Description
A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | ROS# | < V2.3.1 | V2.3.1 |
Advisories 2
- NCSC-2026-0479 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 11, 2026
- SSA-435267 SSA-435267: Code Injection Vulnerability in ROS# Before 2.3.1 Siemens ProductCERT · Nov 10, 2026