Bulletins | CERT@VDE

SSA-819629 V1.1 (Last Update: 2025-04-17): Weak Authentication Vulnerability in Industrial Edge Device Kit

Titel

SSA-819629 V1.1 (Last Update: 2025-04-17): Weak Authentication Vulnerability in Industrial Edge Device Kit

Veröffentlicht

17. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-819629.html

Text

Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Industrial Edge ...

SSA-366067 V1.2 (Last Update: 2025-04-16): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Titel

SSA-366067 V1.2 (Last Update: 2025-04-16): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Veröffentlicht

16. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-366067.html

Text

Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or ...

SSA-443402 V1.0: Multiple SQL Injection Vulnerabilities in TeleControl Server Basic before V3.1.2.2

Titel

SSA-443402 V1.0: Multiple SQL Injection Vulnerabilities in TeleControl Server Basic before V3.1.2.2

Veröffentlicht

16. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-443402.html

Text

TeleControl Server Basic before V3.1.2.2 contains multiple SQL Injection vulnerabilities that could allow an attacker to read and write to the application’s DB, cause denial of service and execute code in an OS shell with limited “NT AUTHORITY” permissions. Siemens has conducted a root-cause analysis for potential SQL injection vulnerabilities ...

SSA-395348 V1.0: Improper Handling of Length Parameter Inconsistency Vulnerability in TeleControl Server Basic before V3.1.2.2

Titel

SSA-395348 V1.0: Improper Handling of Length Parameter Inconsistency Vulnerability in TeleControl Server Basic before V3.1.2.2

Veröffentlicht

16. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-395348.html

Text

TeleControl Server Basic before V3.1.2.2 contains a Improper Handling of Length Parameter Inconsistency Vulnerability that could allow an attacker to cause the application to allocate exhaustive amounts of memory and subsequently create a denial of service condition. Siemens has released a new version for TeleControl Server Basic and recommends to ...

SSA-832273 V1.8 (Last Update: 2025-04-16): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Titel

SSA-832273 V1.8 (Last Update: 2025-04-16): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Veröffentlicht

16. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-832273.html

Text

14.04.2025

SSA-874353 V1.2 (Last Update: 2025-04-14): Entity Enumeration Vulnerability in Mendix Runtime

Titel

SSA-874353 V1.2 (Last Update: 2025-04-14): Entity Enumeration Vulnerability in Mendix Runtime

Veröffentlicht

14. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Text

Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has released new versions for several affected products and recommends to update to the latest ...

10.04.2025

SSA-874353 V1.1 (Last Update: 2025-04-10): Entity Enumeration Vulnerability in Mendix Runtime

Titel

SSA-874353 V1.1 (Last Update: 2025-04-10): Entity Enumeration Vulnerability in Mendix Runtime

Veröffentlicht

10. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Text

SSA-354569 V1.3 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices

Titel

SSA-354569 V1.3 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-354569.html

Text

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/

SSA-398330 V2.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...

Titel

SSA-398330 V2.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Text

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not ...

SSA-306654 V1.9 (Last Update: 2025-04-08): Insyde BIOS Vulnerabilities in Siemens Industrial Products

Titel

SSA-306654 V1.9 (Last Update: 2025-04-08): Insyde BIOS Vulnerabilities in Siemens Industrial Products

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-306654.html

Text

Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures ...

SSA-525431 V1.0: Privilege Escalation Vulnerabilities in Siemens License Server Before V4.3

Titel

SSA-525431 V1.0: Privilege Escalation Vulnerabilities in Siemens License Server Before V4.3

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-525431.html

Text

Siemens License Server before V4.3 contains various vulnerabilities that could allow a low-privileged local user to escalate privileges or perform arbitrary code execution. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the latest version.

SSA-503939 V1.1 (Last Update: 2025-04-08): Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP

Titel

SSA-503939 V1.1 (Last Update: 2025-04-08): Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-503939.html

Text

Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

SSA-369369 V1.1 (Last Update: 2025-04-08): Weak Registry Permission Vulnerability in SIMATIC IPC DiagBase and SIMATIC IPC DiagM...

Titel

SSA-369369 V1.1 (Last Update: 2025-04-08): Weak Registry Permission Vulnerability in SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-369369.html

Text

SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor contain a weak registry permission vulnerability that could allow an authenticated attacker to perform privilege escalation or bypass security measures. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

SSA-364175 V1.5 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Dev...

Titel

SSA-364175 V1.5 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.4-h1

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-364175.html

Text

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available. Customers are advised to consult and implement the workarounds ...

SSA-725549 V1.0: Denial of Service of ICMP in Industrial Devices

Titel

SSA-725549 V1.0: Denial of Service of ICMP in Industrial Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-725549.html

Text

A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The integrated ICMP services in the underlying TCP/IP stack is vulnerable to a denial of service attack through specially crafted ICMP packets. A successful attack will impact the availability ...

SSA-817234 V1.0: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud

Titel

SSA-817234 V1.0: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-817234.html

Text

Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for ...

SSA-698820 V1.6 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices

Titel

SSA-698820 V1.6 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-698820.html

Text

Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

SSA-913875 V1.4 (Last Update: 2025-04-08): Frame Aggregation and Fragmentation Vulnerabilities in 802.11

Titel

SSA-913875 V1.4 (Last Update: 2025-04-08): Frame Aggregation and Fragmentation Vulnerabilities in 802.11

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-913875.html

Text

Twelve vulnerabilities in the implementation of frame aggregation and fragmentation of the 802.11 standard, under the name of FragAttacks, have been published. Successful exploitation of these vulnerabilities could allow an attacker within Wi-Fi range to forge encrypted frames, which could result in sensitive data disclosure and possibly traffic manipulation. The ...

SSA-874353 V1.0: Entity Enumeration Vulnerability in Mendix Runtime

Titel

SSA-874353 V1.0: Entity Enumeration Vulnerability in Mendix Runtime

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Text

SSA-819629 V1.0: Weak Authentication Vulnerability in Industrial Edge Device Kit

Titel

SSA-819629 V1.0: Weak Authentication Vulnerability in Industrial Edge Device Kit

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-819629.html

Text

Industrial Edge Device Kit contains a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Industrial Edge Device Builders integrate Industrial Edge Device Kit into their offerings within the open Industrial Edge ecosystem. See further details about affected Industrial Edge Devices ...

SSA-770770 V1.2 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Titel

SSA-770770 V1.2 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-770770.html

Text

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

SSA-767615 V1.2 (Last Update: 2025-04-08): Information Disclosure Vulnerability in SIPROTEC 5 Devices

Titel

SSA-767615 V1.2 (Last Update: 2025-04-08): Information Disclosure Vulnerability in SIPROTEC 5 Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-767615.html

Text

An information disclosure vulnerability in SIPROTEC 5 devices could allow an unauthenticated, remote attacker to retrieve sensitive information of the device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products ...

SSA-672923 V1.0: Out of Bounds Write Vulnerability in Solid Edge

Titel

SSA-672923 V1.0: Out of Bounds Write Vulnerability in Solid Edge

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-672923.html

Text

Solid Edge is affected by an out of bounds write vulnerability that could be triggered when the application is parsing X_T data or a specially crafted file in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability ...

SSA-634640 V1.0: Weak Authentication Vulnerability in Siemens Industrial Edge Devices

Titel

SSA-634640 V1.0: Weak Authentication Vulnerability in Siemens Industrial Edge Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-634640.html

Text

Siemens Industrial Edge Devices contain a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific ...