456 results · Clear filters · Feed
-
High max 7.8
SSA-000072: Multiple File Parsing Vulnerabilities in Simcenter Femap
Simcenter Femap contains multiple file parsing vulnerabilities that could be triggered when the application reads files in Catia MODEL file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the applicati…
first Feb 13, 2024 -
High max 7.8SSA-797296 2 CVEs
SSA-797296: XT File Parsing Vulnerability in Parasolid
Parasolid is affected by out of bounds read and null pointer dereference vulnerabilities that could be triggered when the application reads files in XT format. If a user is tricked to open a malicious file with the affected applications, an attacker could lev…
-
HighSSA-647068 1 CVE
SSA-647068: Ripple20 in SIMATIC RTLS Gateways
SIMATIC RTLS Gateways are affected by vulnerabilities that were disclosed by JSOF research lab “Ripple20” for the TCP/IP stack. Siemens recommends countermeasures for products where fixes are not, or not yet available.
-
High max 7.8SSA-543502 1 CVE
SSA-543502: Local Privilege Escalation Vulnerability in Unicam FX
Unicam FX contains a local privilege escalation vulnerability that could allow an attcker to gain SYSTEM privileges. Unicam FX has reached end of software maintanence. Further information on recommendations for successor product can be found in section 'Addit…
-
High max 7.5SSA-516818 1 CVE
SSA-516818: TCP Sequence Number Validation Vulnerability in the TCP/IP Stack of CP343-1 Devices
Affected products incorrectly validate TCP sequence numbers. This could allow an unauthenticated remote attacker to create a denial of service condition by injecting spoofed TCP RST packets. Siemens recommends countermeasures for products where fixes are not,…
-
High max 7.8
SSA-309571: IPU 2021.1 Vulnerabilities in Siemens Industrial Products using Intel CPUs (June 2021)
Intel has published information on vulnerabilities in Intel products in June 2021. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update. In this advisory we…
first Aug 10, 2021 -
High max 7.5SSA-108696 5 CVEs
SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400
SIDIS Prime before V4.0.400 is affected by multiple vulnerabilities in the components OPC UA and OpenSSL, that could allow an unauthenticated attacker with access to the network where SIDIS Prime is installed to reuse OPC UA client credentials, create a denia…
-
High max 7.8SSA-017796 10 CVEs
SSA-017796: Multiple File Parsing Vulnerabilities in Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL, PSOBJ or SPP file formats. If a user is tricked to open a malicious file with any of the affected products, thi…
-
High max 7.5
SSA-844761: Multiple Vulnerabilities in SiNVR/SiVMS Video Server
The Video Server application in SiNVR/SiVMS solutions contains five vulnerabilities involving information disclosure (CVE-2019-19291, CVE-2019-19299), path traversal (CVE-2019-19296, CVE-2019-19297), and denial-of-service (CVE-2019-19298). PKE has released up…
first Mar 10, 2020 -
High max 7.8SSA-794653 4 CVEs
SSA-794653: Multiple File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious CGM files. If a user is tricked to open a malicious CGM file with the affected products, this could l…
-
High max 7.8SSA-786191 1 CVE
SSA-786191: Local Privilege Escalation Vulnerability in Spectrum Power 7
Spectrum Power 7 is affected by a vulnerability that could allow an authenticated local attacker to inject arbitrary code and gain root access. Siemens has released an update for Spectrum Power 7 and recommends to update to the latest version.
-
High max 7.8SSA-589891 11 CVEs
SSA-589891: Multiple PAR File Parsing Vulnerabilities in Solid Edge
Siemens Solid Edge 2023 has released Update 10, that fixes multiple vulnerabilities that could be triggered when the application reads PAR files. If a user is tricked to open a malicious file using the affected application, this could lead to a crash, and pot…
-
High max 8.4
SSA-983300: Vulnerabilities in LOGO! Soft Comfort
Two vulnerabilities have been identified in the LOGO! Soft Comfort software. These could allow an attacker to take over a system with the affected software installed. Siemens has released an update for LOGO! Soft Comfort and recommends to update to the latest…
first Apr 13, 2021 -
High max 7.5SSA-892915 2 CVEs
SSA-892915: Multiple Denial of Service Vulnerabilities in the Webserver of Industrial Products
Multiple vulnerabilities in the affected products could allow an unauthorized attacker with network access to the webserver to perform a denial of service attack. Siemens has released a new version for SINAMICS S120 (incl. SIPLUS variants) and recommends to u…
-
High
SSA-618620: Vulnerabilities in Boot Loader (U-Boot) of RUGGEDCOM ROS Devices
The boot loader within RUGGEDCOM ROS contains two vulnerabilities in the loading process of the operating system kernel. The more severe of these vulnerabilities could allow an attacker with local access to the device to execute arbitrary code on an affected …
first Dec 10, 2019 -
High max 7.5SSA-118850 1 CVE
SSA-118850: Denial of Service Vulnerability in the OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC
SINUMERIK ONE and SINUMERIK MC products are affected by a denial of service vulnerability in the OPC UA implementation of the integrated S7-1500 CPU. The vulnerability in the integrated S7-1500 CPU is documented in more detail in SSA-711309 [1]. Siemens has r…
-
High max 8.1SSA-077170 7 CVEs
SSA-077170: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 2
SINEC INS before V1.0 SP2 Update 2 is affected by multiple vulnerabilities. Siemens has released an update for SINEC INS and recommends to update to the latest version.
-
High max 7.8
SSA-975766: Open Design Alliance Drawings SDK Vulnerability in Solid Edge
Solid Edge is affected by a file parsing vulnerability in Drawings SDK from Open Design Alliance. If a user is tricked to open a malicious DWG file with the affected application, an attacker could leverage the vulnerability to crash the application or execute…
first Jun 13, 2023 -
High max 7.8SSA-887122 2 CVEs
SSA-887122: X_T File Parsing Vulnerabilities in Simcenter Femap
Simcenter Femap is affected by out of bounds write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerabili…
-
High max 7.8SSA-478780 7 CVEs
SSA-478780: Multiple WRL File Parsing Vulnerabilities in Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the app…
-
High max 8.0SSA-456933 4 CVEs
SSA-456933: Multiple Vulnerabilities in SIMATIC PCS neo before V4.1
SIMATIC PCS neo before V4.1 is affected by multiple vulnerabilities. Siemens has released a new version for SIMATIC PCS neo and recommends to update to the latest version.
-
High max 7.8
SSA-363107: An Improper Initialization Vulnerability Affects SIMATIC WinCC Kiosk Mode
A vulnerability was found in SIMATIC WinCC that could allow authenticated attackers to escape the Kiosk Mode. Siemens has released updates for the affected products and recommends to update to the latest versions.
first May 10, 2022 -
High max 8.8
SSA-268517: Code Execution Vulnerability (libwebp CVE-2023-4863) in Mendix Studio Pro
Mendix Studio Pro is vulnerable to an out of bounds write vulnerability in the integrated libwebp library (CVE-2023-4863), that could allow an attacker to execute code in the context of a victim user's system. Siemens has released updates for the affected pro…
-
High max 7.5SSA-197270 1 CVE
SSA-197270: Information Disclosure Vulnerability in Siemens OPC UA Modeling Editor (SiOME)
Siemens OPC UA Modeling Editor (SiOME) is affected by an XML external entity (XXE) injection vulnerability that could allow an attacker to interfere with an application's processing of XML data and read arbitrary files in the system. Siemens has released a ne…
-
High max 7.5SSA-770890 1 CVE
SSA-770890: Path Traversal Vulnerability in the Web Server of CPCI85 Firmware of SICAM A8000 Devices
The web server in the CPCI85 firmware of SICAM A8000 CP-8031 and CP-8050 is affected by a path traversal vulnerability that could allow an authenticated remote attacker to traverse directories on the system, download arbitrary files and potentially escalate p…
-
High max 8.3SSA-594373 1 CVE
SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14
SINEMA Server V14 improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting (XSS) attack that may lead to arbitrary code execution with SYST…
-
High max 7.8SSA-524778 9 CVEs
SSA-524778: File Parsing Vulnerabilities in Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation contains multiple vulnerabilities that could be triggered when the application reads SPP and IGS files. If a user is tricked to open a malicious file using the affected application, this could lead to a crash, and potential…
-
High max 7.5
SSA-516174: Wi-Fi Encryption Bypass Vulnerabilities in SCALANCE W1750D
The SCALANCE W1750D device is affected by Wi-Fi encryption bypass vulnerabilities ("Framing Frames") that could allow an attacker to disclose sensitive information or to steal the victims session. Siemens has released updates for the affected products and rec…
first May 9, 2023 -
High max 7.3
SSA-250085: Multiple Vulnerabilities in SINEC NMS and SINEMA Server
SINEC NMS and SINEMA Server V14 contain multiple vulnerabilities that could allow an attacker to execute arbitrary code on the system, arbitrary commands on the local database or achieve privilege escalation. Siemens has released several updates for SINEC NMS…
first Mar 8, 2022 -
High max 7.8SSA-829656 1 CVE
SSA-829656: Stack Overflow Vulnerability in Xpedition Layout Browser
Siemens Xpedition Layout Browser consists of a stack overflow vulnerability that could be triggered when the application reads a malicious file in PCB format. If a user is tricked to open a malicious file with the affected product, this could lead the applica…
-
High max 8.2SSA-357182 1 CVE
SSA-357182: Local Privilege Escalation Vulnerability in Spectrum Power 7
Spectrum Power 7 is affected by a vulnerability that could allow an authenticated local attacker to inject arbitrary code to the update script and escalate privileges. Siemens has released an update for Spectrum Power 7 and recommends to update to the latest …
-
High max 8.2SSA-957369 23 CVEs
SSA-957369: Insyde BIOS Vulnerabilities in RUGGEDCOM APE1808 Product Family
Insyde has published information on vulnerabilities in Insyde BIOS up to August 2023. These vulnerabilities also affect the RUGGEDCOM APE1808 product family. Siemens has released updates for the affected products and recommends to update to the latest version…
-
High max 7.8
SSA-764801: File Parsing Vulnerabilities in Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation contains multiple vulnerabilities that could be triggered when the application reads PAR, SPP, STP and PRT files. If a user is tricked to open a malicious file using the affected application, this could lead to a crash, and…
first Jul 11, 2023 -
High max 7.6
SSA-587547: Unencrypted Storage of User Credentials in QMS Automotive
QMS Automotive contains a vulnerability that stores user credentials in plantext within the user database. This could allow an attacker to read credentials from memory. Siemens has released an update for QMS Automotive and recommends to update to the latest v…
first Nov 8, 2022 -
High max 7.0
SSA-450613: Insyde BIOS Vulnerabilities in RUGGEDCOM APE1808 Product Family
Insyde has published information on vulnerabilities in Insyde BIOS on November 8th 2022. These vulnerabilities also affect the RUGGEDCOM APE1808 product family. Siemens has released updates for the affected products and recommends to update to the latest vers…
first Feb 14, 2023 -
High max 7.5
SSA-382653: Multiple Denial of Service Vulnerabilities in Industrial Products
Affected SIMATIC firmware contains multiple vulnerabilities that could allow an unauthenticated attacker to perform a denial of service attack under certain conditions. Siemens has released updates for the affected products and recommends to update to the lat…
first Dec 13, 2022 -
High max 7.8SSA-278349 7 CVEs
SSA-278349: Multiple WRL File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Siemens JT2Go and Teamcenter Visualization are affected by file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead th…
-
High max 7.8SSA-190839 2 CVEs
SSA-190839: X_T File Parsing Vulnerabilities in Parasolid
Parasolid is affected by out of bounds write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to …
-
High max 8.8SSA-147266 10 CVEs
SSA-147266: Multiple Vulnerabilities in QMS Automotive before V12.39
QMS Automotive before V12.39 contains multiple vulnerabilities that could allow an attacker to perform malicious code injection, information disclosure or lead to a denial of service condition. Siemens has released an update for QMS Automotive and recommends …
-
High max 7.8SSA-975961 2 CVEs
SSA-975961: Privilege Escalation Vulnerabilities in SICAM TOOLBOX II before V07.10
SICAM TOOLBOX II contains two vulnerabilities that could allow local attackers to execute code on the system with elevated privileges. Siemens has released an update for SICAM TOOLBOX II and recommends to update to the latest version.