874 results · Feed
-
Critical max 9.8
SSA-625850: Multiple WIBU Systems CodeMeter Vulnerabilities Affecting the Desigo CC Product Family and SENTRON powermanager
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIB…
first Nov 14, 2023 -
High max 8.7SSA-417547 2 CVEs
SSA-417547: Multiple Vulnerabilities in INTRALOG WMS Before V4
INTRALOG WMS before V4 is affected by vulnerabilities in the SQL Client-Server communication and in the .NET framework. Successful exploitation could allow an unauthenticated attacker located in the INTRALOG WMS network to decrypt and modify client-server com…
-
High max 7.8
SSA-407785: Multiple X_T File Parsing Vulnerabilities in Parasolid and Teamcenter Visualization
Parasolid and Teamcenter Visualization are affected by memory corruption vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could le…
first Aug 8, 2023 -
High max 7.8SSA-357412 1 CVE
SSA-357412: PRT File Parsing Vulnerability in NX Before V2406.3000
NX (incl. NX student versions) before V2406.3000 contains an out-of-bounds read vulnerability that could be triggered when the application reads PRT files. If a user is tricked to open a malicious file using the affected application, this could lead to a cras…
-
Critical max 9.1
SSA-180704: Multiple Vulnerabilities in SCALANCE M-800 Family Before V8.0
SCALANCE M-800 family before V8.0 is affected by multiple vulnerabilities. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or…
first Dec 12, 2023 -
High max 7.3
SSA-116924: Path Traversal Vulnerability in TIA Portal
TIA Portal contains a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability t…
first Apr 11, 2023 -
High max 7.2SSA-087301 4 CVEs
SSA-087301: Multiple Vulnerabilities in SCALANCE M-800 Family Before V8.1
SCALANCE M-800 family before V8.1 is affected by multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 7.2
SSA-068047: Multiple Vulnerabilities in SCALANCE M-800 Family Before V7.2.2
SCALANCE M-800 family before V7.2.2 is affected by multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Dec 12, 2023 -
High max 8.2
SSA-857368: Multiple Vulnerabilities in Omnivise T3000
Omnivise T3000 contains multiple vulnerabilities that could allow an attacker to escalate privileges. Siemens Energy has released patches for several affected products and recommends to apply the patches. Siemens Energy is preparing further fixes for versions…
first Aug 2, 2024 -
Critical max 9.8SSA-071402 2 CVEs
SSA-071402: Multiple Vulnerabilities in SICAM Products
Multiple SICAM products are affected by unauthorized password reset and firmware downgrade vulnerabilities that could lead to privilege escalation and potential leak of information, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICAM EG…
-
High max 7.5SSA-998949 1 CVE
SSA-998949: Hard-coded Default Encryption Key in Mendix Encryption Module V10.0.0 and V10.0.1
The Mendix Encryption module versions V10.0.0 and V10.0.1 define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encr…
-
High max 8.8SSA-928781 2 CVEs
SSA-928781: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 HF1
SINEMA Remote Connect Server before V3.2 HF1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.
-
High max 7.8SSA-868282 3 CVEs
SSA-868282: Multiple Vulnerabilities in SINEMA Remote Connect Client before V3.2 HF1
SINEMA Remote Connect Server before V3.2 HF1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version.
-
High max 7.8SSA-825651 1 CVE
SSA-825651: Deserialization Vulnerability in SIMATIC STEP 7 (TIA Portal) before V18 Update 2
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released a new v…
-
High max 7.8SSA-824889 2 CVEs
SSA-824889: XML File Parsing Vulnerabilities in JT Open and PLM XML SDK
JT Open Toolkit and PLM XML SDK are affected by stack buffer overflow and null pointer dereference vulnerabilities that could be triggered while parsing XML file. If a user is tricked to open a malicious XML file with any of the affected products, this could …
-
High max 7.5
SSA-780073: Denial of Service Vulnerability in PROFINET Devices via DCE-RPC Packets
Products that include the Siemens PROFINET-IO (PNIO) stack in versions prior V06.00 are potentially affected by a denial of service vulnerability when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. Siemens has released new …
first Feb 11, 2020 -
Medium max 6.5SSA-779936 1 CVE
SSA-779936: Catalog-Profile Deserialization Vulnerability in Siemens Engineering Platforms before V19
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new ver…
-
Critical max 10.0
SSA-750274: Impact of CVE-2024-3400 on RUGGEDCOM APE1808 devices configured with Palo Alto Networks Virtual NGFW
Palo Alto Networks has published [1] information on CVE-2024-3400 in PAN-OS. This advisory addresses Siemens Industrial products affected by this vulnerability. Siemens has released a new version of Palo Alto Networks Virtual NGFW for RUGGEDCOM APE1808 and re…
first Apr 19, 2024 -
Critical max 9.8
SSA-484086: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.1
SINEMA Remote Connect Server is affected by multiple vulnerabilities, including - A cross-site scripting vulnerability in an error message pop up window (CVE-2022-29034) - Several authentication bypass, privilege escalation and integrity check vulnerabilities…
first Jun 14, 2022 -
High max 7.5
SSA-473245: Denial of Service Vulnerability in Profinet Devices
A vulnerability in affected devices could allow an attacker to perform a denial of service attack if a large amount of specially crafted UDP packets are sent to the device. Siemens has released new versions for several affected products and recommends to upda…
first Oct 8, 2019 -
Critical max 9.6SSA-381581 13 CVEs
SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1
SINEMA Remote Connect Server before V3.2 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.
-
High max 7.5
SSA-346262: Denial of Service Vulnerability in SNMP Interface of Industrial Products
Several industrial products are affected by a vulnerability that could allow remote attackers to conduct a denial of service attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released new versions for several affected products an…
first Nov 23, 2017 -
Critical max 7.8
SSA-337522: Multiple Vulnerabilities in TIM 1531 IRC before V2.4.8
Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Jun 11, 2024 -
Medium max 6.3SSA-313039 1 CVE
SSA-313039: Deserialization Vulnerability in STEP 7 Safety before V19
Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released a new v…
-
High max 7.8
SSA-160243: Multiple Vulnerabilities in SINEC NMS before V2.0
SINEC NMS before V2.0 is affected by a code injection and a stored cross-site scripting vulnerability. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
first Oct 10, 2023 -
High max 7.8SSA-064222 15 CVEs
SSA-064222: Multiple File Parsing Vulnerabilities in Simcenter Femap before V2406
Simcenter Femap contains multiple file parsing vulnerabilities that could be triggered when the application reads files in IGS, BDF or BMP file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the appli…
-
High max 7.8SSA-900277 1 CVE
SSA-900277: MODEL File Parsing Vulnerability in Tecnomatix Plant Simulation before V2302.0012 and V2024.0001
Tecnomatix Plant Simulation contains a type confusion vulnerability that could be triggered when the application reads MODEL files. If a user is tricked to open a malicious file using the affected application, this could lead to a crash, and potentially also …
-
High max 7.5SSA-879734 8 CVEs
SSA-879734: Multiple Vulnerabilities in SCALANCE XM-400/XR-500 before V6.6.1
Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 7.8
SSA-871704: Multiple Vulnerabilities in SICAM Products
Multiple SICAM products are affected by vulnerabilities that could lead to privilege escalation, remote code execution or information loss namely: - SICAM A8000 device firmwares - CPC80 for CP-8000/CP-8021/CP-8022 - CPCI85 and OPUPI0 for CP-8031/CP-8050 - SIC…
first May 14, 2024 -
Critical max 7.8SSA-625862 23 CVEs
SSA-625862: Multiple Vulnerabilities in Third-Party Components in SIMATIC CP 1542SP-1 and CP 1543SP-1 before V2.3
SIMATIC CP 1542SP-1 and CP 1543SP-1 before V2.3 are affected by multiple vulnerabilities in third-party components and the integrated web server. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 7.8SSA-620338 1 CVE
SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM
SICAM AK3/TM/BC devices are affected by a buffer overflow vulnerability that could allow an attacker to execute code in the context of the current process or lead to a denial of service condition. - SICAM AK3 device firmware- CPCX26 for CP-2016 - PCCX26 for C…
-
Medium max 5.9SSA-540640 1 CVE
SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime
Apps built with Mendix Runtime >= V9.3 could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights. Si…
-
High max 8.2SSA-481506 1 CVE
SSA-481506: Information Disclosure Vulnerability in SIMATIC S7-200 SMART Devices
SIMATIC S7-200 SMART devices contain an information disclosure vulnerability which leaves the system susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack and eventually could allow an at…
-
High max 8.2
SSA-341067: Multiple vulnerabilities in third-party components in ST7 ScadaConnect before V1.1
Siemens has released a new version for ST7 ScadaConnect and recommends to update to the latest version.
-
Low max 3.3SSA-319319 1 CVE
SSA-319319: Denial of Service Vulnerability in TIA Administrator
TIA Administrator creates temporary download files in a directory with insecure permissions. This could allow any authenticated attacker on Windows to disrupt the update process. Siemens has released a new version for TIA Administrator and recommends to updat…
-
Medium max 5.6SSA-238730 3 CVEs
SSA-238730: Out-of-Bounds Write Vulnerabilities in SITOP UPS1600 before V2.5.4
Multiple out-of-bounds vulnerabilities in third-party components are affecting SITOP UPS1600 before V2.5.4. Attackers could exploit these vulnerabilities and cause limited impact in the affected systems. Siemens has released new versions for the affected prod…
-
Critical max 10.0
SSA-093430: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager before V3.0
Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version.
first May 14, 2024 -
High max 7.8
SSA-035466: Incorrect Permission Assignment in SICAM PAS/PQS
SICAM PAS/PQS is affected by insecure permission assignments in application folders that could allow an authenticated local attacker to read and modify configuration data or to escalate privileges. Siemens has released a new version for SICAM PAS/PQS and reco…
first Oct 10, 2023 -
Critical max 9.3SSA-024584 1 CVE
SSA-024584: Authentication Bypass Vulnerability in PowerSys before V3.11
PowerSys before V3.11 is affected by a vulnerability that could allow a local attacker to bypass authentication, thereby gaining administrative privileges for the managed remote devices. Siemens has released a new version for PowerSys and recommends to update…
-
High max 7.8SSA-976324 11 CVEs
SSA-976324: Multiple IGS File Parsing Vulnerabilities in PS/IGES Parasolid Translator Component before V27.1.215
PS/IGES Parasolid Translator Component contains multiple file parsing vulnerabilities that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this could lea…