456 results · Clear filters · Feed
-
High max 7.4SSA-314390 1 CVE
SSA-314390: LDAP Injection Vulnerability in Mendix LDAP Module
The Mendix LDAP module is affected by an LDAP injection vulnerability that could allow an unauthenticated remote attacker to bypass username verification. Siemens has released a new version for Mendix LDAP and recommends to update to the latest version.
-
High max 7.8
SSA-979056: Out of Bounds Write Vulnerability in Parasolid
Parasolid is affected by an out of bounds write vulnerability that could be triggered when the application is parsing X_T data or a specially crafted file in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker…
first Dec 10, 2024 -
High max 7.8SSA-881356 2 CVEs
SSA-881356: Multiple Memory Corruption Vulnerabilities in Simcenter Femap
Simcenter Femap contains multiple memory corruption vulnerabilities that could be triggered when the application reads files in BDF file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the application …
-
High max 8.8
SSA-822518: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW Before V11.0.1 on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products whe…
first Apr 9, 2024 -
High max 7.8SSA-730188 3 CVEs
SSA-730188: Multiple File Parsing Vulnerabilities in Solid Edge V2024
Siemens Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious PAR or ASM files. If a user is tricked to open a malicious file with the affected products, this could lead the application to…
-
High max 7.8SSA-645131 26 CVEs
SSA-645131: Multiple WRL File Parsing Vulnerabilities in Teamcenter Visualization
Siemens Teamcenter Visualization contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the applic…
-
High max 7.8
SSA-583523: Multiple WRL File Parsing Vulnerabilities in Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the app…
first Oct 8, 2024 -
High max 8.8SSA-384652 1 CVE
SSA-384652: Cross-Site Request Forgery (CSRF) Vulnerability in RUGGEDCOM ROX II
The CLI feature in the web interface of RUGGEDCOM ROX II devices is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to perform administrative actions if an authenticated user is tricked into accessing a malicious link. Siemens h…
-
High max 7.4
SSA-264815: Type Confusion Vulnerability in OpenSSL X.400 Address Processing in SIMATIC Products
Several SIMATIC products are affected by a type confusion vulnerability relating to OpenSSL X.400 address processing (CVE-2023-0286), as disclosed disclosed on 2023-02-07 at https://www.openssl.org/news/secadv/20230207.txt. Siemens has released new versions f…
first Aug 8, 2023 -
High max 7.8SSA-824503 10 CVEs
SSA-824503: Multiple WRL File Parsing Vulnerabilities in Tecnomatix Plant Simulation Before V2302.0018 and V2404.0007
Siemens Tecnomatix Plant Simulation contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the app…
-
High max 8.7SSA-472448 1 CVE
SSA-472448: Security Bypass Vulnerability in the SQL Client-Server Communication in Siveillance Video
Siveillance Video is affected by a security bypass vulnerability in the Microsoft .NET implementation of SQL Client as described in CVE-2024-0056. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 7.5SSA-654798 1 CVE
SSA-654798: Incorrect Authorization Vulnerability in SIMATIC CP 1543-1 Devices
SIMATIC CP 1543-1 devices contain an Incorrect Authorization vulnerability that could allow an unauthenticated attacker to gain access to the filesystem. Siemens has released a new version for SIMATIC CP 1543-1 V4.0 and recommends to update to the latest vers…
-
High max 7.8SSA-616032 1 CVE
SSA-616032: Local Privilege Escalation Vulnerability in Spectrum Power 7 Before V24Q3
Spectrum Power 7 before V24Q3 contains several root-owned SUID binaries that could allow an authenticated local attacker to escalate privileges. Siemens has released a new version for Spectrum Power 7 and recommends to update to the latest version.
-
High max 9.8SSA-354112 16 CVEs
SSA-354112: Multiple Vulnerabilities in SCALANCE M-800 Family Before V8.2
SCALANCE M-800 family before V8.2 is affected by multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 7.8SSA-351178 3 CVEs
SSA-351178: Multiple Vulnerabilities in Solid Edge Before SE2024 Update 9
Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as PAR or PSM format, and by a DLL hijacking vulnerability. This could allow an attacker to cras…
-
High max 8.6SSA-331112 17 CVEs
SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1
SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
-
High max 7.8SSA-064257 1 CVE
SSA-064257: Privilege Escalation Vulnerability in SIPORT Before V3.4.0
SIPORT before V3.4.0 contains a privilege escalation vulnerability which could allow a local attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges. Siemens has released a new version for S…
-
High max 7.8SSA-959281 2 CVEs
SSA-959281: XML File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by stack buffer overflow and null pointer dereference vulnerabilities that could be triggered while parsing XML file. If a user is tricked to open a malicious XML file with any of the affected products, …
-
High max 7.8SSA-852501 2 CVEs
SSA-852501: Multiple Memory Corruption Vulnerabilities in Simcenter Nastran Before 2406.5000
Simcenter Nastran contains multiple memory corruption vulnerabilities that could be triggered when the application reads files in BDF file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the applicatio…
-
High max 7.6
SSA-844582: Electromagnetic Fault Injection in LOGO! V8.3 BM Devices Results in Broken LOGO! V8.3 Product CA
LOGO! V8.3 BM (incl. SIPLUS variants) devices contain a vulnerability that could allow an electromagnetic fault injection. This could allow an attacker to dump and debug the firmware, including the manipulation of memory. Further actions could allow to inject…
first Dec 12, 2023 -
High max 7.8SSA-626178 1 CVE
SSA-626178: Stack-Based Buffer Overflow Vulnerability in JT2Go Before V2406.0003
Siemens JT2Go is affected by a stack-based buffer overflow vulnerability that could be triggered when the application reads files in PDF format. If a user is tricked to open a malicious file with any of the affected products, this could lead the application t…
-
High max 8.5SSA-540493 1 CVE
SSA-540493: Kiosk Mode Escape Vulnerability in HiMed Cockpit Devices Before V11.6.2
HiMed Cockpit devices before V11.6.2 contain a Kiosk Mode Escape vulnerability that could allow an attacker to escape the restricted environment and gain access to the underlying operating system. Siemens has released a new version for the HiMed Cockpit devic…
-
High max 8.8SSA-368868 2 CVEs
SSA-368868: Multiple Vulnerabilities in WibuKey for Windows
Several Siemens products (optionally) offer the use of WibuKey Dongles [1] for licensing. According to a recent publication by WIBU Systems (WIBU-94453 at [2]), the Windows device driver for these Dongles contains vulnerabilities as listed below. - [1] https:…
-
High max 7.5
SSA-321292: Denial of Service in the OPC Foundation Local Discovery Server (LDS) in Industrial Products
A vulnerability has been identified in the OPC Foundation Local Discovery Server (LDS) [0] of several industrial products. The vulnerability could cause a denial of service condition on the service or the device. Siemens has released new versions for several …
first May 10, 2022 -
High max 7.5SSA-969738 1 CVE
SSA-969738: Denial of Service Vulnerability in SIMATIC S7-200 SMART Devices
A vulnerability in SIMATIC S7-200 SMART devices could allow an attacker to cause a denial of service condition if a specially crafted TCP packet is sent to the device. Siemens recommends specific countermeasures for products where fixes are not, or not yet av…
-
High max 7.5
SSA-566905: Multiple Denial of Service Vulnerabilities in the Webserver of Industrial Products
Multiple vulnerabilities in the affected products could allow an unauthorized attacker with network access to the webserver of an affected products to perform a denial of service attack. Siemens has released new versions for the affected products and recommen…
first Apr 11, 2023 -
High max 7.8SSA-427715 1 CVE
SSA-427715: Stack-Based Buffer Overflow Vulnerability in Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation is affected by a stack-based buffer overflow vulnerability that could be triggered when the application reads files in SPP file format. If a user is tricked to open a malicious file with any of the affected products, this c…
-
High max 8.8SSA-342438 1 CVE
SSA-342438: Privilege Escalation Vulnerability in SINUMERIK ONE, SINUMERIK 840D and SINUMERIK 828D
SINUMERIK ONE, SINUMERIK 840D sl and SINUMERIK 828D are affected by a privilege escalation vulnerability that could allow an authenticated local attacker to escalate their privileges in the underlying system. Siemens has released new versions for several affe…
-
High max 7.5
SSA-280603: Denial of Service Vulnerability in SINUMERIK ONE and SINUMERIK MC
A vulnerability has been identified in the integrated S7-1500 CPU of SINUMERIK ONE and SINUMERIK MC products that could allow an attacker to cause a denial of service condition. In order to exploit the vulnerability, an attacker must have access to the affect…
first Dec 12, 2023 -
High max 7.8SSA-856475 3 CVEs
SSA-856475: X_T File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Teamcenter Visualization and JT2Go are affected by out of bounds read and null pointer dereference vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applicat…
-
High max 7.3
SSA-813746: BadAlloc Vulnerabilities in SCALANCE X-200, X-200IRT, and X-300 Switch Families
Siemens has released a new firmware version for SCALANCE X-200 and X-200 IRT switches that address Bad Alloc vulnerabilities in the underlying operating system and recommends to update to the latest versions. Siemens recommends countermeasures for products wh…
first Apr 11, 2023 -
High max 7.8
SSA-771940: X_T File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Teamcenter Visualization and JT2Go are affected by out of bounds read, stack exhaustion and null pointer dereference vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the…
first Jun 11, 2024 -
High max 7.8
SSA-722010: Datalogics File Parsing Vulnerability in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by an out of bounds read vulnerability in the APDFL library from Datalogics. If a user is tricked to open a malicious PDF file with the affected products, this could lead the application to crash or pote…
first Jul 9, 2024 -
High max 7.5SSA-716317 5 CVEs
SSA-716317: Multiple Vulnerability in SINEC Traffic Analyzer Before V2.0
SINEC Traffic Analyzer before V2.0 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC Traffic Analyzer and recommends to update to the latest version.
-
High max 7.8SSA-659443 2 CVEs
SSA-659443: Local Code Execution Vulnerabilities in COMOS Before V10.5
COMOS before V10.5 is affected by two local code execution vulnerabilities in the integrated Open Design Alliance Drawings SDK. Siemens has released a new version for COMOS and recommends to update to the latest version.
-
High max 8.7SSA-417547 2 CVEs
SSA-417547: Multiple Vulnerabilities in INTRALOG WMS Before V4
INTRALOG WMS before V4 is affected by vulnerabilities in the SQL Client-Server communication and in the .NET framework. Successful exploitation could allow an unauthenticated attacker located in the INTRALOG WMS network to decrypt and modify client-server com…
-
High max 7.8
SSA-407785: Multiple X_T File Parsing Vulnerabilities in Parasolid and Teamcenter Visualization
Parasolid and Teamcenter Visualization are affected by memory corruption vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could le…
first Aug 8, 2023 -
High max 7.8SSA-357412 1 CVE
SSA-357412: PRT File Parsing Vulnerability in NX Before V2406.3000
NX (incl. NX student versions) before V2406.3000 contains an out-of-bounds read vulnerability that could be triggered when the application reads PRT files. If a user is tricked to open a malicious file using the affected application, this could lead to a cras…
-
High max 7.3
SSA-116924: Path Traversal Vulnerability in TIA Portal
TIA Portal contains a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability t…
first Apr 11, 2023 -
High max 7.2SSA-087301 4 CVEs
SSA-087301: Multiple Vulnerabilities in SCALANCE M-800 Family Before V8.1
SCALANCE M-800 family before V8.1 is affected by multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.