Januar 2025
14.01.2025
SIEMENS CERT
SSA-593272 V2.3 (Last Update: 2025-01-14): SegmentSmack in Interniche IP-Stack based Industrial Devices
Titel
SSA-593272 V2.3 (Last Update: 2025-01-14): SegmentSmack in Interniche IP-Stack based Industrial Devices
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-593272.html
Text
A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released new versions for ...
14.01.2025
SIEMENS CERT
SSA-482757 V1.5 (Last Update: 2025-01-14): Missing Immutable Root of Trust in S7-1500 CPU devices
Titel
SSA-482757 V1.5 (Last Update: 2025-01-14): Missing Immutable Root of Trust in S7-1500 CPU devices
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-482757.html
Text
Affected models of the S7-1500 CPU product family do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to replace the boot ...
14.01.2025
SIEMENS CERT
SSA-629254 V1.3 (Last Update: 2025-01-14): Remote Code Execution Vulnerability in SIMATIC SCADA and PCS 7 systems
Titel
SSA-629254 V1.3 (Last Update: 2025-01-14): Remote Code Execution Vulnerability in SIMATIC SCADA and PCS 7 systems
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-629254.html
Text
The products listed below contain a remote code execution vulnerability that could allow an authenticated remote attacker to execute arbitrary code with high privileges. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, ...
14.01.2025
SIEMENS CERT
SSA-446448 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Titel
SSA-446448 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-446448.html
Text
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, contains a vulnerability that could allow an attacker to cause a denial of service condition on affected industrial products. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific ...
14.01.2025
SIEMENS CERT
SSA-097435 V1.8 (Last Update: 2025-01-14): Usernames Disclosure Vulnerability in Mendix Runtime
Titel
SSA-097435 V1.8 (Last Update: 2025-01-14): Usernames Disclosure Vulnerability in Mendix Runtime
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-097435.html
Text
Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.
14.01.2025
SIEMENS CERT
SSA-711309 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products
Titel
SSA-711309 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-711309.html
Text
The OPC UA implementations (ANSI C and C++) as used in several SIMATIC products contain a denial of service vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate. Siemens has released new versions for several affected products and ...
14.01.2025
SIEMENS CERT
SSA-416411 V1.0: Cross-Site Scripting Vulnerability in Industrial Edge Management
Titel
SSA-416411 V1.0: Cross-Site Scripting Vulnerability in Industrial Edge Management
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-416411.html
Text
Industrial Edge Management is affected by a reflected cross-site scripting (XSS) vulnerability that could allow an attacker to extract sensitive information by tricking users into accessing a malicious link. Siemens recommends countermeasures for products where fixes are not, or not yet available.
14.01.2025
SIEMENS CERT
SSA-690517 V1.2 (Last Update: 2025-01-14): Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11ax Family
Titel
SSA-690517 V1.2 (Last Update: 2025-01-14): Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11ax Family
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-690517.html
Text
SCALANCE W-700 IEEE 802.11ax family devices are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11ax family and recommends to update to the latest version. Siemens recommends countermeasures for vulnerabilities where fixes are not, or not yet available.
14.01.2025
SIEMENS CERT
SSA-717113 V1.0: Cross-Site Request Forgery (CSRF) Vulnerability in SIMATIC S7-1200 CPUs before V4.7
Titel
SSA-717113 V1.0: Cross-Site Request Forgery (CSRF) Vulnerability in SIMATIC S7-1200 CPUs before V4.7
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-717113.html
Text
The web interface of SIMATIC S7-1200 CPUs before V4.7 is affected by a cross-site request forgery (CSRF) vulnerability. Siemens has released new versions for the affected products and recommends to update to the latest versions.
10.01.2025
US CERT (ICS)
Delta Electronics DRASimuCAD (Update A)
Titel
Delta Electronics DRASimuCAD (Update A)
Veröffentlicht
10. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-03
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DRASimuCAD Vulnerabilities: Out-of-bounds Write, Type Confusion 2. RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device or potentially allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ...
10.01.2025
US CERT (ICS)
Delta Electronics DRASimuCAD
Titel
Delta Electronics DRASimuCAD
Veröffentlicht
10. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-03-0
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DRASimuCAD Vulnerabilities: Out-of-bounds Write, Type Confusion 2. RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device or potentially allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ...
10.01.2025
US CERT (ICS)
Schneider Electric Harmony HMI and Pro-face HMI Products
Titel
Schneider Electric Harmony HMI and Pro-face HMI Products
Veröffentlicht
10. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Harmony HMI and Pro-face HMI Products Vulnerability: Use of Unmaintained Third-Party Components 2. RISK EVALUATION Successful exploitation of this vulnerability could cause complete control of the device when an authenticated user installs malicious ...
10.01.2025
US CERT (ICS)
Schneider Electric PowerChute Serial Shutdown
Titel
Schneider Electric PowerChute Serial Shutdown
Veröffentlicht
10. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: PowerChute Serial Shutdown Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial of access to the web interface when someone on the local network repeatedly requests the ...
07.01.2025
US CERT (ICS)
ABB ASPECT-Enterprise, NEXUS, and MATRIX Series Products
Titel
ABB ASPECT-Enterprise, NEXUS, and MATRIX Series Products
Veröffentlicht
7. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: ASPECT-Enterprise, NEXUS, and MATRIX series Vulnerabilities: Files or Directories Accessible to External Parties, Improper Validation of Specified Type of Input, Cleartext Transmission of Sensitive Information, Cross-site Scripting, Server-Side Request Forgery (SSRF), Improper Neutralization of ...
07.01.2025
US CERT (ICS)
Nedap Librix Ecoreader
Titel
Nedap Librix Ecoreader
Veröffentlicht
7. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Nedap Librix Equipment: Ecoreader Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could result in remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Ecoreader are ...
Dezember 2024
19.12.2024
US CERT (ICS)
Hitachi Energy RTU500 series CMU
Titel
Hitachi Energy RTU500 series CMU
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Hitachi Energy Equipment: RTU500 series CMU Vulnerability: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 ...
19.12.2024
US CERT (ICS)
Tibbo AggreGate Network Manager
Titel
Tibbo AggreGate Network Manager
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-05
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Tibbo Equipment: AggreGate Network Manager Vulnerability: Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve code execution on the affected device. 3. TECHNICAL DETAILS ...
19.12.2024
US CERT (ICS)
Schneider Electric Accutech Manager
Titel
Schneider Electric Accutech Manager
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-06
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Accutech Manager Vulnerability: Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation could allow an attacker to cause a crash of the Accutech Manager when receiving a specially crafted request over port 2536/TCP. 3. ...
19.12.2024
US CERT (ICS)
Delta Electronics DTM Soft
Titel
Delta Electronics DTM Soft
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-03
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DTM Soft Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Delta Electronics products ...
19.12.2024
US CERT (ICS)
Hitachi Energy SDM600
Titel
Hitachi Energy SDM600
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable from adjacent network Vendor: Hitachi Energy Equipment: SDM600 Vulnerabilities: Origin Validation Error, Incorrect Authorization 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges and access sensitive information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Hitachi ...
19.12.2024
US CERT (ICS)
Siemens User Management Component
Titel
Siemens User Management Component
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-04
Text
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS ...
17.12.2024
US CERT (ICS)
Rockwell Automation PowerMonitor 1000 Remote
Titel
Rockwell Automation PowerMonitor 1000 Remote
Veröffentlicht
17. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-03
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: PowerMonitor 1000 Remote Vulnerabilities: Unprotected Alternate Channel, Heap-based Buffer Overflow, Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to perform edit operations, create admin users, perform ...
17.12.2024
US CERT (ICS)
Schneider Electric Modicon
Titel
Schneider Electric Modicon
Veröffentlicht
17. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-04
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Modicon M241 / M251 / M258 / LMC058 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to a denial-of-service and a loss of confidentiality and integrity in ...
17.12.2024
US CERT (ICS)
Hitachi Energy TropOS Devices Series 1400/2400/6400
Titel
Hitachi Energy TropOS Devices Series 1400/2400/6400
Veröffentlicht
17. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: TropOS Devices Series 1400/2400/6400 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following ...
17.12.2024
US CERT (ICS)
ThreatQuotient ThreatQ Platform
Titel
ThreatQuotient ThreatQ Platform
Veröffentlicht
17. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThreatQuotient Inc. Equipment: ThreatQ Platform Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ThreatQuotient ...

Letzte Updates

BOSCH PSIRT
25.04.2025
SIEMENS CERT
23.05.2025
US CERT
20.05.2025
US CERT (ICS)
05.06.2025

Nach Quelle

Archiv

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds