456 results · Clear filters · Feed
-
High max 7.8SSA-138516 1 CVE
SSA-138516: Out of Bounds Read Vulnerability in Parasolid X_T File Parsing
Parasolid is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released new versions for the aff…
-
High max 7.5SSA-077553 2 CVEs
SSA-077553: Multiple Vulnerabilities in Siemens License Server (SLS)
Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the …
-
High max 7.4SSA-828211 1 CVE
SSA-828211: Denial of Service Vulnerability in SIMATIC S7-PLCSIM Advanced
SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
-
High max 7.8
SSA-870926: Datakit and Parasolid Vulnerabilities in Simcenter Femap
Simcenter Femap is affected by file parsing vulnerabilities in Datakit library and Parasolid Translator Component that could be triggered when the application reads files in IPT or IGS format. If a user is tricked to open a malicious file with the affected ap…
first May 12, 2026 -
High max 8.8SSA-860189 4 CVEs
SSA-860189: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 6
SINEC INS before V1.0 SP2 Update 6 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC INS and recommends to update to the latest version.
-
High max 7.5
SSA-674753: Denial-of-Service Vulnerability in ET 200 Devices
Siemens ET 200 devices contain a denial-of-service vulnerability that could be triggered by sending a valid S7 protocol Disconnect Request (COTP DR TPDU), causing the device to become unresponsive and require a power cycle to recover. Siemens has released new…
first Jan 13, 2026 -
High max 7.1SSA-063511 1 CVE
SSA-063511: Insufficient protection of key material in WinCC Certificate Manager
WinCC Certificate Manager insufficiently protects key material that could allow an attacker to extract sensitive information. Siemens has released a new version for SIMATIC WinCC Unified PC Runtime V21 and recommends to update to the latest version. Siemens r…
-
High max 7.8
SSA-921111: Two File Parsing Vulnerabilities in Solid Edge Before Version SE226 Update 5
Solid Edge SE2026 before Update 5 is affected by two file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR format. This could allow an attacker to crash the application or execute arbitrary code. Siemen…
first May 12, 2026 -
High max 4.8SSA-876049 1 CVE
SSA-876049: Prototype Pollution Vulnerability in Axios Library Affecting Siemens gWAP Before V3.1.1
Siemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a third-party component, namely the Axios HTTP client library. The vulnerability stems from a specific "Gadget" attack chain that allows p…
-
High max 7.5SSA-827383 3 CVEs
SSA-827383: Multiple Vulnerabilities in Teamcenter
Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 7.7SSA-387223 1 CVE
SSA-387223: Unauthenticated Control Panel Escape Vulnerability on SIMATIC HMI Unified Comfort before V21.0
SIMATIC HMI Unified Comfort Panels before V21.0 are affected by a vulnerability that allows an unauthenticated attacker to access the web browser via the help link. This vulnerability allows an attacker to access the web browser through the Control Panel if i…
-
High max 9.3SSA-085541 1 CVE
SSA-085541: Missing Authentication in Critical Function in ActiveMQ Artemis (CVE-2026-27446) in Opcenter RDnL
Opcenter RDnL is affected by missing authentication in critical function in ‘ActiveMQ Artemis’. An unauthenticated attacker within the adjacent network could use the Core protocol to force a target broker to establish an outbound Core federation connection to…
-
High max 7.5SSA-078743 1 CVE
SSA-078743: Remote Code Execution Vulnerability in Ruggedcom Rox Before V2.17.1
Ruggedcom Rox contains an input validation vulnerability in the feature key installation process that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new …
-
High max 7.3SSA-801704 1 CVE
SSA-801704: Authentication Bypass Vulnerability in SINEC NMS
Siemens SINEC NMS when used with User Management Component (UMC) contains an authentication bypass vulnerability due to insufficient validation of user identity. This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorize…
-
High max 8.8SSA-741509 1 CVE
SSA-741509: Privilege Escalation Vulnerability in RUGGEDCOM CROSSBOW Secure Access Manager Primary Before V5.8
RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) contains a vulnerability that could allow an attacker to escalate their own privileges. Siemens has released a new version for RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) and recommends to …
-
High max 7.5
SSA-726834: Denial of Service Vulnerability in the RADIUS Client of SIPROTEC 5 Devices
The RADIUS client implementation of the VxWorks platform in SIPROTEC 5 devices contains a denial of service vulnerability that could be triggered when a specially crafted packet is sent by a RADIUS server. Siemens has released new versions for the affected pr…
first Mar 14, 2023 -
High max 7.5
SSA-712929: Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Products
A vulnerability in the openSSL component (CVE-2022-0778, [0]) could allow an attacker to create a denial of service condition by providing specially crafted elliptic curve certificates to products that use a vulnerable version of openSSL. Siemens has released…
first Jun 14, 2022 -
High max 7.1SSA-609469 1 CVE
SSA-609469: Authorization Bypass Vulnerability in Industrial Edge Management
Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens…
-
High max 8.8SSA-605717 1 CVE
SSA-605717: Authorization Bypass Vulnerability in SINEC NMS Before V4.0 SP3
SINEC NMS before V4.0 SP3 contains an Authorization Bypass vulnerability that could allow an attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account. Siemens has released a new version for SINEC NMS …
-
High max 7.5
SSA-599968: Denial of Service Vulnerability in Profinet Devices
A vulnerability in affected devices could allow an attacker to perform a denial ofservice attack if a large amount of Profinet Discovery and Configuration Protocol (DCP) reset packets is sent to the affected devices. Siemens has released new versions for seve…
first Jul 13, 2021 -
High max 8.8
SSA-552702: Privilege Escalation Vulnerability in the Web Interface of SCALANCE and RUGGEDCOM Products
The products listed below do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Siemens has released updates for several affected products and recommends to update to t…
first Oct 11, 2022 -
High max 7.5
SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitra…
first Dec 13, 2022 -
High max 7.8
SSA-311973: Multiple Local Privilege Escalation Vulnerabilities in SINEC NMS and User Management Component (UMC)
Multiple Siemens products are affected by two local privilege escalation vulnerabilities which could allow an low privileged attacker to load malicious DLLs, potentially leading to arbitrary code execution with elevated privileges. Siemens has released new ve…
first Feb 10, 2026 -
High max 7.4
SSA-244969: OpenSSL Vulnerability in Industrial Products
OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1l and 1.0.2 < 1.0.2za that allows an attacker to cause a denial of service (DoS) or to disclose private memory content. Siemens has released updates for sever…
first Feb 8, 2022 -
High max 7.2SSA-225816 1 CVE
SSA-225816: Memory Corruption Vulnerability in RUGGEDCOM CROSSBOW Station Access Controller Before V5.8
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains a vulnerability that could allow an attacker to achieve arbitrary code execution and to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access …
-
High max 7.5SSA-246443 2 CVEs
SSA-246443: Multiple Vulnerabilities in SICAM 8 Products
Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - RTUM85 for CP-8010/CP-8012 - SICAM EGS Device firmware -…
-
High max 7.4SSA-903736 6 CVEs
SSA-903736: Multiple vulnerabilities in SICAM SIAPP SDK before V2.1.7
The SICAM SIAPP SDK contains multiple vulnerabilities that could allow an attacker to disrupt the customer-developed SIAPP or its simulation environment. Potential impacts include denial of service within the SIAPP, corruption of SIAPP data, or exploit the si…
-
High max 7.4
SSA-868571: Missing Server Certificate Validation in IAM Client
Multiple Siemens products are affected by improper certificate validation in IAM Client. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for the affected products and recommends to up…
first Dec 9, 2025 -
High max 8.1
SSA-710408: Missing Server Certificate Validation in Siemens Advanced Licensing (SALT) Toolkit
Multiple Siemens products are affected by improper certificate validation in Siemens Advanced Licensing (SALT) Toolkit. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for several aff…
first Dec 9, 2025 -
High max 7.8
SSA-535115: Data Validation Vulnerability in NX Before V2512
Siemens NX is affected by missing data validation vulnerability that could allow an attacker with local access on a compromised system to interfere with internal data during the PDF export process that could potentially lead to arbitrary code execution. Sieme…
first Feb 10, 2026 -
High max 8.4
SSA-513708: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where f…
first Jun 10, 2025 -
High max 9.8SSA-485750 23 CVEs
SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
-
High max 8.2
SSA-201595: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager
Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems…
first Aug 14, 2025 -
High max 7.8SSA-965753 6 CVEs
SSA-965753: Multiple File Parsing Vulnerabilities in Simcenter Femap and Nastran Before V2512
Siemens Simcenter Femap and Nastran is affected by multiple file parsing vulnerabilities that could be triggered when the application reads files in NDB and XDB formats. If a user is tricked to open a malicious file with any of the affected products, this cou…
-
High
SSA-783261: Denial of Service Vulnerability in Automation License Manager (ALM) Before V5.2
A vulnerability was identified in the Automation License Manager software before V5.2 that could be triggered by sending specially crafted packets to port 4410/tcp of an affected system. This could cause a denial of service preventing legitimate users from us…
first Dec 12, 2012 -
High max 9.8
SSA-599451: Multiple Vulnerabilities in SiPass integrated
SiPass integrated contains multiple vulnerabilities that could allow an unauthenticated remote attacker to exploit user accounts, manipulate data, impersonate users, or achieve arbitrary code execution on the SiPass integrated server. Siemens has released a n…
first Oct 14, 2025 -
High max 8.8SSA-507364 1 CVE
SSA-507364: Heap Based Buffer Overflow Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager
Versions V6.0 through V8 QU1 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Sys…
-
High max 7.8SSA-445819 1 CVE
SSA-445819: Out of Bounds Read in PS/IGES Parasolid Translator Component in Solid Edge
Solid Edge uses PS/IGES Parasolid Translator Component that contains an out of bounds read that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this coul…
-
High
SSA-130874: Buffer Overflow Vulnerability in SCALANCE X Switches
The embedded web server on affected devices contains a buffer overflow vulnerability. This could allow remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL. Siemens has released new versions for …
first Apr 5, 2012 -
High max 7.6SSA-035571 1 CVE
SSA-035571: Cross Site Scripting Vulnerability in Polarion Before V2506
Polarion before V2506 contains a vulnerability that could allow authenticated remote attackers to conduct cross-site scripting attacks. Siemens has released new versions for the affected products and recommends to update to the latest versions.