Juni 2025
10.06.2025
SIEMENS CERT
SSA-354569 V1.5 (Last Update: 2025-06-10): Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Titel
SSA-354569 V1.5 (Last Update: 2025-06-10): Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Veröffentlicht
10. Juni 2025 02:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-354569.html
Text
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/
10.06.2025
SIEMENS CERT
SSA-513708 V1.0: Reflected Cross-Site Scripting Vulnerability in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices
Titel
SSA-513708 V1.0: Reflected Cross-Site Scripting Vulnerability in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices
Veröffentlicht
10. Juni 2025 02:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-513708.html
Text
Palo Alto Networks has published [1] information on cross-site scripting vulnerability in PAN-OS. This advisory lists the related Siemens Industrial products affected by this vulnerability. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. Customers are advised to consult and implement ...
10.06.2025
SIEMENS CERT
SSA-301229 V1.1 (Last Update: 2025-06-10): Client-Side Enforcement of Server-Side Security Vulnerabilities in RUGGEDCOM ROX II
Titel
SSA-301229 V1.1 (Last Update: 2025-06-10): Client-Side Enforcement of Server-Side Security Vulnerabilities in RUGGEDCOM ROX II
Veröffentlicht
10. Juni 2025 02:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-301229.html
Text
The web interface of RUGGEDCOM ROX II devices contain multiple Client-Side Enforcement of Server-Side Security vulnerabilities that could allow an attacker with a legitimate, highly privileged account on the web interface to get privileged code execution in the underlying OS of the affected products. Siemens has released new versions for ...
05.06.2025
US CERT (ICS)
CyberData 011209 SIP Emergency Intercom
Titel
CyberData 011209 SIP Emergency Intercom
Veröffentlicht
5. Juni 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: CyberData Equipment: 011209 SIP Emergency Intercom Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel, Missing Authentication for Critical Function, SQL Injection, Insufficiently Protected Credentials, Path Traversal: '.../...//' 2. RISK EVALUATION Successful exploitation of these vulnerabilities ...
05.06.2025
US CERT (ICS)
Hitachi Energy Relion 670, 650 Series and SAM600-IO Product
Titel
Hitachi Energy Relion 670, 650 Series and SAM600-IO Product
Veröffentlicht
5. Juni 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Relion 670, Relion 650, SAM600-IO Vulnerabilities: Integer Overflow or Wraparound 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause memory corruption on the products. 3. TECHNICAL DETAILS 3.1 ...
03.06.2025
US CERT (ICS)
Schneider Electric Wiser Home Automation
Titel
Schneider Electric Wiser Home Automation
Veröffentlicht
3. Juni 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-153-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Wiser AvatarOn 6K Freelocate, Wiser Cuadro H 5P Socket Vulnerability: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to ...
Mai 2025
29.05.2025
US CERT (ICS)
Instantel Micromate
Titel
Instantel Micromate
Veröffentlicht
29. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-04
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Instantel Equipment: Micromate Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the device's configuration port and execute commands. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
29.05.2025
US CERT (ICS)
Consilium Safety CS5000 Fire Panel
Titel
Consilium Safety CS5000 Fire Panel
Veröffentlicht
29. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-03
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Consilium Safety Equipment: CS5000 Fire Panel Vulnerabilities: Initialization of a Resource with an Insecure Default, Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain high-level access to ...
29.05.2025
US CERT (ICS)
Siemens SiPass
Titel
Siemens SiPass
Veröffentlicht
29. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-01
Text
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
27.05.2025
US CERT (ICS)
Johnson Controls iSTAR Configuration Utility (ICU) Tool
Titel
Johnson Controls iSTAR Configuration Utility (ICU) Tool
Veröffentlicht
27. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-146-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.3 ATTENTION: Low attack complexity Vendor: Johnson Controls Inc. Equipment: iSTAR Configuration Utility (ICU) tool Vulnerability: Use of Uninitialized Variable 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to gain access to memory leaked from the ICU. 3. TECHNICAL ...
23.05.2025
SIEMENS CERT
SSA-041082 V1.0: Out of Bounds Read Vulnerability in SiPass Integrated Before V2.95.3.18
Titel
SSA-041082 V1.0: Out of Bounds Read Vulnerability in SiPass Integrated Before V2.95.3.18
Veröffentlicht
23. Mai 2025 02:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-041082.html
Text
SiPass integrated versions before V2.95.3.18 contain an out of bounds read vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition. Siemens has released a new version for SiPass integrated and recommends to update to the latest version.
23.05.2025
SIEMENS CERT
SSA-367714 V1.0: Improper Integrity Check of Firmware Updates in SiPass integrated AC5102 / ACC-G2 and ACC-AP
Titel
SSA-367714 V1.0: Improper Integrity Check of Firmware Updates in SiPass integrated AC5102 / ACC-G2 and ACC-AP
Veröffentlicht
23. Mai 2025 02:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-367714.html
Text
SiPass integrated ACC (Advanced Central Controller) devices do not properly check the integrity of firmware updates. This could allow an attacker to upload a maliciously modified firmware onto the device. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
22.05.2025
US CERT (ICS)
Rockwell Automation FactoryTalk Historian ThingWorx
Titel
Rockwell Automation FactoryTalk Historian ThingWorx
Veröffentlicht
22. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-142-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: 95057C-FTHTWXCT11 Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to launch XXE-based attacks on applications that accept malicious log4net configuration files. ...
22.05.2025
US CERT (ICS)
Lantronix Device Installer
Titel
Lantronix Device Installer
Veröffentlicht
22. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-142-01
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Low attack complexity Vendor: Lantronix Equipment: Device Installer Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain access to the host machine running the Device Installer software. 3. ...
22.05.2025
SIEMENS CERT
SSA-726617 V1.1 (Last Update: 2025-05-22): Incorrect Privilege Assignment Vulnerability in Mendix OIDC SSO Module
Titel
SSA-726617 V1.1 (Last Update: 2025-05-22): Incorrect Privilege Assignment Vulnerability in Mendix OIDC SSO Module
Veröffentlicht
22. Mai 2025 02:00
URL
https://cert-portal.siemens.com/productcert/html/ssa-726617.html
Text
The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development. Siemens has released a new version for Mendix OIDC SSO (Mendix 10 compatible) and recommends to update ...
20.05.2025
US CERT
Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations
Titel
Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations
Veröffentlicht
20. Mai 2025 21:20
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b
Text
Summary The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint advisory to disseminate known tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with threat actors deploying the LummaC2 information stealer (infostealer) malware. LummaC2 malware is able to infiltrate ...
20.05.2025
US CERT (ICS)
Assured Telematics Inc (ATI) Fleet Management System with Geotab Integration
Titel
Assured Telematics Inc (ATI) Fleet Management System with Geotab Integration
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Assured Telematics Inc. Equipment: Fleet Management System Vulnerabilities: Exposure of Sensitive System Information to an Unauthorized Control Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker collecting sensitive file system information ...
20.05.2025
US CERT (ICS)
Assured Telematics Inc (ATI) Fleet Management System (Update A)
Titel
Assured Telematics Inc (ATI) Fleet Management System (Update A)
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Assured Telematics Inc. Equipment: Fleet Management System Vulnerabilities: Exposure of Sensitive System Information to an Unauthorized Control Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker collecting sensitive file system information ...
20.05.2025
US CERT (ICS)
Danfoss AK-SM 8xxA Series
Titel
Danfoss AK-SM 8xxA Series
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.3 ATTENTION: Exploitable remotely Vendor: Danfoss Equipment: AK-SM 8xxA Series Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could enable a remote attacker to bypass authentication and execute arbitrary code remotely. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions ...
20.05.2025
US CERT (ICS)
Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products
Titel
Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.3 ATTENTION: Low attack complexity Vendor: Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric Equipment: ICONICS Product Suite and Mitsubishi Electric MC Works64 Vulnerability: Execution with Unnecessary Privileges 2. RISK EVALUATION Successful exploitation of this vulnerability could result in information tampering on the target ...
20.05.2025
US CERT (ICS)
National Instruments Circuit Design Suite
Titel
National Instruments Circuit Design Suite
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-02
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: National Instruments Equipment: Circuit Design Suite Vulnerabilities: Out-of-bounds Write, Out-of-bounds Read, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code. 3. TECHNICAL DETAILS 3.1 ...
20.05.2025
US CERT (ICS)
Schneider Electric PrismaSeT Active - Wireless Panel Server
Titel
Schneider Electric PrismaSeT Active - Wireless Panel Server
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-06
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: PrismaSeT Active - Wireless Panel Server Vulnerability: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unauthorized code execution, which could result ...
20.05.2025
US CERT (ICS)
Siemens Siveillance Video
Titel
Siemens Siveillance Video
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-05
Text
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
20.05.2025
US CERT (ICS)
Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL
Titel
Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-07
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Galaxy VS, Galaxy VL, Galaxy VXL Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform unauthenticated remote code execution. 3. TECHNICAL DETAILS ...
20.05.2025
US CERT (ICS)
Vertiv Liebert RDU101 and UNITY
Titel
Vertiv Liebert RDU101 and UNITY
Veröffentlicht
20. Mai 2025 14:00
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-10
Text
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Vertiv Equipment: Liebert RDU101 and Liebert UNITY Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition ...

Letzte Updates

BOSCH PSIRT
14.08.2025
SIEMENS CERT
26.08.2025
US CERT
25.08.2025
US CERT (ICS)
04.09.2025

Nach Quelle

Archiv

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds