874 results · Feed
-
Medium max 5.3
SSA-913875: Frame Aggregation and Fragmentation Vulnerabilities in 802.11
Twelve vulnerabilities in the implementation of frame aggregation and fragmentation of the 802.11 standard, under the name of FragAttacks, have been published. Successful exploitation of these vulnerabilities could allow an attacker within Wi-Fi range to forg…
first Jul 13, 2021 -
High max 7.3SSA-801704 1 CVE
SSA-801704: Authentication Bypass Vulnerability in SINEC NMS
Siemens SINEC NMS when used with User Management Component (UMC) contains an authentication bypass vulnerability due to insufficient validation of user identity. This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorize…
-
High max 8.8SSA-741509 1 CVE
SSA-741509: Privilege Escalation Vulnerability in RUGGEDCOM CROSSBOW Secure Access Manager Primary Before V5.8
RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) contains a vulnerability that could allow an attacker to escalate their own privileges. Siemens has released a new version for RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) and recommends to …
-
High max 7.5
SSA-726834: Denial of Service Vulnerability in the RADIUS Client of SIPROTEC 5 Devices
The RADIUS client implementation of the VxWorks platform in SIPROTEC 5 devices contains a denial of service vulnerability that could be triggered when a specially crafted packet is sent by a RADIUS server. Siemens has released new versions for the affected pr…
first Mar 14, 2023 -
Low max 2.2
SSA-726617: Incorrect Privilege Assignment Vulnerability in Mendix OIDC SSO Module
The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development. Siemens has released new versions for several affe…
first May 13, 2025 -
High max 7.5
SSA-712929: Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Products
A vulnerability in the openSSL component (CVE-2022-0778, [0]) could allow an attacker to create a denial of service condition by providing specially crafted elliptic curve certificates to products that use a vulnerable version of openSSL. Siemens has released…
first Jun 14, 2022 -
Critical max 9.1
SSA-710008: Multiple Web Vulnerabilities in SCALANCE Products
SCALANCE devices contain multiple vulnerabilities in MSPS based product lines that could allow authenticated remote attackers to execute custom code or create a XSS situation, as well as unauthenticated remote attackers to create a denial of service condition…
first Aug 9, 2022 -
High max 7.1SSA-609469 1 CVE
SSA-609469: Authorization Bypass Vulnerability in Industrial Edge Management
Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens…
-
High max 8.8SSA-605717 1 CVE
SSA-605717: Authorization Bypass Vulnerability in SINEC NMS Before V4.0 SP3
SINEC NMS before V4.0 SP3 contains an Authorization Bypass vulnerability that could allow an attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account. Siemens has released a new version for SINEC NMS …
-
High max 7.5
SSA-599968: Denial of Service Vulnerability in Profinet Devices
A vulnerability in affected devices could allow an attacker to perform a denial ofservice attack if a large amount of Profinet Discovery and Configuration Protocol (DCP) reset packets is sent to the affected devices. Siemens has released new versions for seve…
first Jul 13, 2021 -
High max 8.8
SSA-552702: Privilege Escalation Vulnerability in the Web Interface of SCALANCE and RUGGEDCOM Products
The products listed below do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Siemens has released updates for several affected products and recommends to update to t…
first Oct 11, 2022 -
High max 7.5
SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitra…
first Dec 13, 2022 -
High max 7.8
SSA-311973: Multiple Local Privilege Escalation Vulnerabilities in SINEC NMS and User Management Component (UMC)
Multiple Siemens products are affected by two local privilege escalation vulnerabilities which could allow an low privileged attacker to load malicious DLLs, potentially leading to arbitrary code execution with elevated privileges. Siemens has released new ve…
first Feb 10, 2026 -
High max 7.4
SSA-244969: OpenSSL Vulnerability in Industrial Products
OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1l and 1.0.2 < 1.0.2za that allows an attacker to cause a denial of service (DoS) or to disclose private memory content. Siemens has released updates for sever…
first Feb 8, 2022 -
High max 7.2SSA-225816 1 CVE
SSA-225816: Memory Corruption Vulnerability in RUGGEDCOM CROSSBOW Station Access Controller Before V5.8
RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains a vulnerability that could allow an attacker to achieve arbitrary code execution and to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access …
-
Medium max 5.5
SSA-186293: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER
SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER are affected by an XXE injection vulnerability that could allow an attacker to access arbitrary application files. Siemens has released new versions for several affected products and recommends to update…
first Aug 12, 2025 -
Critical max 9.1SSA-019200 15 CVEs
SSA-019200: Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11n Devices Before V6.6.0
SCALANCE W-700 IEEE 802.11n family before V6.6.0 are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11n family and recommends to update to the latest version.
-
High max 7.5SSA-246443 2 CVEs
SSA-246443: Multiple Vulnerabilities in SICAM 8 Products
Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - RTUM85 for CP-8010/CP-8012 - SICAM EGS Device firmware -…
-
High max 7.4SSA-903736 6 CVEs
SSA-903736: Multiple vulnerabilities in SICAM SIAPP SDK before V2.1.7
The SICAM SIAPP SDK contains multiple vulnerabilities that could allow an attacker to disrupt the customer-developed SIAPP or its simulation environment. Potential impacts include denial of service within the SIAPP, corruption of SIAPP data, or exploit the si…
-
High max 7.4
SSA-868571: Missing Server Certificate Validation in IAM Client
Multiple Siemens products are affected by improper certificate validation in IAM Client. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for the affected products and recommends to up…
first Dec 9, 2025 -
Critical max 9.6
SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.
first Feb 11, 2025 -
High max 8.1
SSA-710408: Missing Server Certificate Validation in Siemens Advanced Licensing (SALT) Toolkit
Multiple Siemens products are affected by improper certificate validation in Siemens Advanced Licensing (SALT) Toolkit. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for several aff…
first Dec 9, 2025 -
High max 7.8
SSA-535115: Data Validation Vulnerability in NX Before V2512
Siemens NX is affected by missing data validation vulnerability that could allow an attacker with local access on a compromised system to interfere with internal data during the PDF export process that could potentially lead to arbitrary code execution. Sieme…
first Feb 10, 2026 -
High max 8.4
SSA-513708: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where f…
first Jun 10, 2025 -
High max 9.8SSA-485750 23 CVEs
SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
-
Critical max 9.9
SSA-430425: Multiple Vulnerabilities in SINEC Security Monitor before V4.9.0
SINEC Security Monitor before V4.9.0 contains multiple vulnerabilities. Siemens has released a new version for SINEC Security Monitor and recommends to update to the latest version.
first Oct 8, 2024 -
Critical max 10.0
SSA-212953: Multiple Vulnerabilities in COMOS
COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for the affected products and …
first Dec 9, 2025 -
High max 8.2
SSA-201595: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager
Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems…
first Aug 14, 2025 -
Low max 2.6SSA-126399 1 CVE
SSA-126399: Improper Access Control Vulnerability in Heliox EV Chargers
Heliox EV Chargers listed below contain improper access control vulnerability that could allow an attacker to reach unauthorized services via the charging cable. Siemens has released new versions for the affected products and recommends to update to the lates…
-
Medium max 6.3
SSA-027652: Privilege Escalation Vulnerability in SINAMICS Drives
Siemens SINAMICS G220, SINAMICS S210, and SINAMICS S200 contains a privilege escalation vulnerability that could allow users to escalate their privileges. Siemens has released new versions for the affected products and recommends to update to the latest versi…
first Sep 9, 2025 -
Critical max 10.0
SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1
SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Aug 12, 2025 -
Critical max 9.8
SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2
SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Aug 12, 2025 -
Critical max 10.0
SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3
SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Jan 28, 2026 -
High max 7.8SSA-965753 6 CVEs
SSA-965753: Multiple File Parsing Vulnerabilities in Simcenter Femap and Nastran Before V2512
Siemens Simcenter Femap and Nastran is affected by multiple file parsing vulnerabilities that could be triggered when the application reads files in NDB and XDB formats. If a user is tricked to open a malicious file with any of the affected products, this cou…
-
High
SSA-783261: Denial of Service Vulnerability in Automation License Manager (ALM) Before V5.2
A vulnerability was identified in the Automation License Manager software before V5.2 that could be triggered by sending specially crafted packets to port 4410/tcp of an affected system. This could cause a denial of service preventing legitimate users from us…
first Dec 12, 2012 -
Medium max 6.3SSA-625934 1 CVE
SSA-625934: Improper Access Control Vulnerability in the Webhooks Implementation of Siveillance Video Management Servers
The Webhooks implementation of Siveillance Video Management Servers contains a vulnerability that could allow an authenticated remote attacker with read-only privileges to achieve full access to Webhooks API. Siemens has released new versions for the affected…
-
High max 9.8
SSA-599451: Multiple Vulnerabilities in SiPass integrated
SiPass integrated contains multiple vulnerabilities that could allow an unauthenticated remote attacker to exploit user accounts, manipulate data, impersonate users, or achieve arbitrary code execution on the SiPass integrated server. Siemens has released a n…
first Oct 14, 2025 -
High max 8.8SSA-507364 1 CVE
SSA-507364: Heap Based Buffer Overflow Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager
Versions V6.0 through V8 QU1 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Sys…
-
High max 7.8SSA-445819 1 CVE
SSA-445819: Out of Bounds Read in PS/IGES Parasolid Translator Component in Solid Edge
Solid Edge uses PS/IGES Parasolid Translator Component that contains an out of bounds read that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this coul…
-
High
SSA-130874: Buffer Overflow Vulnerability in SCALANCE X Switches
The embedded web server on affected devices contains a buffer overflow vulnerability. This could allow remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL. Siemens has released new versions for …
first Apr 5, 2012