874 results · Feed
-
High max 7.6SSA-035571 1 CVE
SSA-035571: Cross Site Scripting Vulnerability in Polarion Before V2506
Polarion before V2506 contains a vulnerability that could allow authenticated remote attackers to conduct cross-site scripting attacks. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 8.1
SSA-978177: Vulnerability in Nozomi Guardian/CMC Before 25.4.0 on RUGGEDCOM APE1808 Devices
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to upda…
first Aug 12, 2025 -
Critical max 9.8
SSA-928984: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)
Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution. Siemens has released new versions for several affected products and recommends to …
first Dec 16, 2024 -
High max 8.8
SSA-912274: Multiple Vulnerabilities in RUGGEDCOM ROX Before V2.17
Devices based on RUGGEDCOM ROX before V2.17 contain multiple high severity vulnerabilities. Siemens has released a new version for RUGGEDCOM ROX II family and recommends to update to the latest version.
first Dec 9, 2025 -
Critical max 9.8
SSA-832273: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.3 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing furthe…
first Mar 12, 2024 -
High max 6.9
SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens r…
first Jul 9, 2024 -
Medium max 6.5
SSA-693776: Multiple Vulnerabilities in Industrial Communication Devices based on SINEC OS before V3.2
Several Industrial Communication Devices based on SINEC OS before V3.2 contain multiple vulnerabilities that could allow an attacker to circumvent authorization checks and perform actions that exceed the permissions of the "guest" role. Siemens has released n…
first Jun 10, 2025 -
Critical max 9.8
SSA-366067: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing furthe…
first Mar 12, 2024 -
High max 8.1
SSA-365200: Google Chrome Type Confusion Vulnerability in Siemens Products
Multiple Siemens products are affected by a type confusion vulnerability in Google Chrome prior to 138.0.7204.96. This could allow a remote attacker to perform arbitrary code execution via a crafted HTML page. Siemens has released a new version for Industrial…
first Oct 14, 2025 -
Critical max 9.0
SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.4-h1
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products whe…
first Jul 9, 2024 -
High max 8.8SSA-192617 1 CVE
SSA-192617: Local Privilege Escalation Vulnerability in TeleControl Server Basic Before V3.1.2.4
TeleControl Server Basic before V3.1.2.4 contains a local privilege escalation vulnerability that could allow an attacker to run arbitrary code with elevated privileges. Siemens has released a new version for TeleControl Server Basic and recommends to update …
-
Critical max 10.0SSA-014678 1 CVE
SSA-014678: Authorization Bypass Vulnerability in Industrial Edge Device Kit
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains an authorization bypass vulnerability that could…
-
High max 7.8SSA-512988 1 CVE
SSA-512988: File Parsing Vulnerability in Simcenter Femap Before V2512
Siemens Simcenter Femap versions before V2512 are affected by uninitialized memory vulnerability that could be triggered when the application reads files in SLDPRT format. If a user is tricked to open a malicious file with the affected application, an attacke…
-
High max 7.5SSA-915282 1 CVE
SSA-915282: Denial of service Vulnerability in Interniche IP-Stack based Industrial Devices
Multiple Industrial products are affected by a vulnerability in the Interniche IP-Stack. The affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthentic…
-
Medium max 6.7SSA-882673 2 CVEs
SSA-882673: Multiple Vulnerabilities in SINEC Security Monitor before V4.10.0
SINEC Security Monitor before V4.10.0 contains multiple vulnerabilities. Siemens has released a new version for SINEC Security Monitor and recommends to update to the latest version.
-
Medium max 4.3SSA-763474 1 CVE
SSA-763474: Denial of Service Vulnerability in Ruggedcom ROS devices before V5.10.1
Ruggedcom ROS devices contain a temporary denial of service vulnerability that could allow an attacker to crash and restart the device. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
Medium max 6.8SSA-734261 1 CVE
SSA-734261: Authentication Bypass Vulnerability in Energy Services Using Elspec G5DFR
Energy Services from Siemens (previously known as Managed Applications and Services), sell solutions using Elspec G5 devices that allows a person with physical access to the device to reset the Admin password by inserting a USB drive (containing a publicly do…
-
High max 8.2
SSA-673996: Buffer Overflow Vulnerability in Third-Party Component in SICAM and SITIPE Products
Multiple SICAM products are affected by buffer overflow vulnerability in the IEC 61850 Client libraries from Triangle MicroWorks that could allow an unauthenticated remote attacker to create a denial of service condition by sending specially crafted MMS messa…
first Sep 10, 2024 -
Medium max 4.3SSA-626856 2 CVEs
SSA-626856: Multiple Vulnerabilities in SINEMA Remote Connect Sever Before V3.2 SP4
SINEMA Remote Connect Server Before V3.2 SP4 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.
-
Critical max 9.9SSA-471761 15 CVEs
SSA-471761: Multiple Vulnerabilities in SICAM T Before V3.0
SICAM T before V3.0 contain multiple vulnerabilities. These include critical issues such as improper parameter and input validation, various Cross-Site Scripting (XSS) vulnerabilities , and a Cross-Site Request Forgery (CSRF) vulnerability . Additional weakne…
-
Medium max 6.2SSA-420375 1 CVE
SSA-420375: Improper Integrity Check of Firmware Updates in Building X - Security Manager Edge Controller (ACC-AP)
Building X - Security Manager Edge Controller (ACC-AP) devices do not properly check the integrity of firmware updates. This could allow an attacker to upload a maliciously modified firmware onto the device. Siemens is preparing fix versions and recommends sp…
-
High max 8.3SSA-416652 5 CVEs
SSA-416652: Multiple Vulnerabilities in SIMATIC CN 4100 Before V4.0.1
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
-
Medium max 6.3SSA-356310 2 CVEs
SSA-356310: Multiple Vulnerabilities in Gridscale X Prepay
Gridscale X Prepay contains multiple vulnerabilities that could allow an attacker to enumerate valid user names and to bypass locked-out user sessions. Siemens has released a new version for Gridscale X Prepay and recommends to update to the latest version.
-
Critical max 9.8
SSA-202008: Multiple Vulnerabilities in Ruggedcom Rox Before V2.17.0
Ruggedcom ROX familly contain multiple vulnerabilities before V2.17.0 Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 7.8SSA-241605 1 CVE
SSA-241605: Out of Bounds Read in PS/IGES Parasolid Translator Component Before V29.0.258
PS/IGES Parasolid Translator Component contains an out of bounds read that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the applicatio…
-
Medium max 5.7SSA-190588 1 CVE
SSA-190588: Cross-Site Scripting Vulnerability in Mendix Rich Text Widget
Mendix RichText editor contain a cross-site scripting vulnerability. Siemens has released a new version for Mendix RichText and recommends to update to the latest version.
-
Medium max 5.9
SSA-750499: Weak Encryption Vulnerability in SIPROTEC 5 Devices
The SIPROTEC 5 devices are supporting weak encryption. This could allow an unauthorized attacker in a man-in-the-middle position to read any data passed over the connection between legitimate clients and the affected device. Siemens has released new versions …
first Jul 9, 2024 -
High max 7.5
SSA-711309: Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products
The OPC UA implementations (ANSI C and C++) as used in several SIMATIC products contain a denial of service vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate. S…
first Sep 12, 2023 -
Medium max 6.8
SSA-687955: Accessible Development Shell via Physical Interface in SIPROTEC 5
Affected SIPROTEC 5 devices contain a development shell which is accessible via a physical interface which is not properly restricted. This could allow an unauthenticated attacker with physical access to an affected device to execute arbitrary commands on the…
first Feb 11, 2025 -
Critical max 9.4SSA-682326 2 CVEs
SSA-682326: Multiple Vulnerabilities in COMOS before V10.4.5
COMOS is affected by two vulnerabilities that could allow an attacker to execute arbitrary code or lead to data infiltration. Siemens has released a new version for COMOS and recommends to update to the latest version.
-
Critical max 9.8
SSA-631336: Multiple Web Server Vulnerabilities in SICAM GridEdge Before V2.6.6
Multiple vulnerabilities were identified in the web server of the SICAM GridEdge application which includes missing authentication for critical API functions, absent cross-origin resource sharing restrictions and access to credentials. Siemens has released a …
first Jun 14, 2022 -
Medium max 5.3
SSA-552874: Denial of Service Vulnerability in SIPROTEC 5 Devices
Devices of the SIPROTEC 5 family contain a vulnerability related to secure client-initiated renegotiation. This could allow an unauthenticated attacker to cause a denial of service condition for the duration of the attack. Siemens has released new versions fo…
first Dec 13, 2022 -
High max 7.5SSA-522291 1 CVE
SSA-522291: Improper Certificate Validation Vulnerability in Solid Edge
Solid Edge is affected by improper certificate validation while connecting to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released a new version for Solid Edge SE2025 and reco…
-
High max 7.8SSA-514895 2 CVEs
SSA-514895: Multiple Vulnerabilities in Altair Grid Engine V2025.1.0
Altair Grid Engine contain multiple vulnerabilities that could allow an attacker to escalate privileges and execute arbitrary code with superuser permissions. Siemens has released a new version for Altair Grid Engine and recommends to update to the latest ver…
-
High max 7.8SSA-365596 1 CVE
SSA-365596: DLL Hijacking Vulnerability in Siemens Software Center and Solid Edge
Siemens Software Center and Solid Edge is affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code via placing a crafted DLL file on the system. Siemens has released new versions for the affected products and recommend…
-
High max 8.8SSA-339694 5 CVEs
SSA-339694: Multiple Vulnerabilities in Spectrum Power 4 Before v4.70 SP12 Security Patch 2
Spectrum Power 4 before v4.70 SP12 Security Patch 2 contains multiple vulnerabilities that could allow an attacker to remotely execute code as application administrator or locally execute code as operating system administrator. Siemens has released a new vers…
-
High max 7.5
SSA-322980: Denial of Service Vulnerability in SIPROTEC 5 Devices
SIPROTEC 5 devices contain a null pointer dereference vulnerability in the web service. This could allow an attacker to send unauthenticated maliciously crafted http request that could cause denial of service condition of the device. Siemens has released new …
first Apr 11, 2023 -
Critical max 9.9
SSA-301229: Client-Side Enforcement of Server-Side Security Vulnerabilities in RUGGEDCOM ROX II
The web interface of RUGGEDCOM ROX II devices contain multiple Client-Side Enforcement of Server-Side Security vulnerabilities that could allow an attacker with a legitimate, highly privileged account on the web interface to get privileged code execution in t…
first May 13, 2025 -
Medium max 6.3
SSA-225578: Improper Access Control Vulnerability in SICAM GridEdge Before V2.7.3
SICAM GridEdge contains an improper access control vulnerability. This could allow persons with local access to the host system to inject an SSH key. Siemens has released a new version for SICAM GridEdge (Classic) and recommends to update to the latest versio…
first Jul 12, 2022 -
Medium max 5.5SSA-201498 2 CVEs
SSA-201498: Multiple Vulnerabilities in the Web Server of SICAM P850 and SICAM P855 Devices Before V3.11
The web server of SICAM P850 and SICAM P855 devices, versions before V3.11, contains a Cross Site Request Forgery (CSRF) vulnerability and is missing cookie protection flags. This could allow an attacker to perform arbitrary actions on the device on behalf of…