Bulletins | CERT@VDE

SSA-832273 V1.8 (Last Update: 2025-04-16): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Titel

SSA-832273 V1.8 (Last Update: 2025-04-16): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Veröffentlicht

16. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-832273.html

Text

Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or ...

16.04.2025

SSA-443402 V1.0: Multiple SQL Injection Vulnerabilities in TeleControl Server Basic before V3.1.2.2

Titel

SSA-443402 V1.0: Multiple SQL Injection Vulnerabilities in TeleControl Server Basic before V3.1.2.2

Veröffentlicht

16. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-443402.html

Text

TeleControl Server Basic before V3.1.2.2 contains multiple SQL Injection vulnerabilities that could allow an attacker to read and write to the application’s DB, cause denial of service and execute code in an OS shell with limited “NT AUTHORITY” permissions. Siemens has conducted a root-cause analysis for potential SQL injection vulnerabilities ...

Lantronix Xport (Update A)

Titel

Lantronix Xport (Update A)

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Lantronix Equipment: XPort Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker unauthorized access to the configuration interface and cause disruption to monitoring and operations. 3. TECHNICAL ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08

ABB M2M Gateway

Titel

ABB M2M Gateway

Veröffentlicht

15. April 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: M2M Gateway Vulnerabilities: Integer Overflow or Wraparound, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Unquoted Search Path or Element, Untrusted Search Path, Use After Free, Out-of-bounds Write, Buffer Copy without Checking Size of ...

Mitsubishi Electric Europe B.V. smartRTU

Titel

Mitsubishi Electric Europe B.V. smartRTU

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-09

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Europe B.V. Equipment: smartRTU Vulnerability: Missing Authentication for Critical Function, OS Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to disclose, tamper with, destroy or delete ...

Growatt Cloud Applications

Titel

Growatt Cloud Applications

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Growatt Equipment: Cloud Applications Vulnerabilities: Cross-site Scripting, Authorization Bypass Through User-Controlled Key, Insufficient Type Distinction, External Control of System or Configuration Setting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to compromise ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05

Lantronix Xport

Titel

Lantronix Xport

Veröffentlicht

15. April 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Lantronix Equipment: Xport Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker unauthorized access to the configuration interface and cause disruption to monitoring and operations. 3. TECHNICAL ...

Delta Electronics COMMGR

Titel

Delta Electronics COMMGR

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-07

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: COMMGR Vulnerability: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for an attacker to remotely access the AS3000Simulator family in the COMMGR software ...

Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX

Titel

Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-03

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Siemens Industrial Edge Device Kit

Titel

Siemens Industrial Edge Device Kit

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-02

Text

14.04.2025

SSA-874353 V1.2 (Last Update: 2025-04-14): Entity Enumeration Vulnerability in Mendix Runtime

Titel

SSA-874353 V1.2 (Last Update: 2025-04-14): Entity Enumeration Vulnerability in Mendix Runtime

Veröffentlicht

14. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Text

Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has released new versions for several affected products and recommends to update to the latest ...

Siemens License Server

Titel

Siemens License Server

Veröffentlicht

10. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-01

Text

ABB Arctic Wireless Gateways

Titel

ABB Arctic Wireless Gateways

Veröffentlicht

10. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-09

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: Arctic Wireless Gateways Vulnerabilities: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Improper Privilege Management, Exposure of Sensitive Information to an Unauthorized Actor, Improper Limitation of a Pathname to a Restricted Directory ...

Siemens SENTRON 7KT PAC1260 Data Manager

Titel

Siemens SENTRON 7KT PAC1260 Data Manager

Veröffentlicht

10. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-06

Text

https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-02

Siemens SIDIS Prime

Titel

Siemens SIDIS Prime

Veröffentlicht

10. April 2025 14:00

URL

Text

Siemens Insights Hub Private Cloud

Titel

Siemens Insights Hub Private Cloud

Veröffentlicht

10. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-05

Text

Siemens Industrial Edge Devices

Titel

Siemens Industrial Edge Devices

Veröffentlicht

10. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-04

Text

SSA-874353 V1.1 (Last Update: 2025-04-10): Entity Enumeration Vulnerability in Mendix Runtime

Titel

SSA-874353 V1.1 (Last Update: 2025-04-10): Entity Enumeration Vulnerability in Mendix Runtime

Veröffentlicht

10. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Text

SSA-672923 V1.0: Out of Bounds Write Vulnerability in Solid Edge

Titel

SSA-672923 V1.0: Out of Bounds Write Vulnerability in Solid Edge

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-672923.html

Text

Solid Edge is affected by an out of bounds write vulnerability that could be triggered when the application is parsing X_T data or a specially crafted file in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability ...

SSA-686975 V1.6 (Last Update: 2025-04-08): IPU 2022.3 Vulnerabilities in Siemens Industrial Products using Intel CPUs

Titel

SSA-686975 V1.6 (Last Update: 2025-04-08): IPU 2022.3 Vulnerabilities in Siemens Industrial Products using Intel CPUs

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-686975.html

Text

Intel has published information on vulnerabilities in Intel products in November 2022. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update (“2022.3 IPU – BIOS Advisory” Intel-SA-00688). Siemens has released new versions for several affected products and ...

SSA-634640 V1.0: Weak Authentication Vulnerability in Siemens Industrial Edge Devices

Titel

SSA-634640 V1.0: Weak Authentication Vulnerability in Siemens Industrial Edge Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-634640.html

Text

Siemens Industrial Edge Devices contain a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific ...

SSA-187636 V1.0: Multiple Vulnerabilities in SENTRON 7KT PAC1260 Data Manager

Titel

SSA-187636 V1.0: Multiple Vulnerabilities in SENTRON 7KT PAC1260 Data Manager

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Text

SENTRON 7KT PAC1260 Data Manager is affected by multiple vulnerabilities as listed below. Software fixes can no longer be provided for The SENTRON 7KT PAC1260 Data Manager. This advisory documents the known open vulnerabilities. To fix the vulnerabilities, Siemens recommends to replace the device by the new SENTRON 7KT PAC1261 ...

SSA-525431 V1.0: Privilege Escalation Vulnerabilities in Siemens License Server Before V4.3

Titel

SSA-525431 V1.0: Privilege Escalation Vulnerabilities in Siemens License Server Before V4.3

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-525431.html

Text

Siemens License Server before V4.3 contains various vulnerabilities that could allow a low-privileged local user to escalate privileges or perform arbitrary code execution. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the latest version.