217 results · Clear filters · Feed
-
Critical max 9.2
SSA-678870: Node2Shell/Broccoli2Shell Vulnerabilities in Siemens Software Products
On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write t…
-
Critical max 9.2
SSA-242944: Node2Shell Vulnerability in Siemens Industrial Products
On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write t…
-
Critical max 10.0
SSA-834709: Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 with Industrial OS
SIMATIC IoT2050 devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the…
first Aug 11, 2026 -
Critical max 10.0
SSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for produ…
first Oct 13, 2026 -
Critical max 8.5
SSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto …
first Jul 14, 2026 -
Critical max 9.2
SSA-443410: Node2Shell Vulnerability in Industrial Edge Management Applications
Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the affected Brotli library is incl…
first Oct 30, 2026 -
Critical max 9.2
SSA-045512: Node2Shell Vulnerability in Siemens Products
On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write t…
first Oct 30, 2026 -
Critical max 9.2
SSA-166980: PHP2Shell Vulnerabilities in Siemens Products
On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory c…
first Oct 26, 2026 -
Critical max 9.2
SSA-566512: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement t…
first Oct 23, 2026 -
Critical max 9.2
SSA-898633: Node2Shell Vulnerability in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on a vulnerability in PAN-OS related to the Node2Shell vulnerability. This advisory lists the related Siemens Industrial products affected by this vulnerability. Customers are advised to consult and implement t…
-
Critical max 8.7
SSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS before V11.2.10-h7 on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to …
first May 12, 2026 -
Critical max 9.1
SSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.
first May 13, 2025 -
Critical max 8.6
SSA-858251: Authentication Bypass Vulnerabilities in OPC UA
The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server. Siemens has released new versions for several affected products and recommends to update to the latest v…
first Mar 11, 2025 -
Critical max 9.1SSA-832641 2 CVEs
SSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices
Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to …
-
Critical max 9.8
SSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.0. Siemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version. SIMATIC…
first Jun 13, 2023 -
Critical max 9.0
SSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products
This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RAD…
first May 13, 2025 -
Critical max 10.0
SSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
-
Critical max 9.8SSA-765416 5 CVEs
SSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a …
-
Critical max 9.6SSA-591731 8 CVEs
SSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server
SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is prep…
-
Critical max 9.8
SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally ide…
first Dec 12, 2023 -
Critical max 9.1SSA-377139 2 CVEs
SSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that cou…
-
Critical max 10.0
SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version. Siemens…
first Apr 9, 2024 -
Critical max 10.0
SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens has released new versions for several affected products and reco…
first Jun 10, 2025 -
Critical max 10.0
SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens has released new versions for several affected products and reco…
first Jul 14, 2026 -
Critical max 9.1SSA-503852 1 CVE
SSA-503852: Authentication Bypass Vulnerability in Industrial Edge Management
Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versi…
-
Critical max 9.0SSA-254516 1 CVE
SSA-254516: Arbitrary File Upload in OIS Web Module
A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . This vulnerability allows an attacker to upload arbitrary files, which can lead …
-
Critical max 9.8SSA-142885 14 CVEs
SSA-142885: Multiple Vulnerabilities in Reyrolle 7SR5 Before V2.70
Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 and recommends to update to the latest version.
-
Critical max 9.1SSA-825228 1 CVE
SSA-825228: Potential Remote Code Execution in Siveillance Video Management Servers
Siveillance Video Management Servers contains a vulnerability that could allow a Remote Code Execution attack. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
Critical max 8.8SSA-734552 1 CVE
SSA-734552: Buffer Overflow Vulnerability in OpenSSL Affecting Desigo CC
OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends t…
-
Critical max 9.1
SSA-688146: Multiple Cross-Site Scripting Vulnerabilities in SIMATIC S7 PLCs Web Server
SIMATIC S7 PLCs contain multiple vulnerabilities in the web server that could allow an attacker to perform cross-site scripting attacks. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens i…
first May 12, 2026 -
Critical max 9.8SSA-585531 12 CVEs
SSA-585531: Multiple Vulnerabilities in SIDIS Secured SmartPlug before V7.26.0310
SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the …
-
Critical max 9.8
SSA-470355: Zlib and Foxit Vulnerabilities in CADRA
CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fix…
-
Critical max 10.0SSA-096828 1 CVE
SSA-096828: Token Invalidation Vulnerability in Opcenter X Before V2604
Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X and recommends to update to the latest version.
-
Critical max 9.0
SSA-723487: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products
This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SCALANCE, RUGGEDCOM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the…
first Jul 9, 2024 -
Critical max 9.8
SSA-722410: Multiple Vulnerabilities in User Management Component (UMC)
Siemens' User Management Component (UMC) is affected by multiple vulnerabilities that could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition. Siemens has released a new version for User Management Co…
first Sep 9, 2025 -
Critical max 9.8SSA-253495 77 CVEs
SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0
SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.
-
Critical max 9.4
SSA-975644: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.
first Mar 10, 2026 -
Critical max 9.1SSA-783943 1 CVE
SSA-783943: HTTP Request Smuggling Vulnerability in SENTRON 7KT PAC1261 Data Manager Before V2.1.0
The web server in SENTRON 7KT PAC1261 Data Manager Before V2.1.0 contains a request smuggling vulnerability in the Go Project's net/http package that could allow an attacker to retrieve authorization tokens that can be used to gain administrative control over…
-
Critical max 9.1SSA-577017 35 CVEs
SSA-577017: Multiple Vulnerabilities in Ruggedcom Rox Before 2.17.1
Ruggedcom Rox before v2.17.1 contain multiple third-party vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
Critical max 9.6
SSA-452276: Eval Injection Vulnerability in SIMATIC S7-1500
SIMATIC S7-1500 devices contain a vulnerability that could allow an attacker to inject code by tricking a legitimate user into importing a specially crafted trace file in the web interface. Siemens has released new versions for several affected products and r…
first Mar 10, 2026