Bulletins | CERT@VDE

…
3
4
5 (current)
6
7
…

August 2025

12.08.2025

SIEMENS CERT

SSA-331739 V1.0: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting Siemens Products

Titel

SSA-331739 V1.0: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting Siemens Products

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-331739.html

Text

WIBU Systems published information about a privilege escalation vulnerability under a certain circumstances and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products. Siemens has released new versions for affected products and recommends to update to the latest versions. Siemens ...

12.08.2025

SIEMENS CERT

SSA-794185 V1.1 (Last Update: 2025-08-12): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC,...

Titel

SSA-794185 V1.1 (Last Update: 2025-08-12): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-794185.html

Text

This advisory documents the impact of CVE-2024-3596 (also dubbed “Blastradius”), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in ...

12.08.2025

SIEMENS CERT

SSA-353002 V1.2 (Last Update: 2025-08-12): Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG ...

Titel

SSA-353002 V1.2 (Last Update: 2025-08-12): Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-353002.html

Text

SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG Family is affected by multiple vulnerabilities. CVE-2023-44318 and CVE-2023-44321 were previously published as part of SSA-699386. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.

12.08.2025

SIEMENS CERT

SSA-914892 V1.1 (Last Update: 2025-08-12): Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime

Titel

SSA-914892 V1.1 (Last Update: 2025-08-12): Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-914892.html

Text

The basic authentication mechanism of Mendix Runtime contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are ...

12.08.2025

SIEMENS CERT

SSA-400089 V1.0: Denial of Service Vulnerability in SIPROTEC 4 and SIPROTEC 4 Compact

Titel

SSA-400089 V1.0: Denial of Service Vulnerability in SIPROTEC 4 and SIPROTEC 4 Compact

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-400089.html

Text

SIPROTEC 4 and SIPROTEC 4 Compact devices contain a vulnerability that could allow an unauthenticated remote attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures ...

12.08.2025

SIEMENS CERT

SSA-186293 V1.0: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER

Titel

SSA-186293 V1.0: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-186293.html

Text

SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER are affected by an XXE injection vulnerability that could allow an attacker to access arbitrary application files. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends ...

12.08.2025

SIEMENS CERT

SSA-908185 V1.2 (Last Update: 2025-08-12): Mirror Port Isolation Vulnerability in RUGGEDCOM ROS Devices

Titel

SSA-908185 V1.2 (Last Update: 2025-08-12): Mirror Port Isolation Vulnerability in RUGGEDCOM ROS Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-908185.html

Text

A vulnerability was identified in RUGGEDCOM ROS devices with mirror port enabled, that could allow an attacker to inject information into the network via the mirror port. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products ...

12.08.2025

SIEMENS CERT

SSA-856721 V1.3 (Last Update: 2025-08-12): Vulnerability in RUGGEDCOM Discovery Protocol (RCDP) of Industrial Communication Dev...

Titel

SSA-856721 V1.3 (Last Update: 2025-08-12): Vulnerability in RUGGEDCOM Discovery Protocol (RCDP) of Industrial Communication Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-856721.html

Text

The RUGGEDCOM RCDP protocol is not properly configured after commissioning of RUGGEDCOM ROS based devices and some SCALANCE X switch models and could allow unauthenticated remote users to perform administrative operations. An attacker must be in the same adjacent network and the RCDP daemon must be enabled in order to ...

12.08.2025

SIEMENS CERT

SSA-978177 V1.0: Vulnerability in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices

Titel

SSA-978177 V1.0: Vulnerability in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-978177.html

Text

Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available.

12.08.2025

SIEMENS CERT

SSA-994087 V1.0: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Before V5.7

Titel

SSA-994087 V1.0: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Before V5.7

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-994087.html

Text

RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code or to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the ...

12.08.2025

SIEMENS CERT

SSA-177847 V1.0: Improper VNC Password Check Vulnerability in SINUMERIK Controllers

Titel

SSA-177847 V1.0: Improper VNC Password Check Vulnerability in SINUMERIK Controllers

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-177847.html

Text

Siemens SINUMERIK Controllers are affected by an improper VNC password check vulnerability. Siemens has released new versions for the affected products and recommends to update to the latest versions.

12.08.2025

SIEMENS CERT

SSA-398330 V2.7 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...

Titel

SSA-398330 V2.7 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Text

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update ...

12.08.2025

SIEMENS CERT

SSA-392859 V1.1 (Last Update: 2025-08-12): Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before...

Titel

SSA-392859 V1.1 (Last Update: 2025-08-12): Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-392859.html

Text

Affected products contain a local arbitrary code execution vulnerability that could allow an attacker to perform actions against the operation system of that environment. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures ...

12.08.2025

SIEMENS CERT

SSA-864900 V1.2 (Last Update: 2025-08-12): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Titel

SSA-864900 V1.2 (Last Update: 2025-08-12): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-864900.html

Text

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

12.08.2025

SIEMENS CERT

SSA-256353 V1.6 (Last Update: 2025-08-12): Third-Party Component Vulnerabilities in RUGGEDCOM ROS

Titel

SSA-256353 V1.6 (Last Update: 2025-08-12): Third-Party Component Vulnerabilities in RUGGEDCOM ROS

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-256353.html

Text

Multiple vulnerabilities affect various third-party components of the RUGGEDCOM Operating System (ROS). If exploited, an attacker could cause a denial-of-service, act as a man-in-the-middle or retrieval of sensitive information or gain privileged functions. Siemens has released new versions for several affected products and recommends to update to the latest versions. ...

12.08.2025

SIEMENS CERT

SSA-282044 V1.0: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery

Titel

SSA-282044 V1.0: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-282044.html

Text

The installers used to install several Siemens products are affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected installer component. This vulnerability poses a risk only during setup and installation phase of the ...

12.08.2025

SIEMENS CERT

SSA-094954 V1.0: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II

Titel

SSA-094954 V1.0: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-094954.html

Text

RUGGEDCOM ROX II devices do not properly limit access through their Built-In-Self-Test (BIST) mode. This could allow a local attacker to bypass authentication and access a root shell on the device. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

12.08.2025

SIEMENS CERT

SSA-097435 V1.9 (Last Update: 2025-08-12): Usernames Disclosure Vulnerability in Mendix Runtime

Titel

SSA-097435 V1.9 (Last Update: 2025-08-12): Usernames Disclosure Vulnerability in Mendix Runtime

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-097435.html

Text

Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.

12.08.2025

SIEMENS CERT

SSA-170375 V1.1 (Last Update: 2025-08-12): Multiple Vulnerabilities in RUGGEDCOM ROS Before V5.9

Titel

SSA-170375 V1.1 (Last Update: 2025-08-12): Multiple Vulnerabilities in RUGGEDCOM ROS Before V5.9

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-170375.html

Text

Multiple vulnerabilities affect the RUGGEDCOM Operating System (ROS). The common denominator to all vulnerabilities is the leak of confidential information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet ...

12.08.2025

SIEMENS CERT

SSA-894058 V1.0: Improper Bandwidth Limitation of Network Packets Over Local USB Port Vulnerability in SIPROTEC 5

Titel

SSA-894058 V1.0: Improper Bandwidth Limitation of Network Packets Over Local USB Port Vulnerability in SIPROTEC 5

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-894058.html

Text

Affected SIPROTEC 5 devices do not properly limit the bandwidth for incoming network packets over their local USB port. This could allow an attacker with physical access to send specially crafted packets with high bandwidth to the affected devices thus forcing them to exhaust their memory and stop responding to ...

12.08.2025

SIEMENS CERT

SSA-082556 V1.1 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...

Titel

SSA-082556 V1.1 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Text

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available.

12.08.2025

SIEMENS CERT

SSA-028723 V1.0: Multiple OpenSSL Vulnerabilities in BFCClient Before V2.17

Titel

SSA-028723 V1.0: Multiple OpenSSL Vulnerabilities in BFCClient Before V2.17

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-028723.html

Text

Siemens BFCClient contains multiple vulnerabilities in the integrated OpenSSL component that could allow an attacker to read memory contents, to change the application behaviour or to create a denial of service condition. Siemens has released a new version for BFCClient and recommends to update to the latest version.

07.08.2025

US CERT (ICS)

EG4 Electronics EG4 Inverters

Titel

EG4 Electronics EG4 Inverters

Veröffentlicht

7. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: EG4 Electronics Equipment: EG4 Inverters Vulnerabilities: Cleartext Transmission of Sensitive Information, Download of Code Without Integrity Check, Observable Discrepancy, Improper Restriction of Excessive Authentication Attempts 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...

07.08.2025

US CERT (ICS)

Packet Power EMX and EG

Titel

Packet Power EMX and EG

Veröffentlicht

7. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Packet Power Equipment: EMX, EG Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full access to the device without authentication. 3. TECHNICAL DETAILS 3.1 ...

07.08.2025

US CERT (ICS)

Dreame Technology iOS and Android Mobile Applications

Titel

Dreame Technology iOS and Android Mobile Applications

Veröffentlicht

7. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Dreame Technology Equipment: Dreamehome and MOVAhome mobile applications Vulnerability: Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could result in unauthorized information disclosure. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of the ...

…
3
4
5 (current)
6
7
…

Letzte Updates

Nach Quelle

Archiv

2025

2024

2023

2022

2021

2020

2019

2018

2017

Feeds