217 results · Clear filters · Feed
-
Critical max 9.1SSA-357982 1 CVE
SSA-357982: Path Traversal Vulnerability in ROS# Before 2.2.2
ROS# contains a ROS service file_server, that before version 2.2.2 contains a path traversal vulnerability which could allow an attacker to access, i.e. read and write, arbitrary files, which are accessible with the user rights of the user that runs the servi…
-
Critical max 9.1SSA-081142 1 CVE
SSA-081142: Arbitrary Code Execution Vulnerability in Ruggedcom Rox Before 2.17.1
Ruggedcom Rox contains an input validation vulnerability in the Scheduler functionality that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions …
-
Critical max 9.8
SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.0
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
-
Critical max 10.0
SSA-001536: Authorization Bypass Vulnerability in Siemens Industrial Edge Devices
Siemens Industrial Edge Devices contain an authorization bypass vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for the affected products …
first Jan 13, 2026 -
Critical max 9.1
SSA-710008: Multiple Web Vulnerabilities in SCALANCE Products
SCALANCE devices contain multiple vulnerabilities in MSPS based product lines that could allow authenticated remote attackers to execute custom code or create a XSS situation, as well as unauthenticated remote attackers to create a denial of service condition…
first Aug 9, 2022 -
Critical max 9.1SSA-019200 15 CVEs
SSA-019200: Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11n Devices Before V6.6.0
SCALANCE W-700 IEEE 802.11n family before V6.6.0 are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11n family and recommends to update to the latest version.
-
Critical max 9.6
SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.
first Feb 11, 2025 -
Critical max 9.9
SSA-430425: Multiple Vulnerabilities in SINEC Security Monitor before V4.9.0
SINEC Security Monitor before V4.9.0 contains multiple vulnerabilities. Siemens has released a new version for SINEC Security Monitor and recommends to update to the latest version.
first Oct 8, 2024 -
Critical max 10.0
SSA-212953: Multiple Vulnerabilities in COMOS
COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for the affected products and …
first Dec 9, 2025 -
Critical max 10.0
SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1
SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Aug 12, 2025 -
Critical max 9.8
SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2
SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Aug 12, 2025 -
Critical max 10.0
SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3
SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Jan 28, 2026 -
Critical max 9.8
SSA-928984: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)
Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution. Siemens has released new versions for several affected products and recommends to …
first Dec 16, 2024 -
Critical max 9.8
SSA-832273: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.3 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing furthe…
first Mar 12, 2024 -
Critical max 9.8
SSA-366067: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing furthe…
first Mar 12, 2024 -
Critical max 9.0
SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.4-h1
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products whe…
first Jul 9, 2024 -
Critical max 10.0SSA-014678 1 CVE
SSA-014678: Authorization Bypass Vulnerability in Industrial Edge Device Kit
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains an authorization bypass vulnerability that could…
-
Critical max 9.9SSA-471761 15 CVEs
SSA-471761: Multiple Vulnerabilities in SICAM T Before V3.0
SICAM T before V3.0 contain multiple vulnerabilities. These include critical issues such as improper parameter and input validation, various Cross-Site Scripting (XSS) vulnerabilities , and a Cross-Site Request Forgery (CSRF) vulnerability . Additional weakne…
-
Critical max 9.8
SSA-202008: Multiple Vulnerabilities in Ruggedcom Rox Before V2.17.0
Ruggedcom ROX familly contain multiple vulnerabilities before V2.17.0 Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
Critical max 9.4SSA-682326 2 CVEs
SSA-682326: Multiple Vulnerabilities in COMOS before V10.4.5
COMOS is affected by two vulnerabilities that could allow an attacker to execute arbitrary code or lead to data infiltration. Siemens has released a new version for COMOS and recommends to update to the latest version.
-
Critical max 9.8
SSA-631336: Multiple Web Server Vulnerabilities in SICAM GridEdge Before V2.6.6
Multiple vulnerabilities were identified in the web server of the SICAM GridEdge application which includes missing authentication for critical API functions, absent cross-origin resource sharing restrictions and access to credentials. Siemens has released a …
first Jun 14, 2022 -
Critical max 9.9
SSA-301229: Client-Side Enforcement of Server-Side Security Vulnerabilities in RUGGEDCOM ROX II
The web interface of RUGGEDCOM ROX II devices contain multiple Client-Side Enforcement of Server-Side Security vulnerabilities that could allow an attacker with a legitimate, highly privileged account on the web interface to get privileged code execution in t…
first May 13, 2025 -
Critical max 9.8SSA-486936 1 CVE
SSA-486936: Authentication Vulnerability in SIMATIC ET 200SP Communication Processors
SIMATIC ET 200SP communication processors (CP 1542SP-1, CP 1542SP-1 IRC and CP 1543SP-1, incl. SIPLUS variants) contain an authentication vulnerability that could allow an unauthenticated remote attacker to access the configuration data. Siemens has released …
-
Critical
SSA-279823: Cross-Site Scripting Vulnerability in SIMATIC S7-1200 CPU V2/V3 Before V3.0.2
The web server on SIMATIC S7-1200 CPU V2/V3 Before V3.0.2 contains a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary web script or HTML via a crafted URI. Siemens has released a new version for SIMATIC S7-1200 CP…
first Oct 8, 2012 -
Critical max 9.8SSA-062309 1 CVE
SSA-062309: Information Disclosure Vulnerability in TeleControl Server Basic V3.1
TeleControl Server Basic V3.1 contains an information disclosure vulnerability that could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service. Siemens has rel…
-
Critical max 9.8
SSA-039007: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)
Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution. Siemens has released new versions for several affected products and recommends to …
first Sep 10, 2024 -
Critical max 9.1SSA-534283 1 CVE
SSA-534283: Insecure File Share Vulnerability in SIMATIC Virtualization as a Service (SIVaaS)
SIMATIC Virtualization as a Service (SIVaaS) is affected by a vulnerability which exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization. Siemens recommends to contact te…
-
Critical max 9.8
SSA-028723: Multiple OpenSSL Vulnerabilities in BFCClient Before V2.17
Siemens BFCClient contains multiple vulnerabilities in the integrated OpenSSL component that could allow an attacker to read memory contents, to change the application behaviour or to create a denial of service condition. Siemens has released a new version fo…
first Aug 12, 2025 -
Critical max 9.1
SSA-908185: Mirror Port Isolation Vulnerability in RUGGEDCOM ROS Devices
A vulnerability was identified in RUGGEDCOM ROS devices with mirror port enabled, that could allow an attacker to inject information into the network via the mirror port. Siemens has released new versions for several affected products and recommends to update…
first Aug 8, 2023 -
Critical max 9.1SSA-493787 1 CVE
SSA-493787: Arbitrary Code Execution Vulnerability in SIMATIC RTLS Locating Manager Before V3.2
SIMATIC RTLS Locating Manager Before V3.2 contains an improper input validation vulnerability that could allow an authenticated remote attacker to execute arbitrary code with high privileges. Siemens has released a new version for SIMATIC RTLS Locating Manage…
-
Critical max 10.0
SSA-446307: Authentication Bypass Vulnerability in BMC (CVE-2024-54085) affects SIMATIC IPC RS-828A
SIMATIC IPC RS-828A is affected by an authentication bypass vulnerability in the Redfish interface of its Baseboard Management Controller (BMC) that could allow an attacker to gain unauthorized access and compromise confidentiality, integrity and availability…
first May 13, 2025 -
Critical max 9.6
SSA-256353: Third-Party Component Vulnerabilities in RUGGEDCOM ROS
Multiple vulnerabilities affect various third-party components of the RUGGEDCOM Operating System (ROS). If exploited, an attacker could cause a denial-of-service, act as a man-in-the-middle or retrieval of sensitive information or gain privileged functions. S…
first Mar 8, 2022 -
Critical
SSA-763427: Authentication Bypass Vulnerability in SIMATIC CP and TIM Devices
SIMATIC CP and TIM devices contain an authentication bypass vulnerability that could allow unauthenticated users to perform administrative operations under certain conditions. Siemens has released new versions for several affected products and recommends to u…
first Nov 27, 2015 -
Critical max 9.8
SSA-634640: Weak Authentication Vulnerability in Siemens Industrial Edge Devices
Siemens Industrial Edge Devices contain a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for the affected products an…
first Apr 8, 2025 -
Critical max 9.8SSA-078892 4 CVEs
SSA-078892: Multiple Vulnerabilities in SINEC NMS Before V4.0
Siemens SINEC NMS before V4.0 is affected by multiple vulnerabilities which could allow an attacker to elevate privilege and exceute arbitrary code. Siemens has released a new version for SINEC NMS and recommends to update to the latest version. Siemens is pr…
-
Critical max 9.9
SSA-345750: Default Credentials in Energy Services Using Elspec G5DFR
Energy Services from Siemens (previously known as Managed Applications and Services), sell solutions using Elspec G5 Digital Fault Recorder which contains default credentials with admin privileges. A client configuration with remote access could allow an atta…
first Jun 10, 2025 -
Critical
SSA-497656: Multiple NTP Vulnerabilities in TIM 4R-IE Devices
TIM 4R-IE devices contain multiple vulnerabilities in the integrated NTP component as listed below. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
first Apr 13, 2021 -
Critical max 8.7
SSA-354569: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where f…
first Nov 22, 2024 -
Critical max 9.8
SSA-819629: Weak Authentication Vulnerability in Industrial Edge Device Kit
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains a weak authentication vulnerability that could f…
first Apr 8, 2025 -
Critical max 9.8
SSA-455250: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.2-h3
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version of Palo Alto Networks Virtual NGFW for RUGGEDCOM A…
first Apr 9, 2024