Januar 2025
14.01.2025
SIEMENS CERT
SSA-446448 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Titel
SSA-446448 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-446448.html
Text
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, contains a vulnerability that could allow an attacker to cause a denial of service condition on affected industrial products. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific ...
14.01.2025
SIEMENS CERT
SSA-404759 V1.0: Information Disclosure Vulnerability in Siveillance Video Camera Drivers
Titel
SSA-404759 V1.0: Information Disclosure Vulnerability in Siveillance Video Camera Drivers
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-404759.html
Text
Several HikVision camera device drivers in the Siveillance Video Device Pack store camera credentials in their log file when authentication fails. This could allow a local attacker to read camera credentials stored in the Recording Server under specific conditions. Siemens has released an update of the Device Pack and recommends ...
14.01.2025
SIEMENS CERT
SSA-398330 V2.2 (Last Update: 2025-01-14): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...
Titel
SSA-398330 V2.2 (Last Update: 2025-01-14): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Text
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not ...
14.01.2025
SIEMENS CERT
SSA-194557 V1.0: Improper Limitation of Filesystem Access through Web Server Vulnerability in SIPROTEC 5
Titel
SSA-194557 V1.0: Improper Limitation of Filesystem Access through Web Server Vulnerability in SIPROTEC 5
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-194557.html
Text
Affected SIPROTEC 5 devices do not properly limit the access of the web server to the filesystem. This could allow an authenticated remote attacker to read arbitrary files or the entire filesystem of the device. Siemens has released new versions for several affected products and recommends to update to the ...
14.01.2025
SIEMENS CERT
SSA-097435 V1.8 (Last Update: 2025-01-14): Usernames Disclosure Vulnerability in Mendix Runtime
Titel
SSA-097435 V1.8 (Last Update: 2025-01-14): Usernames Disclosure Vulnerability in Mendix Runtime
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-097435.html
Text
Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.
14.01.2025
SIEMENS CERT
SSA-999588 V1.7 (Last Update: 2025-01-14): Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2
Titel
SSA-999588 V1.7 (Last Update: 2025-01-14): Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2
Veröffentlicht
14. Januar 2025 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-999588.html
Text
Siemens User Management Component (UMC) before V2.11.2 is affected by multiple vulnerabilities where the most severe could lead to a restart of the UMC server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes ...
10.01.2025
US CERT (ICS)
Delta Electronics DRASimuCAD
Titel
Delta Electronics DRASimuCAD
Veröffentlicht
10. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-03-0
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DRASimuCAD Vulnerabilities: Out-of-bounds Write, Type Confusion 2. RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device or potentially allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ...
10.01.2025
US CERT (ICS)
Delta Electronics DRASimuCAD (Update A)
Titel
Delta Electronics DRASimuCAD (Update A)
Veröffentlicht
10. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-03
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DRASimuCAD Vulnerabilities: Out-of-bounds Write, Type Confusion 2. RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device or potentially allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ...
10.01.2025
US CERT (ICS)
Schneider Electric Harmony HMI and Pro-face HMI Products
Titel
Schneider Electric Harmony HMI and Pro-face HMI Products
Veröffentlicht
10. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Harmony HMI and Pro-face HMI Products Vulnerability: Use of Unmaintained Third-Party Components 2. RISK EVALUATION Successful exploitation of this vulnerability could cause complete control of the device when an authenticated user installs malicious ...
10.01.2025
US CERT (ICS)
Schneider Electric PowerChute Serial Shutdown
Titel
Schneider Electric PowerChute Serial Shutdown
Veröffentlicht
10. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: PowerChute Serial Shutdown Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial of access to the web interface when someone on the local network repeatedly requests the ...
07.01.2025
US CERT (ICS)
Nedap Librix Ecoreader
Titel
Nedap Librix Ecoreader
Veröffentlicht
7. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Nedap Librix Equipment: Ecoreader Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could result in remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Ecoreader are ...
07.01.2025
US CERT (ICS)
ABB ASPECT-Enterprise, NEXUS, and MATRIX Series Products
Titel
ABB ASPECT-Enterprise, NEXUS, and MATRIX Series Products
Veröffentlicht
7. Januar 2025 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: ASPECT-Enterprise, NEXUS, and MATRIX series Vulnerabilities: Files or Directories Accessible to External Parties, Improper Validation of Specified Type of Input, Cleartext Transmission of Sensitive Information, Cross-site Scripting, Server-Side Request Forgery (SSRF), Improper Neutralization of ...
Dezember 2024
19.12.2024
US CERT (ICS)
Hitachi Energy SDM600
Titel
Hitachi Energy SDM600
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable from adjacent network Vendor: Hitachi Energy Equipment: SDM600 Vulnerabilities: Origin Validation Error, Incorrect Authorization 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges and access sensitive information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Hitachi ...
19.12.2024
US CERT (ICS)
Siemens User Management Component
Titel
Siemens User Management Component
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-04
Text
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS ...
19.12.2024
US CERT (ICS)
Hitachi Energy RTU500 series CMU
Titel
Hitachi Energy RTU500 series CMU
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Hitachi Energy Equipment: RTU500 series CMU Vulnerability: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 ...
19.12.2024
US CERT (ICS)
Delta Electronics DTM Soft
Titel
Delta Electronics DTM Soft
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-03
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DTM Soft Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Delta Electronics products ...
19.12.2024
US CERT (ICS)
Schneider Electric Accutech Manager
Titel
Schneider Electric Accutech Manager
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-06
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Accutech Manager Vulnerability: Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation could allow an attacker to cause a crash of the Accutech Manager when receiving a specially crafted request over port 2536/TCP. 3. ...
19.12.2024
US CERT (ICS)
Tibbo AggreGate Network Manager
Titel
Tibbo AggreGate Network Manager
Veröffentlicht
19. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-05
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Tibbo Equipment: AggreGate Network Manager Vulnerability: Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve code execution on the affected device. 3. TECHNICAL DETAILS ...
17.12.2024
US CERT (ICS)
Rockwell Automation PowerMonitor 1000 Remote
Titel
Rockwell Automation PowerMonitor 1000 Remote
Veröffentlicht
17. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-03
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: PowerMonitor 1000 Remote Vulnerabilities: Unprotected Alternate Channel, Heap-based Buffer Overflow, Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to perform edit operations, create admin users, perform ...
17.12.2024
US CERT (ICS)
Hitachi Energy TropOS Devices Series 1400/2400/6400
Titel
Hitachi Energy TropOS Devices Series 1400/2400/6400
Veröffentlicht
17. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: TropOS Devices Series 1400/2400/6400 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following ...
17.12.2024
US CERT (ICS)
Schneider Electric Modicon
Titel
Schneider Electric Modicon
Veröffentlicht
17. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-04
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Modicon M241 / M251 / M258 / LMC058 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to a denial-of-service and a loss of confidentiality and integrity in ...
17.12.2024
US CERT (ICS)
ThreatQuotient ThreatQ Platform
Titel
ThreatQuotient ThreatQ Platform
Veröffentlicht
17. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThreatQuotient Inc. Equipment: ThreatQ Platform Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ThreatQuotient ...
16.12.2024
SIEMENS CERT
SSA-928984 V1.0: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)
Titel
SSA-928984 V1.0: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)
Veröffentlicht
16. Dezember 2024 01:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-928984.html
Text
Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for ...
12.12.2024
US CERT (ICS)
Siemens Teamcenter Visualization
Titel
Siemens Teamcenter Visualization
Veröffentlicht
12. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-09
Text
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS ...
12.12.2024
US CERT (ICS)
Siemens Solid Edge SE2024
Titel
Siemens Solid Edge SE2024
Veröffentlicht
12. Dezember 2024 13:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-07
Text
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS ...

Letzte Updates

BOSCH PSIRT
15.01.2025
SIEMENS CERT
15.01.2025
US CERT
08.11.2024
US CERT (ICS)
16.01.2025

Nach Quelle

Archiv

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds