (TIA Portal) that fixes an information disclosure vulnerability. A local attacker could gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the har…
-
High max 8.1ICSA-23-348-16 7 CVEs
Siemens SINEC INS
SINEC INS before V1.0 SP2 Update 2 is affected by multiple vulnerabilities. Siemens has released an update for SINEC INS and recommends to update to the latest version.
-
Medium max 5.5ICSA-23-341-01 2 CVEs
Mitsubishi Electric FA Engineering Software Products
Successful exploitation of these vulnerabilities may allow a malicious attacker to disclose information in the affected products.
-
Medium max 4.3ICSA-23-341-02 1 CVE
Schweitzer Engineering Laboratories SEL-411L
Successful exploitation of this vulnerability could expose authorized users to clickjacking attacks.
-
High max 7.5ICSA-23-341-05 1 CVE
ControlbyWeb Relay
Successful exploitation of this vulnerability could allow an authenticated attacker to run malicious code during a user's session.
-
High max 8.1ICSA-23-341-06 7 CVEs
Sierra Wireless AirLink with ALEOS firmware
Successful exploitation of these vulnerabilities could allow an attacker to perform remote code execution to take full control of the device, steal credentials through a cross site scripting attack, or crash the device being accessed through a denial-of-servi…
-
Critical max 9.8
FESTO Automation Suite, FluidDraw, and Festo Didactic Products
A vulnerability in the Wibu CodeMeter Runtime, which is part of the installation packages of several Festo products, was found. An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via…
first Nov 28, 2023 -
Medium max 5.4ICSA-23-339-01 1 CVE
Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d
Successful exploitation of this vulnerability could allow an attacker to send specially crafted packets to change credentials without any prior authentication.
-
High max 7.8ICSA-23-334-01 1 CVE
Delta Electronics DOPSoft
Successful exploitation of this vulnerability could lead to remote code execution.
-
MediumICSA-23-334-02 1 CVE
Yokogawa STARDOM
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a specially crafted packet.
-
Critical max 9.1ICSA-23-334-03 2 CVEs
PTC KEPServerEx
Successful exploitation of these vulnerabilities could allow an attacker gaining Windows SYSTEM-level code execution on the service host and may cause the product to crash, leak sensitive information, or connect to the product without proper authentication.
-
High max 7.8ICSA-23-334-04 1 CVE
Mitsubishi Electric FA Engineering Software Products
Successful exploitation of this vulnerability could allow a malicious attacker to execute malicious code by tricking legitimate users to open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-o…