4,108 results · Feed
-
High max 7.5
Siemens SIMATIC S7-400
SIMATIC S7-400 CPU devices contain an input validation vulnerability that could allow an attacker to create a Denial-of-Service condition. A restart is needed to restore normal operations. Siemens has released an update for SIMATIC S7-410 V10 CPU family and S…
first Apr 12, 2022 -
Medium max 6.2ICSA-23-103-01 1 CVE
Siemens Adaptec Maxview Application
The Adaptec Maxview application shipped with affected SIMATIC IPCs contains a hard coded, non-unique certificate to secure HTTPS connections between the browser and the local Maxview configuration application. A local attacker may use this key to decrypt inte…
-
Critical max 9.8ICSA-23-103-07 1 CVE
Siemens CPCI85 Firmware of SICAM A8000 Devices
The CPCI85 firmware of SICAM A8000 CP-8031 and CP-8050 is affected by unauthenticated command injection vulnerability. This could allow an attacker to perfom remote code execution. Siemens has released updates for the affected products and recommends to updat…
-
Critical max 8.8ICSA-23-096-06 5 CVEs
mySCADA myPRO
Successful exploitation of this vulnerability could allow an authenticated user to inject arbitrary operating system commands.
-
High max 7.8ICSA-23-096-03 3 CVEs
JTEKT ELECTRONICS Kostac PLC Programming Software
Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code.
-
High max 7.8ICSA-23-096-02 7 CVEs
JTEKT ELECTRONICS Screen Creator Advance 2
Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code.
-
CriticalICSA-23-096-01 1 CVE
Industrial Control Links ScadaFlex II SCADA Controllers
Successful exploitation of this vulnerability could allow an authenticated attacker to overwrite, delete, or create files.
-
High max 8.8ICSA-23-096-04 3 CVEs
Korenix Jetwave
Successful exploitation of these vulnerabilities could allow an attacker to gain full access to the underlying operating system of the device or cause a denial-of-service condition.
-
Critical max 9.9ICSA-23-096-05 5 CVEs
Hitachi Energy MicroSCADA System Data Manager SDM600
Successful exploitation of these vulnerabilities could allow an attacker to take remote control of the product.
-
Critical max 9.3ICSA-23-094-01 5 CVEs
Nexx Smart Home Device
Successful exploitation of these vulnerabilities could allow an attacker to receive sensitive information, execute application programmable interface (API) requests, or hijack devices.
-
Medium max 5.5ICSA-23-080-05 7 CVEs
VISAM VBASE Automation Base
Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information from the target device.
-
High max 6.5ICSA-23-082-03 5 CVEs
SAUTER EY-modulo 5 Building Automation Stations
Successful exploitation of these vulnerabilities could lead to privilege escalation, unauthorized execution of actions, a denial-of-service condition, or retrieval of sensitive information.
-
High max 8.8ICSA-23-082-04 8 CVEs
Schneider Electric IGSS
Successful exploitation of these vulnerabilities could result in a denial-of-service condition, as well as the loss, addition, or modification of dashboards or report files in the IGSS Report folder. Successful exploitation of these vulnerabilities could also…
-
Critical max 6.9ICSA-23-075-06 3 CVEs
Honeywell OneWireless Wireless Device Manager
Successful exploitation of these vulnerabilities could disclose sensitive information, allow privilege escalation, or allow remote code execution.
-
High max 8.8ICSA-23-068-03 1 CVE
ABB Ability Symphony Plus
Successful exploitation of this vulnerability could allow an unauthorized client to connect to the S+ Operations servers (human machine interface (HMI) network), to act as a legitimate S+ Operations client.
-
Critical max 9.8
AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere
This updated advisory is a follow-up to the original advisory titled ICSA-22-342-02 AVEVA InTouch Access Anywhere, published December 8, 2022 on the ICS webpage at cisa.gov/topics/industrial-control-systems.
first Dec 8, 2022 -
High max 7.8ICSA-23-082-02 1 CVE
CP Plus KVMS Pro
Successful exploitation of this vulnerability could allow an attacker to retrieve sensitive credentials and control the entire CCTV system.
-
Critical max 9.8ICSA-23-080-06 3 CVEs
Rockwell Automation ThinManager
Successful exploitation of these vulnerabilities could allow an attacker to potentially perform remote code execution on the target or crash the software.
-
Medium max 6.3ICSA-23-082-05 2 CVEs
ABB Pulsar Plus Controller
Successful exploitation of these vulnerabilities could allow an attacker to take control of the product or execute arbitrary code.
-
High max 7.9ICSA-23-082-01 1 CVE
RoboDK
Successful exploitation of this vulnerability could allow an attacker to escalate privileges, which could allow attackers to write files to the RoboDK directory and achieve code execution.
-
Medium max 5.3ICSA-23-075-07 1 CVE
Rockwell Automation Modbus TCP AOI Server
Successful exploitation of this vulnerability could allow an unauthorized user to read the connected device’s Modbus TCP Server AOI information.
-
Critical max 9.1ICSA-23-073-01 1 CVE
Omron CJ1M PLC
Successful exploitation of these vulnerabilities could allow an attacker to bypass user memory protections by writing to a specific memory address. An attacker can also overwrite passwords and lock engineers from reading their own memory regions.
-
High max 7.8ICSA-23-073-02 3 CVEs
Autodesk FBX SDK
Successful exploitation of these vulnerabilities could lead to code execution or a denial-of-service condition. Products using Autodesk FBX SDK software are affected by these vulnerabilities.
-
High max 7.8ICSA-23-073-03 1 CVE
GE iFIX
Successful exploitation of this vulnerability could allow for privilege escalation and full control of the system.
-
Critical max 9.8ICSA-23-068-01 13 CVEs
Akuvox E11
Successful exploitation of these vulnerabilities could cause loss of sensitive information, unauthorized access, and grant full administrative control to an attacker.
-
Critical max 9.8ICSA-23-073-04 1 CVE
AVEVA Plant SCADA and AVEVA Telemetry Server
Successful exploitation of this vulnerability could allow an unauthenticated user to read data, cause a denial of service, and tamper with alarm states.
-
Medium max 6.1ICSA-23-068-02 1 CVE
B&R Systems Diagnostics Manager
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code to exfiltrate data and perform any action within the user's browser session.
-
Low max 2.2ICSA-23-068-04 1 CVE
Step Tools Third-Party
Successful exploitation of this vulnerability could allow an attacker to deny application usage when reading a specially constructed file.
-
High max 7.8ICSA-23-080-01 1 CVE
Keysight N6845A Geolocation Server
Successful exploitation of this vulnerability could allow an attacker to escalate privileges in the affected device’s default configuration, resulting in remote code execution or deleting system files and folders.
-
Critical max 9.8ICSA-23-080-02 13 CVEs
Delta Electronics InfraSuite Device Master
Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to obtain access to files and credentials, escalate privileges, and remotely execute arbitrary code.
-
High
Siemens Linux-based Products (Update J)
A vulnerability made public under the name SAD DNS affects Domain Name System resolvers due to a vulnerability in the Linux kernel when handling ICMP packets. The Siemens products which are affected are listed below. For more information please see https://ww…
first May 11, 2021 -
Critical max 7.5
Siemens Industrial Products LLDP (Update D)
There are multiple vulnerabilities in an underlying Link Layer Discovery Protocol (LLDP) third party library. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Jul 13, 2021 -
Critical max 10.0
Siemens SRCS VPN Feature in SIMATIC CP Devices
The below referenced devices contain multiple vulnerabilities that could be exploited when the SINEMA Remote Connect Server (SRCS) VPN feature is used. The feature is not activated by default. The most severe could allow an attacker to execute arbitrary code …
first Jul 12, 2022 -
High max 8.2
Siemens Automation License Manager
Siemens Automation License Manager contains two vulnerabilities which, when combined, could allow an attacker to modify and rename license files, extract licenses and overwrite arbitrary files on the target system potentially leading to privilege escalation a…
first Jan 10, 2023 -
High max 7.8
Siemens Solid Edge
Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as X_B, DWG, DXF, STL, STP, SLDPRT and PAR format. If a user is tricked to open a malicious…
first Feb 14, 2023 -
Critical max 9.8
Siemens SCALANCE, RUGGEDCOM Third-Party
Multiple third-party component vulnerabilities were reported for the Busybox applet, the Linux Kernel, OpenSSL, OpenVPN and various other components used by the RUGGEDCOM and SCALANCE products. The vulnerabilities range from improper neutralization of special…
-
High max 8.8ICSA-23-075-02 2 CVEs
Siemens RUGGEDCOM CROSSBOW V5.3
RUGGEDCOM CROSSBOW before V5.3 contains two vulnerabilities that could allow authenticated remote attackers to access data they are not authorized for, or execute arbitrary database queries via an SQL injection attack. Siemens has released an update for RUGGE…
-
Medium max 6.6ICSA-23-075-03 2 CVEs
Siemens RUGGEDCOM CROSSBOW V5.2
RUGGEDCOM CROSSBOW V5.2 fixes two vulnerabilities that could allow authenticated remote attackers to perform unauthorized actions (CVE-2023-27309) or escalate privileges (CVE-2023-27310). Siemens has released an update for RUGGEDCOM CROSSBOW and recommends to…
-
High max 7.5ICSA-23-080-07 17 CVEs
Siemens SCALANCE Third-Party
Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released…
-
High max 7.5ICSA-23-059-02 4 CVEs
Hitachi Energy Gateway Station
Successful exploitation of these vulnerabilities could cause part of GWS fail to start, allow unauthorized actors to run scripts, and/or cause a denial-of-service.