874 results · Feed
-
Medium max 4.3
SSA-460466: Denial of Service Vulnerability in TIA Project-Server and TIA Portal
A vulnerability in TIA Project Server and TIA Portal could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further …
first Jul 8, 2025 -
Critical max 10.0
SSA-446307: Authentication Bypass Vulnerability in BMC (CVE-2024-54085) affects SIMATIC IPC RS-828A
SIMATIC IPC RS-828A is affected by an authentication bypass vulnerability in the Redfish interface of its Baseboard Management Controller (BMC) that could allow an attacker to gain unauthorized access and compromise confidentiality, integrity and availability…
first May 13, 2025 -
High max 7.5SSA-400089 1 CVE
SSA-400089: Denial of Service Vulnerability in SIPROTEC 4 and SIPROTEC 4 Compact
SIPROTEC 4 and SIPROTEC 4 Compact devices contain a vulnerability that could allow an unauthenticated remote attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the lates…
-
High max 7.1SSA-382999 7 CVEs
SSA-382999: Multiple Vulnerabilities in Opcenter Quality Before V2506
The Opcenter Quality is affected by multiple vulnerabilities in the SmartClient modules Opcenter QL Home (SC), SOA Audit and SOA Cockpit. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
Medium max 4.9
SSA-353002: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family
SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG Family is affected by multiple vulnerabilities. CVE-2023-44318 and CVE-2023-44321 were previously published as part of SSA-699386. Siemens has released new versions for several affected products and recommends t…
first Mar 12, 2024 -
Critical max 9.6
SSA-256353: Third-Party Component Vulnerabilities in RUGGEDCOM ROS
Multiple vulnerabilities affect various third-party components of the RUGGEDCOM Operating System (ROS). If exploited, an attacker could cause a denial-of-service, act as a man-in-the-middle or retrieval of sensitive information or gain privileged functions. S…
first Mar 8, 2022 -
High max 8.3SSA-177847 1 CVE
SSA-177847: Improper VNC Password Check Vulnerability in SINUMERIK Controllers
Siemens SINUMERIK Controllers are affected by an improper VNC password check vulnerability. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
High max 8.8
SSA-170375: Multiple Vulnerabilities in RUGGEDCOM ROS Before V5.9
Multiple vulnerabilities affect the RUGGEDCOM Operating System (ROS). The common denominator to all vulnerabilities is the leak of confidential information. Siemens has released new versions for several affected products and recommends to update to the latest…
first Jul 9, 2024 -
Medium max 5.3
SSA-097435: Usernames Disclosure Vulnerability in Mendix Runtime
Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions f…
first Sep 10, 2024 -
High max 7.6SSA-094954 1 CVE
SSA-094954: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II
RUGGEDCOM ROX II devices do not properly limit access through their Built-In-Self-Test (BIST) mode. This could allow a local attacker to bypass authentication and access a root shell on the device. Siemens is preparing fix versions and recommends specific cou…
-
Medium max 5.3
SSA-725549: Denial of Service of ICMP in Industrial Devices
A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The integrated ICMP services in the underlying TCP/IP stack is vulnerable to a denial of service attack through s…
first Apr 8, 2025 -
High max 8.1
SSA-183963: Certificate Validation Vulnerabilities in SICAM TOOLBOX II Before V07.11
During establishment of a https connection to the TLS server of a managed device, SICAM TOOLBOX II improperly validates that device's certificate. This could allow an attacker to execute an on-path network (MitM) attack. Siemens has released a new version for…
first Jul 8, 2025 -
Unscored max 10.0
SSA-938066: Remote Code Execution Vulnerability in SENTRON Powermanager and Desigo CC
SENTRON Powermanager and Desigo CC devices are not affected by a remote code execution vulnerability in Apache Tomcat that can be triggered via a partial PUT request due to a path equivalence issue. It could allow a remote attacker to execute arbitrary code, …
-
Critical
SSA-763427: Authentication Bypass Vulnerability in SIMATIC CP and TIM Devices
SIMATIC CP and TIM devices contain an authentication bypass vulnerability that could allow unauthenticated users to perform administrative operations under certain conditions. Siemens has released new versions for several affected products and recommends to u…
first Nov 27, 2015 -
Critical max 9.8
SSA-634640: Weak Authentication Vulnerability in Siemens Industrial Edge Devices
Siemens Industrial Edge Devices contain a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for the affected products an…
first Apr 8, 2025 -
Medium max 6.5SSA-626991 1 CVE
SSA-626991: Denial of Service Vulnerability in SIMATIC CN 4100 before V4.0
A vulnerability in SIMATIC CN 4100 could allow an attacker to cause a denial of service condition. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
-
High max 7.5
SSA-593272: SegmentSmack in Interniche IP-Stack based Industrial Devices
A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which c…
first Apr 14, 2020 -
High max 7.8SSA-573669 2 CVEs
SSA-573669: Multiple Vulnerabilities in TIA Administrator Before V3.0.6
Siemens TIA Administrator before V3.0.6 contains multiple vulnerabilities which could allow an attacker to escalate privilege or exceute arbitrary code during installations. Siemens has released a new version for TIA Administrator and recommends to update to …
-
High max 8.1
SSA-446545: Impact of RegreSSHion (CVE-2024-6387) in Siemens Industrial Products
An OpenSSH vulnerability, known as regreSSHion, affects multiple Siemens industrial products. This security regression vulnerability consists in a race condition which may allow an unauthenticated remote attacker to achieve remote code execution with high imp…
first Sep 10, 2024 -
High max 7.8SSA-091753 3 CVEs
SSA-091753: Multiple Vulnerabilities in Solid Edge Before SE2025 Update 5
Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as PAR or CFG format. This could allow an attacker to crash the application or execute arbitrary…
-
Critical max 9.8SSA-078892 4 CVEs
SSA-078892: Multiple Vulnerabilities in SINEC NMS Before V4.0
Siemens SINEC NMS before V4.0 is affected by multiple vulnerabilities which could allow an attacker to elevate privilege and exceute arbitrary code. Siemens has released a new version for SINEC NMS and recommends to update to the latest version. Siemens is pr…
-
Medium max 6.7
SSA-426509: Multiple Local Code Execution Vulnerabilities in Questa and ModelSim
Questa and ModelSim (incl. OEM Editions) are affected by multiple vulnerabilities that could allow a local attacker to inject arbitrary code and escalate privileges. Siemens has released new versions for the affected products and recommends to update to the l…
first Oct 8, 2024 -
Critical max 9.9
SSA-345750: Default Credentials in Energy Services Using Elspec G5DFR
Energy Services from Siemens (previously known as Managed Applications and Services), sell solutions using Elspec G5 Digital Fault Recorder which contains default credentials with admin privileges. A client configuration with remote access could allow an atta…
first Jun 10, 2025 -
Medium max 5.3
SSA-874353: Entity Enumeration Vulnerability in Mendix Runtime
Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has rele…
first Apr 8, 2025 -
High max 7.4
SSA-656895: Open Redirect Vulnerability in Teamcenter
The SSO login service in Teamcenter contains an open redirect vulnerability that could allow an attacker to redirect the legitimate user to an attacker-chosen URL to steal valid session data. Siemens has released new versions for the affected products and rec…
first Feb 11, 2025 -
Medium max 4.3SSA-633269 1 CVE
SSA-633269: Incorrect Authorization Check Vulnerability in Industrial Communication Devices based on SINEC OS before V3.1
Several Industrial Communication Devices based on SINEC OS before V3.1 contain an incorrect authorization check vulnerability that could allow an attacker to perform actions that exceed the permissions of the "guest" role. Siemens has released new versions fo…
-
Unscored max 6.5
SSA-620799: Denial of Service Vulnerability During BLE Pairing in SENTRON Powercenter 1000/1100
SENTRON Powercenter devices are not affected by a denial of service vulnerability that can be triggered during BLE (Bluetooth Low Energy) pairing. Note: Unlike stated in the initial version of this security advisory from 2024-12-10, detailed analysis has show…
first Dec 10, 2024 -
Critical
SSA-497656: Multiple NTP Vulnerabilities in TIM 4R-IE Devices
TIM 4R-IE devices contain multiple vulnerabilities in the integrated NTP component as listed below. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
first Apr 13, 2021 -
High max 7.8SSA-486186 1 CVE
SSA-486186: Out of Bounds Read Vulnerability in Tecnomatix Plant Simulation Before 2404
Siemens Tecnomatix Plant Simulation contains a out-of-bound read vulnerability that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the applica…
-
Critical max 8.7
SSA-354569: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where f…
first Nov 22, 2024 -
High max 7.5
SSA-340240: Denial of Service Vulnerability in SIRIUS 3RV2921-5M
A vulnerability in SIRIUS 3RV2921-5M could allow an attacker to cause a denial of service condition. Siemens has released a new version for SIRIUS 3RV2921-5M and recommends to update to the latest version.
first Oct 8, 2024 -
High max 7.1
SSA-162506: DHCP Client Vulnerability in SIMOTICS CONNECT 400, Desigo PXC/PXM, APOGEE MEC/MBC/PXC, APOGEE PXC Series, and TALON TC Series
SIMOTICS CONNECT 400, Desigo (Power PC-based), APOGEE MEC/MBC/PXC and TALON TC products are affected by a DHCP Client vulnerability as initially reported in SSA-434032 for the Mentor Nucleus Networking Module. Siemens has released updates for several affected…
first Apr 14, 2020 -
High max 7.5SSA-041082 1 CVE
SSA-041082: Out of Bounds Read Vulnerability in SiPass Integrated Before V2.95.3.18
SiPass integrated versions before V2.95.3.18 contain an out of bounds read vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition. Siemens has released a new version for SiPass integrated and recommends to up…
-
High max 8.8
SSA-556937: Multiple Vulnerabilities in VersiCharge AC Series EV Chargers
VersiCharge AC Series EV Chargers contain two vulnerabilities that could allow an attacker to gain control of the chargers through default Modbus port or execute arbitrary code by manipulating the M0 firmware. Siemens recommends countermeasures for products w…
first May 13, 2025 -
Medium max 5.5SSA-552330 1 CVE
SSA-552330: System Configuration Password Reset in Siveillance Video V2024 R1
The installer of Siveillance Video V2024 R1 resets the system configuration password when updating from older versions of Siveillance Video. This could inadvertently remove the password protection from system configuration files, also affecting backup data se…
-
High max 7.5
SSA-935500: Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products
A denial of service vulnerability has been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-313313: https://cert-portal.siemens.com/productcert/html/ssa-313313.html. The products listed below use af…
first Oct 11, 2022 -
High max 8.7SSA-901508 8 CVEs
SSA-901508: Multiple Vulnerabilities in INTRALOG WMS Before V5
INTRALOG WMS before V5 is affected by multiple vulnerabilities in the Microsoft .NET implementation as described below. Siemens has released a new version for INTRALOG WMS and recommends to update to the latest version. Please approach your INTRALOG WMS conta…
-
Medium max 6.5SSA-828116 1 CVE
SSA-828116: Denial of Service Vulnerability in BACnet ATEC Devices
BACnet ATEC devices are affected by a denial of service vulnerability that could be triggered by an attacker residing in the same BACnet network by sending a specially crafted MSTP message. A power cycle is required to restore the device's normal operation. S…
-
Critical max 9.8
SSA-819629: Weak Authentication Vulnerability in Industrial Edge Device Kit
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains a weak authentication vulnerability that could f…
first Apr 8, 2025 -
Medium max 4.7SSA-718393 1 CVE
SSA-718393: Partial Denial of Service Vulnerability in APOGEE PXC and TALON TC Series (BACnet) Devices
APOGEE PXC and TALON TC Series (BACnet) Devices devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted m…