Bulletins | CERT@VDE

1
2 (current)
3
4
…

September 2025

SSA-534283 V1.0: Insecure File Share Vulnerability in SIMATIC Virtualization as a Service (SIVaaS)

Titel

SSA-534283 V1.0: Insecure File Share Vulnerability in SIMATIC Virtualization as a Service (SIVaaS)

Veröffentlicht

9. September 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-534283.html

Text

SIMATIC Virtualization as a Service (SIVaaS) is affected by a vulnerability which exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization. Siemens recommends to contact technical support to fix the vulnerability.

SSA-027652 V1.0: Privilege Escalation Vulnerability in SINAMICS Drives

Titel

SSA-027652 V1.0: Privilege Escalation Vulnerability in SINAMICS Drives

Veröffentlicht

9. September 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-027652.html

Text

Siemens SINAMICS G220, SINAMICS S210, and SINAMICS S200 contains a privilege escalation vulnerability that could allow users to escalate their privileges. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where ...

SSA-864900 V1.3 (Last Update: 2025-09-09): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Titel

SSA-864900 V1.3 (Last Update: 2025-09-09): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Veröffentlicht

9. September 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-864900.html

Text

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

SSA-712929 V3.0 (Last Update: 2025-09-09): Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Prod...

Titel

SSA-712929 V3.0 (Last Update: 2025-09-09): Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Products

Veröffentlicht

9. September 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-712929.html

Text

A vulnerability in the openSSL component (CVE-2022-0778, [0]) could allow an attacker to create a denial of service condition by providing specially crafted elliptic curve certificates to products that use a vulnerable version of openSSL. Siemens has released new versions for several affected products and recommends to update to the ...

Honeywell OneWireless Wireless Device Manager (WDM)

Titel

Honeywell OneWireless Wireless Device Manager (WDM)

Veröffentlicht

4. September 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-247-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: OneWireless Wireless Device Manager (WDM) Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong Handler ...

Delta Electronics EIP Builder

Titel

Delta Electronics EIP Builder

Veröffentlicht

2. September 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.7 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: EIP Builder Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in disclosure of sensitive information. ...

SunPower PVS6

Titel

SunPower PVS6

Veröffentlicht

2. September 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.4 ATTENTION: Exploitable from an adjacent network/low attack complexity Vendor: SunPower Equipment: PVS6 Vulnerability: Use of Hard-Coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to gain full access to the device, enabling them to replace firmware, modify settings, ...

Fuji Electric FRENIC-Loader 4

Titel

Fuji Electric FRENIC-Loader 4

Veröffentlicht

2. September 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Fuji Electric Equipment: FRENIC-Loader 4 Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Fuji Electric products ...

August 2025

Schneider Electric Saitel DR & Saitel DP Remote Terminal Unit

Titel

Schneider Electric Saitel DR & Saitel DP Remote Terminal Unit

Veröffentlicht

28. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.7 ATTENTION: Low Attack Complexity Vendor: Schneider Electric Equipment: Saitel DR RTU, Saitel DP RTU Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker to escalate privileges, potentially leading to arbitrary code execution. 3. TECHNICAL ...

GE Vernova CIMPLICITY

Titel

GE Vernova CIMPLICITY

Veröffentlicht

28. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.0 ATTENTION: Low attack complexity Vendor: GE Vernova Equipment: CIMPLICITY Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a low-privileged local attacker to escalate privileges. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of GE ...

Schneider Electric Modicon M340 Controller and Communication Modules

Titel

Schneider Electric Modicon M340 Controller and Communication Modules

Veröffentlicht

26. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-238-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Modicon M340 and Communication Modules Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Schneider ...

INVT VT-Designer and HMITool

Titel

INVT VT-Designer and HMITool

Veröffentlicht

26. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-238-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: INVT Equipment: VT-Designer and HMITool Vulnerabilities: Out-of-bounds Write, Access of Resource Using Incompatible Type ('Type Confusion') 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code in the context of the current ...

SSA-707630 V1.1 (Last Update: 2025-08-26): Multiple Vulnerabilities in SIMATIC RTLS Locating Manager Before V3.3

Titel

SSA-707630 V1.1 (Last Update: 2025-08-26): Multiple Vulnerabilities in SIMATIC RTLS Locating Manager Before V3.3

Veröffentlicht

26. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-707630.html

Text

Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version.

Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

Titel

Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

Veröffentlicht

25. August 2025 15:36

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

Text

Executive summary People’s Republic of China (PRC) state-sponsored cyber threat actors are targeting networks globally, including, but not limited to, telecommunications, government, transportation, lodging, and military infrastructure networks. While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and customer edge (CE) ...

Mitsubishi Electric Corporation MELSEC iQ-F Series CPU Module

Titel

Mitsubishi Electric Corporation MELSEC iQ-F Series CPU Module

Veröffentlicht

21. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-233-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Mitsubishi Electric Corporation Equipment: MELSEC iQ-F Series CPU module Vulnerability: Improper Handling of Length Parameter Inconsistency 2. RISK EVALUATION Successful exploitation of this vulnerability could result in a remote attacker being able to delay the processing ...

Mitsubishi Electric Corporation MELSEC iQ-F Series CPU Module (Update A)

Titel

Mitsubishi Electric Corporation MELSEC iQ-F Series CPU Module (Update A)

Veröffentlicht

21. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-233-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Mitsubishi Electric Corporation Equipment: MELSEC iQ-F Series CPU module Vulnerability: Improper Handling of Length Parameter Inconsistency 2. RISK EVALUATION Successful exploitation of this vulnerability could result in a remote attacker being able to delay the processing ...

Siemens Desigo CC Product Family and SENTRON Powermanager

Titel

Siemens Desigo CC Product Family and SENTRON Powermanager

Veröffentlicht

19. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-231-01

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

SSA-201595 V1.1 (Last Update: 2025-08-19): Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC...

Titel

SSA-201595 V1.1 (Last Update: 2025-08-19): Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager

Veröffentlicht

19. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-201595.html

Text

Versions V5.0 through V8 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could allow privilege ...

SSA-711309 V2.4 (Last Update: 2025-08-18): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products

Titel

SSA-711309 V2.4 (Last Update: 2025-08-18): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products

Veröffentlicht

18. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-711309.html

Text

The OPC UA implementations (ANSI C and C++) as used in several SIMATIC products contain a denial of service vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate. Siemens has released new versions for several affected products and ...

Siemens Wibu CodeMeter Runtime

Titel

Siemens Wibu CodeMeter Runtime

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-05

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Siemens SIMATIC RTLS Locating Manager

Titel

Siemens SIMATIC RTLS Locating Manager

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-01

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Siemens SINEC OS

Titel

Siemens SINEC OS

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT

Titel

Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-31

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT Vulnerabilities: Improper Input Validation, Improper Handling of Exceptional Conditions 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker causing a denial of service condition. 3. TECHNICAL DETAILS ...

Siemens BFCClient

Titel

Siemens BFCClient

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-21

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Siemens RUGGEDCOM CROSSBOW Station Access Controller

Titel

Siemens RUGGEDCOM CROSSBOW Station Access Controller

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-08

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

1
2 (current)
3
4
…

Letzte Updates

BOSCH PSIRT

14.08.2025

SIEMENS CERT

09.09.2025

US CERT

25.08.2025

US CERT (ICS)

11.09.2025

Nach Quelle

BOSCH PSIRT (91)
SIEMENS CERT (2155)
US CERT (181)
US CERT (ICS) (1967)

Archiv

2025

September (33)
August (93)
Juli (58)
Juni (52)
Mai (77)
April (68)
März (57)
Februar (59)
Januar (52)

2024

Dezember (57)
November (53)
Oktober (66)
September (69)
August (59)
Juli (63)
Juni (53)
Mai (64)
April (41)
März (45)
Februar (45)
Januar (41)

2023

Dezember (57)
November (58)
Oktober (46)
September (51)
August (62)
Juli (49)
Juni (49)
Mai (52)
April (67)
März (67)
Februar (71)
Januar (60)

2022

Dezember (65)
November (46)
Oktober (61)
September (55)
August (88)
Juli (61)
Juni (91)
Mai (58)
April (83)
März (72)
Februar (70)
Januar (37)

2021

Dezember (73)
November (46)
Oktober (49)
September (73)
August (33)
Juli (33)
Juni (30)
Mai (30)
April (37)
März (46)
Februar (42)
Januar (27)

2020

Dezember (32)
November (19)
Oktober (30)
September (33)
August (26)
Juli (51)
Juni (51)
Mai (26)
April (39)
März (45)
Februar (106)
Januar (35)

2019

Dezember (33)
November (14)
Oktober (37)
September (34)
August (26)
Juli (28)
Juni (22)
Mai (37)
April (28)
März (19)
Februar (36)
Januar (37)

2018

Dezember (36)
November (36)
Oktober (34)
September (22)
August (26)
Juli (18)
Juni (26)
Mai (42)
April (31)
März (37)
Februar (24)
Januar (10)

2017

Dezember (1)
August (1)
Juli (2)
Juni (1)
Mai (1)
April (1)
März (1)

Feeds

RSS / Atom