456 results · Clear filters · Feed
-
HighSSA-617755 1 CVE
SSA-617755: Denial of Service Vulnerability in the SNMP Agent of SCALANCE X-200IRT Products
Products of the SCALANCE X-200IRT switch family are affected by a denial of service vulnerability in the SNMP agent that could allow remote attackers to cause a denial of service condition. Siemens has released updates for the affected products and recommends…
-
High max 7.8SSA-565356 2 CVEs
SSA-565356: X_T File Parsing Vulnerabilities in Simcenter Femap before V2023.1
Simcenter Femap is affected by out of bounds read/write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulner…
-
High max 7.5
SSA-313313: Denial of Service Vulnerability in the FTP Server of Nucleus RTOS
The FTP server of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to genera…
first Oct 11, 2022 -
High max 7.8SSA-997779 1 CVE
SSA-997779: File Parsing Vulnerability in Solid Edge before V2023 MP1
Solid Edge is affected by memory corruption vulnerability that could be triggered when the application read files in different file formats such as PAR, ASM, DFT. If a user is tricked to open a malicious file with the affected applications, an attacker could …
-
High max 7.8SSA-936212 3 CVEs
SSA-936212: JT File Parsing Vulnerabilities in JT Open, JT Utilities and Solid Edge
JT Open Toolkit, JT Utilities and Solid Edge are affected by memory corruption vulnerabilities that could be triggered while parsing JT files. If a user is tricked to open a malicious JT file with any of the affected products, this could cause the application…
-
High max 8.1
SSA-210822: Improper Access Control Vulnerability in Mendix Workflow Commons Module
The Mendix Workflow Commons module improperly handles access control for some module entities. This could allow authenticated remote attackers to read or delete sensitive information. Mendix has released updates for several version lines of the Mendix Workflo…
first Dec 13, 2022 -
High max 9.8SSA-849072 3 CVEs
SSA-849072: Several Vulnerabilities in SICAM PAS before V8.06
SICAM PAS/PQS before V8.06 is affected by three vulnerabilities which could lead to remote code execution, privilege escalation or the creation of a denial of service condition. Siemens has released several updates for SICAM PAS/PQS and recommends to update t…
-
High
SSA-678983: Vulnerabilities in Industrial PCs and CNC devices using Intel CPUs (November 2020)
Intel has published information on vulnerabilities in Intel products in November 2020. This advisory lists the Siemens IPC related products, that are affected by these vulnerabilities. In this advisory we take a representative CVE from each advisory: - “Intel…
first May 11, 2021 -
High max 9.8
SSA-638652: Authentication Bypass Vulnerability in Mendix SAML Module
The Mendix SAML module insufficiently protects from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. Mendix has provided fix releases for the Mendix SAML module and recommends to…
first Sep 13, 2022 -
High max 7.8SSA-588101 5 CVEs
SSA-588101: Multiple File Parsing Vulnerabilities in Parasolid
Parasolid is affected by out of bounds read/write vulnerabilities that could be triggered when the application reads files in X_B format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerabilit…
-
High
SSA-443566: Authentication Bypass in SCALANCE X Switches Families
Several SCALANCE X switches are affected by an Authentication Bypass vulnerability. The vulnerability allows an unauthenticated attacker to violate access-control rules. The vulnerability can be exploited by sending a GET request to a specific uniform resourc…
first Jan 14, 2020 -
High max 9.8SSA-363821 6 CVEs
SSA-363821: Multiple Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7
SCALANCE X-200RNA switch devices before V3.2.7 contain multiple vulnerabilities that could allow an attacker to cause a denial of service condition, to extract sensitive information or to hijack existing sessions. Siemens has released updates for the affected…
-
High max 7.8SSA-360681 3 CVEs
SSA-360681: Datalogics File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by multiple out of bounds write vulnerabilities in the APDFL library from Datalogics. If a user is tricked to open a malicious PDF file with the affected products, this could lead the application to cras…
-
High max 7.8SSA-333517 4 CVEs
SSA-333517: Multiple Vulnerabilities in SCALANCE SC-600 Family before V3.0
Multiple vulnerabilities affecting various third-party components of the SCALANCE SC-600 family could allow an attacker to cause a denial of service condition, corrupt memory or potentially execute custom code. Siemens has released updates for the affected pr…
-
High
SSA-312271: Unquoted Search Path Vulnerability in Windows-based Industrial Software Applications
Several industrial products as listed below contain a local privilege escalation vulnerability that could allow a local attacker to execute arbitrary code with SYTEM privileges. Siemens has released updates for the affected products and recommends to update t…
first Jun 9, 2020 -
High max 8.1SSA-224632 1 CVE
SSA-224632: Improper Access Control Vulnerability in Mendix Email Connector Module
The Mendix Email Connector module improperly handles access control for some module entities. This could allow authenticated remote attackers to read and manipulate sensitive information. Mendix has released an update for the Mendix Email Connector module and…
-
High max 7.8SSA-853037 2 CVEs
SSA-853037: File Parsing Vulnerabilities in Parasolid
Parasolid is affected by out of bounds read/write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerabilit…
-
HighSSA-649853 1 CVE
SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management
Industrial Edge Management contains a vulnerability that could allow an unauthenticated attacker to spoof a trusted entity by interfering in the communication path between the Industrial Edge Management (IEM) and the Industrial Edge Hub (IEH) using a crafted …
-
High max 7.8SSA-611756 1 CVE
SSA-611756: JT File Parsing Vulnerability in JTTK and Simcenter Femap
JT Open Toolkit (JTTK) and Simcenter Femap are affected by an uninitialized pointer reference vulnerability that could be triggered while parsing JT files. If a user is tricked to open a malicious JT file with any of the affected products, this could cause th…
-
High max 7.5SSA-384224 1 CVE
SSA-384224: Denial of Service Vulnerability in SIMATIC HMI Panels
Several SIMATIC HMI Panels are affected by a vulnerability that could allow an attacker to cause a permanent denial of service condition (requiring a device reboot) by sending specially crafted TCP packets. Siemens has released updates for the affected produc…
-
HighSSA-360783 7 CVEs
SSA-360783: Multiple Webserver Vulnerabilities in Desigo PXM Devices
Desigo PXM devices contain multiple vulnerabilities in the webserver application that could allow an attacker to potentially access sensitive information, execute arbitrary commands, cause a denial of service condition, or perform remote code execution. Sieme…
-
HighSSA-258115 1 CVE
SSA-258115: DWG File Parsing Vulnerability in Solid Edge before SE2022MP9
Solid Edge is affected by a heap overflow vulnerability that could be triggered when the application reads DWG files. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to perform remote c…
-
High max 8.8SSA-637483 14 CVEs
SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2
Multiple vulnerabilities affecting various third-party components of SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for the SINE…
-
HighSSA-589975 1 CVE
SSA-589975 Improper Access Control Vulnerability in CoreShield OWG Software
The default installation of the Windows version of the CoreShield One- Way Gateway (OWG) software sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator. Siemens Mobility has released an update for the C…
-
High max 7.8SSA-518824 20 CVEs
SSA-518824 Multiple File Parsing Vulnerabilities in Simcenter Femap and Parasolid
Simcenter Femap and Parasolid are affected by multiple file parsing vulnerabilities that could be triggered when the application reads files in X_T file formats. If a user is tricked to open a malicious file with the affected applications, an attacker could l…
-
High
SSA-429204 Open Design Alliance Drawings SDK Vulnerabilities in JT2Go and Teamcenter Visualization
JT2Go and Teamcenter Visualization are affected by multiple file parsing vulnerabilities in Drawings SDK from Open Design Alliance. If a user is tricked to open a malicious DWG file with any of the affected products, this could lead the application to crash o…
first Jul 12, 2022 -
High
SSA-243317 File Parsing Vulnerability in Simcenter Femap and Parasolid
Simcenter Femap and Parasolid are affected by an out of bounds read vulnerability that could be triggered when the application reads files in NEU format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage …
first Jul 12, 2022 -
High max 7.8
SSA-829738: Datalogics File Parsing Vulnerability in Teamcenter Visualization and JT2Go
Siemens Teamcenter Visualization and JT2Go are affected by an out of bounds write vulnerability in APDFL library from Datalogics. If a user is tricked to open a malicious PDF file with the affected products, this could lead the application to crash or potenti…
first Jul 12, 2022 -
High
SSA-789162: Vulnerabilities in Teamcenter
Teamcenter is affected by XML External Entity Injection (XXE, CVE-2022-29801) and a stack based buffer overflow vulnerability (CVE-2022-24290). XXE impacts only Teamcenter versions before V13.1. Siemens has released updates for the affected products and recom…
first May 10, 2022 -
High max 6.8SSA-759952 2 CVEs
SSA-759952: Command Injection and Denial of Service Vulnerability in Teamcenter
Teamcenter is affected by two security vulnerabilities in the File Service Cache service that could lead to command injection and denial of service issues. Siemens has released updates for the affected products and recommends to update to the latest versions.
-
High max 3.7
SSA-732250: Libcurl Vulnerabilities in Industrial Devices
Vulnerabilities in third-party component cURL could allow an attacker to interfere with the affected products in various ways. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends count…
first May 10, 2022 -
High
SSA-661034: Incorrect Permission Assignment in Multiple SIMATIC Software Products
Multiple SIMATIC software products are affected by a vulnerability that could allow an attacker to change the content of certain metafiles and subsequently manipulate parameters or behaviour of devices configured by the affected software products. Siemens has…
first Jul 13, 2021 -
High
SSA-629512: Local Privilege Escalation Vulnerability in TIA Portal
The latest updates for TIA Portal fix a vulnerability that could allow a local attacker to execute arbitrary code with SYSTEM privileges. Update: The previously provided fixes only correctly set the permissions on English Windows versions. Siemens has release…
first Jan 14, 2020 -
High
SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products
WIBU Systems published information about a denial-of-service vulnerability and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerability is describ…
first Nov 9, 2021 -
High max 7.5
SSA-307392: Denial of Service in OPC UA in Industrial Products
A vulnerability has been identified in the OPC UA server of several industrial products. The vulnerability could cause a denial of service condition on the service or the device. Siemens has released updates for several affected products and recommends to upd…
first Apr 9, 2019 -
HighSSA-865333 1 CVE
SSA-865333: Memory Corruption Vulnerability in EN100 Ethernet Module
EN100 Ethernet module is affected by memory corruption vulnerability (CVE-2022-30938). Siemens has released an update for the EN100 Ethernet module IEC 61850 variant and recommends to update to the latest version. Siemens recommends specific countermeasures f…
-
High
SSA-711829: Denial of Service Vulnerability in TIA Administrator
In conjunction with the installation of the affected products listed in the table below, a vulnerability in TIA Administrator occurs that could allow an unauthenticated attacker to perform a denial of service attack. Siemens has released updates for the affec…
first Apr 12, 2022 -
HighSSA-599506 1 CVE
SSA-599506: Command Injection Vulnerability in RUGGEDCOM ROX
RUGGEDCOM ROX devices are affected by a command injection vulnerability that could allow an attacker with administrative privileges to gain root access. Siemens has released updates for the affected products and recommends to update to the latest versions.
-
HighSSA-491621 1 CVE
SSA-491621: Denial of Service Vulnerability in CPC80 Firmware of SICAM A8000 Devices
A vulnerability was identified in the CPC80 firmware of SICAM A8000 devices. It could allow an unauthenticated remote attacker to cause a permanent denial of service condition. Siemens has released updates for the affected products and recommends to update to…
-
HighSSA-474231 1 CVE
SSA-474231: File Parsing Vulnerability in Simcenter Femap before V2022.2
Siemens Simcenter Femap versions before V2022.2 are affected by an out of bounds write vulnerability that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected application, an attack…