Bulletins | CERT@VDE

Mitsubishi Electric Corporation MELSEC iQ-F Series CPU Module

Title

Mitsubishi Electric Corporation MELSEC iQ-F Series CPU Module

Published

Aug. 21, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-233-01

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Mitsubishi Electric Corporation Equipment: MELSEC iQ-F Series CPU module Vulnerability: Improper Handling of Length Parameter Inconsistency 2. RISK EVALUATION Successful exploitation of this vulnerability could result in a remote attacker being able to delay the processing ...

19.08.2025

Siemens Desigo CC Product Family and SENTRON Powermanager

Title

Siemens Desigo CC Product Family and SENTRON Powermanager

Published

Aug. 19, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-231-01

Summary

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

19.08.2025

SSA-201595 V1.1 (Last Update: 2025-08-19): Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC...

Title

SSA-201595 V1.1 (Last Update: 2025-08-19): Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager

Published

Aug. 19, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-201595.html

Summary

Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege ...

18.08.2025

SSA-711309 V2.4 (Last Update: 2025-08-18): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products

Title

SSA-711309 V2.4 (Last Update: 2025-08-18): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products

Published

Aug. 18, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-711309.html

Summary

The OPC UA implementations (ANSI C and C++) as used in several SIMATIC products contain a denial of service vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate. Siemens has released new versions for several affected products and ...

Rockwell Automation ArmorBlock 5000 I/O - Webserver

Title

Rockwell Automation ArmorBlock 5000 I/O - Webserver

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-27

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ArmorBlock 5000 I/O Vulnerabilities: Incorrect Authorization, Improper Authentication 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to predict session numbers or perform privileged actions. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

Siemens SIMOTION SCOUT, SIMOTION SCOUT TIA, and SINAMICS STARTER

Title

Siemens SIMOTION SCOUT, SIMOTION SCOUT TIA, and SINAMICS STARTER

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-18

Summary

Siemens Web Installer

Title

Siemens Web Installer

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-22

Summary

Rockwell FactoryTalk Linx

Title

Rockwell FactoryTalk Linx

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-24

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Rockwell Equipment: FactoryTalk Linx Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to to create, update, and delete FTLinx drivers. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Rockwell ...

Siemens SIMATIC RTLS Locating Manager

Title

Siemens SIMATIC RTLS Locating Manager

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-01

Summary

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-21

Siemens BFCClient

Title

Siemens BFCClient

Published

Aug. 14, 2025, 2 p.m.

URL

Summary

Rockwell Automation FactoryTalk Action Manager

Title

Rockwell Automation FactoryTalk Action Manager

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-30

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Action Manager Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local unauthenticated attacker to listen to communications and manipulate the device. ...

Rockwell Automation ControlLogix Ethernet Modules

Title

Rockwell Automation ControlLogix Ethernet Modules

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-28

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ControlLogix Ethernet Modules Vulnerability: Initialization of a Resource with an Insecure Default 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote attackers to perform memory dumps, modify memory, and control execution ...

Rockwell Automation FLEX 5000 I/O

Title

Rockwell Automation FLEX 5000 I/O

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-26

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Rockwell Automation Equipment: FLEX 5000 I/O Vulnerabilities: Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could create a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following version of FLEX 5000 I/O ...

Rockwell Automation Micro800

Title

Rockwell Automation Micro800

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-25

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Micro800 Vulnerabilities: Dependency on Vulnerable Third-Party Component, Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in remote code execution or may lead to privilege escalation. 3. TECHNICAL DETAILS ...

Siemens Wibu CodeMeter Runtime

Title

Siemens Wibu CodeMeter Runtime

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-05

Summary

Rockwell Automation FactoryTalk Viewpoint

Title

Rockwell Automation FactoryTalk Viewpoint

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-23

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Viewpoint Vulnerability: Improper Handling of Insufficient Permissions or Privileges 2. RISK EVALUATION Successful exploitation of this vulnerability could result in full privilege escalation. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following version of ...

Siemens Third-Party Components in SINEC OS

Title

Siemens Third-Party Components in SINEC OS

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Summary

Siemens SIPROTEC 4 and SIPROTEC 4 Compact

Title

Siemens SIPROTEC 4 and SIPROTEC 4 Compact

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-12

Summary

Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT

Title

Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-31

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT Vulnerabilities: Improper Input Validation, Improper Handling of Exceptional Conditions 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker causing a denial of service condition. 3. TECHNICAL DETAILS ...

Siemens RUGGEDCOM CROSSBOW Station Access Controller

Title

Siemens RUGGEDCOM CROSSBOW Station Access Controller

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-08

Summary

Siemens SICAM Q100/Q200

Title

Siemens SICAM Q100/Q200

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-16

Summary

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Siemens SINEC OS

Title

Siemens SINEC OS

Published

Aug. 14, 2025, 2 p.m.

URL

Summary

Siemens Opcenter Quality

Title

Siemens Opcenter Quality

Published

Aug. 14, 2025, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-06

Summary

SSA-395458 V1.0: Account Hijacking Vulnerability in Mendix SAML Module

Title

SSA-395458 V1.0: Account Hijacking Vulnerability in Mendix SAML Module

Published

Aug. 14, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-395458.html

Summary

Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.