November 2022
17.11.2022
US CERT (ICS)
Cradlepoint IBR600
Titel
Cradlepoint IBR600
Veröffentlicht
17. November 2022 16:00
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-321-02
Text
16.11.2022
US CERT
AA22-320A: Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
Titel
AA22-320A: Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
Veröffentlicht
16. November 2022 16:04
URL
https://us-cert.cisa.gov/ncas/alerts/aa22-320a
Text
Original release date: November 16, 2022SummaryFrom mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability ...
11.11.2022
US CERT (ICS)
Siemens SINEC Network Management System Logback Component
Titel
Siemens SINEC Network Management System Logback Component
Veröffentlicht
11. November 2022 05:25
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-03
Text
10.11.2022
US CERT (ICS)
Siemens Parasolid
Titel
Siemens Parasolid
Veröffentlicht
10. November 2022 17:35
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-01
Text
10.11.2022
US CERT (ICS)
Siemens Web Server Login Page of Industrial Controllers
Titel
Siemens Web Server Login Page of Industrial Controllers
Veröffentlicht
10. November 2022 17:30
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-02
Text
10.11.2022
US CERT (ICS)
Siemens SINUMERIK ONE and SINUMERIK MC
Titel
Siemens SINUMERIK ONE and SINUMERIK MC
Veröffentlicht
10. November 2022 17:20
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-04
Text
10.11.2022
US CERT (ICS)
Siemens QMS Automotive
Titel
Siemens QMS Automotive
Veröffentlicht
10. November 2022 17:10
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-06
Text
10.11.2022
US CERT (ICS)
Omron NJ/NX-series Machine Automation Controllers
Titel
Omron NJ/NX-series Machine Automation Controllers
Veröffentlicht
10. November 2022 17:05
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-07
Text
10.11.2022
US CERT (ICS)
Omron NJNX-series
Titel
Omron NJNX-series
Veröffentlicht
10. November 2022 17:00
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-08
Text
10.11.2022
US CERT (ICS)
Siemens Teamcenter Visualization and JT2Go
Titel
Siemens Teamcenter Visualization and JT2Go
Veröffentlicht
10. November 2022 16:55
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-09
Text
08.11.2022
SIEMENS CERT
SSA-362164 V1.2 (Last Update: 2022-11-08): Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS
Titel
SSA-362164 V1.2 (Last Update: 2022-11-08): Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf
Text
The networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) use Initial Sequence Numbers for TCP-Sessions that are predictable. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
08.11.2022
SIEMENS CERT
SSA-120378 V1.0: Multiple File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Titel
SSA-120378 V1.0: Multiple File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
Text
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious TIF, CGM or PDF files. If a user is tricked to open a malicious TIF, CGM or PDF file with the affected products, this could lead the application to ...
08.11.2022
SIEMENS CERT
SSA-501891 V1.1 (Last Update: 2022-11-08): Cross-Site Scripting Vulnerability in SCALANCE X-200 and X-200IRT Families
Titel
SSA-501891 V1.1 (Last Update: 2022-11-08): Cross-Site Scripting Vulnerability in SCALANCE X-200 and X-200IRT Families
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-501891.pdf
Text
There is a cross-site scripting vulnerability that affects the SCALANCE switches. This vulnerability if used by a threat actor could result in the stealing of session cookies and session hijacking. Siemens has released updates for the affected products and recommends to update to the latest versions.
08.11.2022
SIEMENS CERT
SSA-478960 V1.0: Missing CSRF Protection in the Web Server Login Page of Industrial Controllers
Titel
SSA-478960 V1.0: Missing CSRF Protection in the Web Server Login Page of Industrial Controllers
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-478960.pdf
Text
The web server login page of affected products does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.. Siemens has released updates for several affected products and recommends to update to the latest versions. ...
08.11.2022
SIEMENS CERT
SSA-400332 V1.1 (Last Update: 2022-11-08): Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Ques...
Titel
SSA-400332 V1.1 (Last Update: 2022-11-08): Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Questa and ModelSim
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-400332.pdf
Text
A security research [1] identified weaknesses in the IEEE 1735 recommended practice for encryption of Design IP, which could allow a sophisticated attacker access to unencrypted Design IP data in IEEE 1735-compliant products. This advisory addresses the specific details for the affected Siemens software products: Questa and ModelSim simulators. Siemens ...
08.11.2022
SIEMENS CERT
SSA-506569 V1.0: Multiple Vulnerabilities in SCALANCE W1750D
Titel
SSA-506569 V1.0: Multiple Vulnerabilities in SCALANCE W1750D
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
Text
The SCALANCE W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to denial of service, unauthenticated remote code execution or stored XSS. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not ...
08.11.2022
SIEMENS CERT
SSA-459643 V1.1 (Last Update: 2022-11-08): Denial of Service Vulnerability in RUGGEDCOM ROS before V5.6.0
Titel
SSA-459643 V1.1 (Last Update: 2022-11-08): Denial of Service Vulnerability in RUGGEDCOM ROS before V5.6.0
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-459643.pdf
Text
RUGGEDCOM ROS-based devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP connections. The web server recovers by itself once the attack ends. Siemens ...
08.11.2022
SIEMENS CERT
SSA-587547 V1.0: Unencrypted Storage of User Credentials in QMS Automotive
Titel
SSA-587547 V1.0: Unencrypted Storage of User Credentials in QMS Automotive
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-587547.pdf
Text
QMS Automotive contains a vulnerability that stores user credentials in plantext within the user database. This could allow an attacker to read credentials from memory. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.
08.11.2022
SIEMENS CERT
SSA-371761 V1.0: Arbitrary Code Execution Vulnerability in the Logback Component of SINEC NMS before V1.0.3
Titel
SSA-371761 V1.0: Arbitrary Code Execution Vulnerability in the Logback Component of SINEC NMS before V1.0.3
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf
Text
SINEC NMS versions before V1.0.3 are affected by a vulnerability in the logback component (CVE-2021-42550) that could allow attackers with write access to the logback configuration file to execute arbitrary code on the system. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
08.11.2022
SIEMENS CERT
SSA-570294 V1.0: Multiple Vulnerabilities in SICAM Q100 Before V2.50
Titel
SSA-570294 V1.0: Multiple Vulnerabilities in SICAM Q100 Before V2.50
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf
Text
SICAM Q100 devices contain multiple vulnerabilities that could allow an attacker to take over the session of a logged in user or to inject custom code. Siemens has released updates for the affected products and recommends to update to the latest versions.
08.11.2022
SIEMENS CERT
SSA-568428 V1.0: Weak Key Protection Vulnerability in SINUMERIK ONE and SINUMERIK MC
Titel
SSA-568428 V1.0: Weak Key Protection Vulnerability in SINUMERIK ONE and SINUMERIK MC
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-568428.pdf
Text
SINUMERIK ONE and SINUMERIK MC products are affected by a weak key protection vulnerability in the integrated S7-1500 CPU. The weak key protection vulnerability in the integrated S7-1500 CPU is documented in more detail in SSA-568427 [1]. Siemens is preparing updates and recommends specific countermeasures for products where updates are ...
08.11.2022
SIEMENS CERT
SSA-552702 V1.1 (Last Update: 2022-11-08): Privilege Escalation Vulnerability in the Web Interface of SCALANCE and RUGGEDCOM Pr...
Titel
SSA-552702 V1.1 (Last Update: 2022-11-08): Privilege Escalation Vulnerability in the Web Interface of SCALANCE and RUGGEDCOM Products
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-552702.pdf
Text
The products listed below do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific ...
08.11.2022
SIEMENS CERT
SSA-853037 V1.0: File Parsing Vulnerabilities in Parasolid
Titel
SSA-853037 V1.0: File Parsing Vulnerabilities in Parasolid
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-853037.pdf
Text
Parasolid is affected by out of bounds read/write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of ...
08.11.2022
SIEMENS CERT
SSA-787941 V1.0: Denial of Service Vulnerability in RUGGEDCOM ROS V4
Titel
SSA-787941 V1.0: Denial of Service Vulnerability in RUGGEDCOM ROS V4
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-787941.pdf
Text
RUGGEDCOM ROS-based V4 devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP connections. The web server recovers by itself once the attack ends. ...
08.11.2022
SIEMENS CERT
SSA-764417 V1.5 (Last Update: 2022-11-08): Weak Encryption Vulnerability in RUGGEDCOM ROS Devices
Titel
SSA-764417 V1.5 (Last Update: 2022-11-08): Weak Encryption Vulnerability in RUGGEDCOM ROS Devices
Veröffentlicht
8. November 2022 01:00
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-764417.pdf
Text
The SSH server on RUGGEDCOM ROS devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device. Siemens is preparing updates and recommends specific countermeasures ...

Letzte Updates

BOSCH PSIRT
15.01.2025
SIEMENS CERT
17.04.2025
US CERT
01.04.2025
US CERT (ICS)
17.04.2025

Nach Quelle

Archiv

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds