456 results · Clear filters · Feed
-
High max 7.8
SSA-932528: Multiple File Parsing Vulnerabilities in Solid Edge
Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as DWG, IFC, OBJ or STP format. If a user is tricked to open a malicious file with the affe…
first May 9, 2023 -
High max 7.8SSA-811403 9 CVEs
SSA-811403: Multiple File Parsing Vulnerabilities in Solid Edge before V223 Update 7
Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as DFT, PAR or PSM format. If a user is tricked to open a malicious file with the affected …
-
High
SSA-223771: SISCO Stack Vulnerability in SIPROTEC 5 Devices
A vulnerability in the third party component SISCO MMS-EASE could allow attackers to cause a denial of service condition with SIPROTEC 5 devices. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Dec 13, 2022 -
High max 7.8SSA-188491 2 CVEs
SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center
Multiple DLL Hijacking vulnerabilities in Siemens Software Center (SSC) could allow a local attacker to execute code with elevated privileges. Siemens has released an update for the Siemens Software Center and recommends to update to the latest version.
-
High max 8.8
SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20
APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities: - CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege acc…
first Dec 13, 2022 -
High max 7.8SSA-131450 3 CVEs
SSA-131450: File parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization
Siemens JT2Go, Teamcenter Visualization and Solid Edge are affected by multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as ASM or TIFF file format) with any of the affected products, this could lead the application…
-
HighSSA-116172 1 CVE
SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer
A vulnerability in Nullsoft Scriptable Installer System (NSIS) software (CVE-2023-37378) used in Parasolid installers before V36 creates an “uninstall directory” with insufficient access control. This could allow an attacker to misuse the vulnerability, and p…
-
High max 7.8SSA-001569 2 CVEs
SSA-001569: JT File Parsing Vulnerabilities in JT Open, JT Utilities and Parasolid
JT Open Toolkit, JT Utilities and Parasolid are affected by memory corruption vulnerabilities that could be triggered while parsing JT files. If a user is tricked to open a malicious JT file with any of the affected products, this could cause the application …
-
High max 7.8
SSA-930100: Privilege Escalation Vulnerability in Simcenter STAR-CCM+
Simcenter STAR-CCM+ contains a privilege escalation vulnerability which could allow a local attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges. Siemens has released an update for Simcen…
first Dec 13, 2022 -
High max 7.5SSA-924149 1 CVE
SSA-924149: Stack Overflow Vulnerability in SiPass Integrated before V2.90.3.8
SiPass integrated versions before V2.90.3.8 contain a stack overflow vulnerability that could allow an unauthenticated remote attacker to crash the server application, creating a denial of service condition. Siemens has released an update for SiPass integrate…
-
High max 7.8
SSA-988345: Local Privilege Escalation Vulnerability in Xpedition Designer
A vulnerability in Xpedition Designer could allow an attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges. Siemens has released updates for the affected products and recommends to update …
first Jun 14, 2022 -
High max 7.8SSA-914026 1 CVE
SSA-914026: Local Code Execution Vulnerability in SIMATIC WinCC V7
SIMATIC WinCC V7 is affected by a vulnerability that could allow a local attacker to inject arbitrary code and escalate privileges, if a non-default installation path was chosen during installation. Siemens has released an update for SIMATIC WinCC and recomme…
-
High max 7.2SSA-731916 3 CVEs
SSA-731916: Multiple Vulnerabilities in CPCI85 Firmware of SICAM A8000 Devices
The CPCI85 firmware of SICAM A8000 CP-8031 and CP-8050 is affected by multiple vulnerabilities such as authenticated remote command injection, exposure of serial UART interface, and hard coded credentials (for UART login). Siemens has released updates for the…
-
High max 7.8SSA-538795 4 CVEs
SSA-538795: Multiple File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious CGM files. If a user is tricked to open a malicious CGM file with the affected products, this could l…
-
High max 7.8
SSA-120378: Multiple File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious TIF, CGM or PDF files. If a user is tricked to open a malicious TIF, CGM or PDF file with the affecte…
first Nov 8, 2022 -
High max 7.2SSA-555292 7 CVEs
SSA-555292: Security Vulnerabilities Fixed in SIMATIC Cloud Connect 7 V2.1
SIMATIC Cloud Connect 7 contains multiple vulnerabilities that could allow an attacker to impact its confidentiality, integrity and availability. Siemens has released updates for the affected products and recommends to update to the latest versions.
-
High max 7.5
SSA-480230: Denial of Service Vulnerability in Webserver of Industrial Products
A vulnerability in the affected devices could allow an unauthorized attacker with network access to the webserver of an affected device to perform a denial of service attack. Siemens has released updates for several affected products and recommends to update …
first Apr 9, 2019 -
High max 8.2
SSA-113131: Denial of Service Vulnerabilities in SIMATIC S7-400 CPUs
Two vulnerabilities have been identified in the SIMATIC S7-400 CPU family that could allow an attacker to cause a denial of service condition. In order to exploit the vulnerabilities, an attacker must have access to the affected devices on port 102/tcp via Et…
first Nov 13, 2018 -
High max 7.5
SSA-978220: Denial of Service Vulnerability over SNMP in Multiple Industrial Products
Several industrial products are affected by a vulnerability that could allow remote attackers to conduct a denial of service attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released updates for several affected products and rec…
first Feb 11, 2020 -
High max 7.5
SSA-838121: Multiple Denial of Service Vulnerabilities in Industrial Products
Affected SIMATIC firmware contains three vulnerabilities that could allow an unauthenticated attacker to perform a denial of service attack under certain conditions. Siemens has released updates for several affected products and recommends to update to the la…
first Feb 8, 2022 -
High max 7.8
SSA-700053: Multiple File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads a malicious file in CGM or RAS format. If a user is tricked to open a malicious file with the affected products…
first Dec 13, 2022 -
High max 7.5
SSA-676336: OpenSSH Vulnerabilities in SCALANCE X-200 and X-300/X408 Switches
The latest update of the SCALANCE X-200 and X-300/X408 switches families fixes multiple OpenSSH vulnerabilities. The most severe of these vulnerabilities could allow a denial of service condition. Siemens has released updates for several affected products and…
first Sep 14, 2021 -
High max 7.8SSA-642810 1 CVE
SSA-642810: JT File Parsing Vulnerability in JT Open and JT Utilities
JT Open Toolkit and JT Utilities are affected by a memory corruption vulnerability that could be triggered while parsing JT files. If a user is tricked to open a malicious JT file with any of the affected products, this could cause the application to crash or…
-
High max 5.5SSA-629917 1 CVE
SSA-629917: Datalogics File Parsing Vulnerability in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by a memory corruption vulnerability in the APDFL library from Datalogics. If a user is tricked to open a malicious PDF file with the affected products, this could lead the application to crash or potent…
-
HighSSA-572164 1 CVE
SSA-572164: Luxion KeyShot Vulnerability in Solid Edge
The Solid Edge installation package includes a specific version of the third-party product KeyShot from Luxion : https://www.keyshot.com, which may not contain the latest security fixes provided by Luxion. Siemens recommends to update KeyShot according to the…
-
High max 7.5
SSA-557541: Denial-of-Service Vulnerability in SIMATIC S7-400 CPUs
SIMATIC S7-400 CPU devices contain an input validation vulnerability that could allow an attacker to create a Denial-of-Service condition. A restart is needed to restore normal operations. Siemens has released an update for SIMATIC S7-410 V10 CPU family and S…
first Apr 12, 2022 -
High max 7.5
SSA-549234: Denial-of-Service Vulnerability in SIMATIC NET CP Modules
A denial of service vulnerability was identified in different types of Communication Processors. An attacker could exploit this vulnerability causing the device to become un-operational until the device is restarted. Siemens has released updates for several a…
first Sep 14, 2021 -
High max 7.5
SSA-462066: Vulnerability known as TCP SACK PANIC in Industrial Products
Multiple industrial products are affected by a vulnerability in the kernel known as TCP SACK PANIC. The vulnerability could allow a remote attacker to cause a denial of service condition. Siemens has released updates for several affected products and recommen…
first Sep 10, 2019 -
High max 7.5
SSA-270778: Denial-of-Service Vulnerability in SIMATIC PCS 7, SIMATIC WinCC and SIMATIC NET PC Software
A Denial-of-Service vulnerability was found in SIMATIC PCS 7, SIMATIC WinCC and SIMATIC NET PC software when encrypted communication is enabled. The vulnerability could allow an attacker with network access to cause a Denial-of-Service condition under certain…
first Feb 11, 2020 -
High max 7.5
SSA-102233: SegmentSmack in VxWorks-based Industrial Devices
The products listed below contain a vulnerability that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet w…
first Apr 14, 2020 -
High max 7.8
SSA-847261: Multiple SPP File Parsing Vulnerabilities in Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation has released an update, 2201 Update 6, that fixes multiple vulnerabilities that could be triggered when the application reads SPP files. If a user is tricked to open a malicious file using the affected application, this cou…
first Feb 14, 2023 -
High max 7.5SSA-565386 17 CVEs
SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0
Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released…
-
High
SSA-539476: Siemens SIMATIC NET CP, SINEMA and SCALANCE Products Affected by Vulnerabilities in Third-Party Component strongSwan
Vulnerabilities in the third-party component strongSwan could allow an attacker to cause a denial of service (DoS) condition in affected devices by exploiting integer overflow bugs. Siemens has released updates for the affected products and recommends to upda…
first Feb 8, 2022 -
High max 7.8
SSA-491245: Multiple File Parsing Vulnerabilities in Solid Edge
Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as X_B, DWG, DXF, STL, STP, SLDPRT and PAR format. If a user is tricked to open a malicious…
first Feb 14, 2023 -
High max 8.2
SSA-476715: Two Vulnerabilities in Automation License Manager
Siemens Automation License Manager contains two vulnerabilities which, when combined, could allow an attacker to modify and rename license files, extract licenses and overwrite arbitrary files on the target system potentially leading to privilege escalation a…
first Jan 10, 2023 -
High
SSA-324955: SAD DNS Attack in Linux Based Products
A vulnerability made public under the name SAD DNS affects Domain Name System resolvers due to a vulnerability in the Linux kernel when handling ICMP packets. The Siemens products which are affected are listed below. For more information please see https://ww…
first May 11, 2021 -
High max 8.8SSA-320629 2 CVEs
SSA-320629: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.3
RUGGEDCOM CROSSBOW before V5.3 contains two vulnerabilities that could allow authenticated remote attackers to access data they are not authorized for, or execute arbitrary database queries via an SQL injection attack. Siemens has released an update for RUGGE…
-
High max 7.8SSA-836777 3 CVEs
SSA-836777: JT File Parsing Vulnerabilities in JT Open, JT Utilities and Parasolid
JT Open Toolkit, JT Utilities and Parasolid are affected by memory corruption vulnerabilities that could be triggered while parsing JT files. If a user is tricked to open a malicious JT file with any of the affected products, this could cause the application …
-
High max 7.5SSA-744259 8 CVEs
SSA-744259: Golang Vulnerabilities in Brownfield Connectivity - Gateway before V1.10.1
Siemens has released a new version for Brownfield Connectivity - Gateway that contains fixes for multiple vulnerabilities in the underlying Golang implementation. Successful exploitation of these vulnerabilities could lead to Denial of Service (DoS). Siemens …
-
High max 7.8SSA-658793 1 CVE
SSA-658793: Command Injection Vulnerability in SiPass integrated AC5102 / ACC-G2 and ACC-AP
SiPass integrated ACC (Advanced Central Controller) devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileg…