456 results · Clear filters · Feed
-
High max 8.5SSA-979641 1 CVE
SSA-979641: Implicit Execution of Active Content when Opening Files Vulnerability in SIMATIC WinCC Graphics Designer
Graphics Designer of SIMATIC WinCC before V8.2 contains an implicit active content execution vulnerability upon opening files, which could allow an attacker to cause arbitrary code execution on the device. Siemens is preparing fixes and recommends specific mi…
-
High max 7.5SSA-970803 1 CVE
SSA-970803: Insecure User Authentication in SIMATIC SCADA and PCS 7 systems
The products listed below contain an authentication bypass vulnerability that could allow an on-path attacker to take over the session of a legitimate user and execute arbitrary code with the privileges of the victim user. Siemens is preparing fixes and recom…
-
High max 7.3SSA-724261 1 CVE
SSA-724261: Command Injection Vulnerability in meta-iot2050
meta-iot2050 (https://github.com/siemens/meta-iot2050) from V01.03.01 contains a Command Injection vulnerability in the firmware update tool that could allow an attacker which is able to manipulate a configuration file to have arbitrary commands run as root. …
-
High max 8.8SSA-710379 2 CVEs
SSA-710379: Multiple Vulnerabilities in Mendix Studio Pro's MCP Server
Mendix Studio Pro contains multiple vulnerabilities in the MCP Server, that could allow an attacker with network access to interact with the server remotely or trick a user's browser into sending unauthorized requests, potentially leading to unauthorized data…
-
High max 8.6SSA-435267 1 CVE
SSA-435267: Code Injection Vulnerability in ROS# Before 2.3.1
ROS# before version 2.3.1 contains a code injection vulnerability that could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program. Siemens has released a new version for ROS# …
-
High max 7.8SSA-105852 1 CVE
SSA-105852: Out of Bounds Read Vulnerability in Simcenter Femap
Simcenter Femap is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released a new version for …
-
High max 7.8
SSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20
Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected pr…
first Dec 10, 2024 -
High max 8.2
SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms
Affected products do not properly restrict access permissions to a local Windows Named Pipe and do not properly sanitize user-controllable input sent to that Named Pipe. This could allow a local authenticated attacker to cause a type confusion and execute arb…
first Aug 12, 2025 -
High max 7.8
SSA-493396: Deserialization Vulnerability in Siemens Engineering Platforms
Affected products do not properly sanitize user-controllable input when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several aff…
first Aug 12, 2025 -
High max 8.8
SSA-434797: Buffer Overflow Vulnerability in OpenSSL affecting Siemens Products
OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends t…
first Jun 9, 2026 -
High max 7.5
SSA-390352: Multiple Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API
.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Clien…
first Oct 13, 2026 -
High max 7.8
SSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery
The installers used to install several Siemens products are affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected installer component. This vulne…
first Aug 12, 2025 -
High max 7.3
SSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigati…
first Aug 11, 2026 -
High max 7.5
SSA-392349: Denial of Service Vulnerability in Industrial Devices
Multiple industrial devices contain a vulnerability that could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing furt…
first May 12, 2026 -
High max 8.7
SSA-887643: Account Hijacking Vulnerability in Mendix SAML module
Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.
first Sep 3, 2026 -
High max 8.3SSA-968435 2 CVEs
SSA-968435: Multiple Vulnerabilities in Industrial Edge App Publisher
The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the manageme…
-
High max 7.5SSA-911336 5 CVEs
SSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update info…
-
High max 8.1
SSA-563922: Local Privilege Escalation Vulnerability in SIMOTION Tools
Several tools for the SIMOTION system are affected by a local privilege escalation vulnerability. This could allow an attacker to execute arbitrary code with SYSTEM privileges when a legitimate user installs an application that uses the affected setup compone…
first Sep 9, 2025 -
High max 8.8SSA-550198 1 CVE
SSA-550198: Authenticated Remote Code Execution in WinCC
Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several a…
-
High max 8.3
SSA-545643: Multiple Vulnerabilities in KACO Blueplanet Inverters
KACO blueplanet Inverters contain multiple vulnerabilities that could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access. KACO new energy GmbH has released new versions for several affected p…
first May 12, 2026 -
High max 8.8SSA-508506 11 CVEs
SSA-508506: Multiple Vulnerabilities in RUGGEDCOM CROSSBOW
RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as mod…
-
High max 7.3
SSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20
Affected products contain a local arbitrary code execution vulnerability that could allow an attacker to perform actions against the operation system of that environment. Siemens has released new versions for several affected products and recommends to update…
first Dec 10, 2024 -
High max 8.2SSA-333035 5 CVEs
SSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products
The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends…
-
High max 7.6
SSA-267056: Multiple Vulnerabilities in LOGO! 8 BM Devices
LOGO! 8 BM (incl. SIPLUS variants) contains multiple vulnerabilities. These could allow an attacker to execute code remotely, put the device into a denial of service state, or change the behavior of the device. Siemens has released new versions for the affect…
first Nov 11, 2025 -
High max 7.7SSA-159454 1 CVE
SSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs
The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new version…
-
High max 7.0SSA-148322 1 CVE
SSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL
PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to…
-
High max 8.6SSA-517424 1 CVE
SSA-517424: Path Traversal Vulnerability in SIMOVE Fleetmanager and SIPLANT
SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside of intended scope. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 8.2
SSA-331739: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting Siemens Products
WIBU Systems published information about a privilege escalation vulnerability under a certain circumstances and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products. Siemens has relea…
first Aug 12, 2025 -
High max 8.2SSA-330084 1 CVE
SSA-330084: Client Code Execution Vulnerability in Desigo CC Product Family
A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics co…
-
High max 7.8
SSA-328642: "Copy Fail" Vulnerability in Multiple Industrial Products
Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific count…
-
High max 7.8
SSA-327438: Multiple Vulnerabilities in SCALANCE LPE9403
SCALANCE LPE9403 is affected by multiple vulnerabilities which lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SCALANCE LPE9403 and recommends to update to the latest version. Siemens recommends spec…
first May 13, 2025 -
High max 7.2
SSA-229470: Multiple Vulnerabilities in SICAM 8 Products Before V26.20
Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICOR…
first Jul 9, 2026 -
High max 8.2
SSA-216014: Vulnerabilities in EFI variable of SIMATIC IPCs, SIMATIC Tablet PCs, and SIMATIC Field PGs
Multiple vulnerabilities has been identified in Siemens SIMATIC IPCs, SIMATIC Tablet PCs, and SIMATIC Field PGs that can allow an authenticated attacker to alter the secure boot and password configurations. Siemens has released new versions of BIOS for severa…
first Mar 11, 2025 -
High max 7.6SSA-682041 1 CVE
SSA-682041: Cross Site Scripting Vulnerability in Element Maps
The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hover…
-
High max 7.8
SSA-069220: Stack Overflow Vulnerability in Simcenter Nastran Before V2606
Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a malicious string, an attack…
first Aug 11, 2026 -
High max 8.9
SSA-827968: Vulnerability in Nozomi Guardian/CMC Before V26.2.0 on RUGGEDCOM APE1808 Devices
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to upda…
first Jan 13, 2026 -
High max 7.9
SSA-686975: IPU 2022.3 Vulnerabilities in Siemens Industrial Products using Intel CPUs
Intel has published information on vulnerabilities in Intel products in November 2022. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update ("2022.3 IPU – B…
first Feb 14, 2023 -
High max 7.8SSA-621657 7 CVEs
SSA-621657: File Parsing Vulnerabilities in Solid Edge Before Version SE2026 Update 7
Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR, PSM or DFT format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has …
-
High max 7.8SSA-584312 2 CVEs
SSA-584312: File Parsing Vulnerabilities in Simcenter Femap Before V2606 MP1
Simcenter Femap contains two file parsing vulnerabilities that could be triggered when the application reads files in BMP file format. If a user is tricked to open a malicious file with the affected application, this could lead the application to crash or pot…
-
High max 8.2
SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products
Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities. Siemens has released new versions for the affected products and recommends to update to…
first Feb 22, 2022