Bulletins | CERT@VDE

1
2 (current)
3
4
…

August 2025

12.08.2025

SSA-265688 V1.8 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP ...

Titel

SSA-265688 V1.8 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Text

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

12.08.2025

SIEMENS CERT

SSA-770770 V1.6 (Last Update: 2025-08-12): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices

Titel

SSA-770770 V1.6 (Last Update: 2025-08-12): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-770770.html

Text

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.

12.08.2025

SIEMENS CERT

SSA-177847 V1.0: Improper VNC Password Check Vulnerability in SINUMERIK Controllers

Titel

SSA-177847 V1.0: Improper VNC Password Check Vulnerability in SINUMERIK Controllers

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-177847.html

Text

Siemens SINUMERIK Controllers are affected by an improper VNC password check vulnerability. Siemens has released new versions for the affected products and recommends to update to the latest versions.

12.08.2025

SIEMENS CERT

SSA-097435 V1.9 (Last Update: 2025-08-12): Usernames Disclosure Vulnerability in Mendix Runtime

Titel

SSA-097435 V1.9 (Last Update: 2025-08-12): Usernames Disclosure Vulnerability in Mendix Runtime

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-097435.html

Text

Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.

12.08.2025

SIEMENS CERT

SSA-094954 V1.0: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II

Titel

SSA-094954 V1.0: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-094954.html

Text

RUGGEDCOM ROX II devices do not properly limit access through their Built-In-Self-Test (BIST) mode. This could allow a local attacker to bypass authentication and access a root shell on the device. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

12.08.2025

SIEMENS CERT

SSA-529291 V1.0: Information Disclosure Vulnerabilities in SICAM Q100/Q200

Titel

SSA-529291 V1.0: Information Disclosure Vulnerabilities in SICAM Q100/Q200

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-529291.html

Text

SICAM Q100 and Q200 devices are affected by two information disclosure vulnerabilities that could allow an authenticated local attacker to extract the SMTP account password and use the configured SMTP service for arbitrary purposes. Siemens has released new versions for the affected products and recommends to update to the latest ...

12.08.2025

SIEMENS CERT

SSA-613116 V1.0: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1

Titel

SSA-613116 V1.0: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-613116.html

Text

SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.

12.08.2025

SIEMENS CERT

SSA-517338 V1.0: Multiple Vulnerabilities in SINEC Traffic Analyzer Before V3.0

Titel

SSA-517338 V1.0: Multiple Vulnerabilities in SINEC Traffic Analyzer Before V3.0

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-517338.html

Text

SINEC Traffic Analyzer before V3.0 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC Traffic Analyzer and recommends to update to the latest version. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

12.08.2025

SIEMENS CERT

SSA-674084 V1.0: File Parsing Vulnerabilities in Simcenter Femap Before V2506

Titel

SSA-674084 V1.0: File Parsing Vulnerabilities in Simcenter Femap Before V2506

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-674084.html

Text

Simcenter Femap contains a file parsing vulnerability that could be triggered when the application reads files in STP or BMP file format. If a user is tricked to open a malicious file with the affected application, this could lead the application to crash or potentially lead to arbitrary code execution. ...

12.08.2025

SIEMENS CERT

SSA-914892 V1.1 (Last Update: 2025-08-12): Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime

Titel

SSA-914892 V1.1 (Last Update: 2025-08-12): Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-914892.html

Text

The basic authentication mechanism of Mendix Runtime contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are ...

12.08.2025

SIEMENS CERT

SSA-978177 V1.0: Vulnerability in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices

Titel

SSA-978177 V1.0: Vulnerability in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-978177.html

Text

Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available.

12.08.2025

SIEMENS CERT

SSA-994087 V1.0: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Before V5.7

Titel

SSA-994087 V1.0: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller Before V5.7

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-994087.html

Text

RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code or to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the ...

12.08.2025

SIEMENS CERT

SSA-446307 V1.1 (Last Update: 2025-08-12): Authentication Bypass Vulnerability in BMC (CVE-2024-54085) affects SIMATIC IPC RS-828A

Titel

SSA-446307 V1.1 (Last Update: 2025-08-12): Authentication Bypass Vulnerability in BMC (CVE-2024-54085) affects SIMATIC IPC RS-828A

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-446307.html

Text

SIMATIC IPC RS-828A is affected by an authentication bypass vulnerability in the Redfish interface of its Baseboard Management Controller (BMC) that could allow an attacker to gain unauthorized access and compromise confidentiality, integrity and availability of the BMC and thus the entire system. Siemens has released a new version for ...

12.08.2025

SIEMENS CERT

SSA-908185 V1.2 (Last Update: 2025-08-12): Mirror Port Isolation Vulnerability in RUGGEDCOM ROS Devices

Titel

SSA-908185 V1.2 (Last Update: 2025-08-12): Mirror Port Isolation Vulnerability in RUGGEDCOM ROS Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-908185.html

Text

A vulnerability was identified in RUGGEDCOM ROS devices with mirror port enabled, that could allow an attacker to inject information into the network via the mirror port. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products ...

12.08.2025

SIEMENS CERT

SSA-856721 V1.3 (Last Update: 2025-08-12): Vulnerability in RUGGEDCOM Discovery Protocol (RCDP) of Industrial Communication Dev...

Titel

SSA-856721 V1.3 (Last Update: 2025-08-12): Vulnerability in RUGGEDCOM Discovery Protocol (RCDP) of Industrial Communication Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-856721.html

Text

The RUGGEDCOM RCDP protocol is not properly configured after commissioning of RUGGEDCOM ROS based devices and some SCALANCE X switch models and could allow unauthenticated remote users to perform administrative operations. An attacker must be in the same adjacent network and the RCDP daemon must be enabled in order to ...

12.08.2025

SIEMENS CERT

SSA-864900 V1.2 (Last Update: 2025-08-12): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Titel

SSA-864900 V1.2 (Last Update: 2025-08-12): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-864900.html

Text

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

12.08.2025

SIEMENS CERT

SSA-894058 V1.0: Improper Bandwidth Limitation of Network Packets Over Local USB Port Vulnerability in SIPROTEC 5

Titel

SSA-894058 V1.0: Improper Bandwidth Limitation of Network Packets Over Local USB Port Vulnerability in SIPROTEC 5

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-894058.html

Text

Affected SIPROTEC 5 devices do not properly limit the bandwidth for incoming network packets over their local USB port. This could allow an attacker with physical access to send specially crafted packets with high bandwidth to the affected devices thus forcing them to exhaust their memory and stop responding to ...

12.08.2025

SIEMENS CERT

SSA-767615 V1.4 (Last Update: 2025-08-12): Information Disclosure Vulnerability in SIPROTEC 5 Devices

Titel

SSA-767615 V1.4 (Last Update: 2025-08-12): Information Disclosure Vulnerability in SIPROTEC 5 Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-767615.html

Text

An information disclosure vulnerability in SIPROTEC 5 devices could allow an unauthenticated, remote attacker to retrieve sensitive information of the device. Siemens has released new versions for the affected products and recommends to update to the latest versions.

12.08.2025

SIEMENS CERT

SSA-840800 V1.5 (Last Update: 2025-08-12): Code Injection Vulnerability in RUGGEDCOM ROS

Titel

SSA-840800 V1.5 (Last Update: 2025-08-12): Code Injection Vulnerability in RUGGEDCOM ROS

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-840800.html

Text

RUGGEDCOM ROS-based devices are vulnerable to a web-based code injection attack. To execute this attack, it is necessary to access the system via the Command Line Interface (CLI). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for ...

12.08.2025

SIEMENS CERT

SSA-800126 V1.1 (Last Update: 2025-08-12): Deserialization Vulnerability in Siemens Engineering Platforms before V20

Titel

SSA-800126 V1.1 (Last Update: 2025-08-12): Deserialization Vulnerability in Siemens Engineering Platforms before V20

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-800126.html

Text

Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further ...

12.08.2025

SIEMENS CERT

SSA-794185 V1.1 (Last Update: 2025-08-12): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC,...

Titel

SSA-794185 V1.1 (Last Update: 2025-08-12): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-794185.html

Text

This advisory documents the impact of CVE-2024-3596 (also dubbed “Blastradius”), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in ...

12.08.2025

SIEMENS CERT

SSA-665108 V1.0: Arbitrary File Upload Vulnerability in RUGGEDCOM ROX II

Titel

SSA-665108 V1.0: Arbitrary File Upload Vulnerability in RUGGEDCOM ROX II

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-665108.html

Text

RUGGEDCOM ROX II devices does not properly enforce limitations on type and size of files that can be uploaded through their web interface. This could allow an attacker with a legitimate, highly privileged account on the web interface to upload arbitrary files onto the filesystem of the devices. Siemens is ...

12.08.2025

SIEMENS CERT

SSA-770902 V1.2 (Last Update: 2025-08-12): Denial of Service Vulnerability in the Web Server of RUGGEDCOM ROS Devices

Titel

SSA-770902 V1.2 (Last Update: 2025-08-12): Denial of Service Vulnerability in the Web Server of RUGGEDCOM ROS Devices

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-770902.html

Text

A denial of service vulnerability could allow an unauthorized attacker to cause total loss of availability in the web server of the affected devices. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are ...

12.08.2025

SIEMENS CERT

SSA-355557 V1.0: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2

Titel

SSA-355557 V1.0: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Text

SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.

12.08.2025

SIEMENS CERT

SSA-493787 V1.0: Arbitrary Code Execution Vulnerability in SIMATIC RTLS Locating Manager Before V3.2

Titel

SSA-493787 V1.0: Arbitrary Code Execution Vulnerability in SIMATIC RTLS Locating Manager Before V3.2

Veröffentlicht

12. August 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-493787.html

Text

SIMATIC RTLS Locating Manager Before V3.2 contains an improper input validation vulnerability that could allow an authenticated remote attacker to execute arbitrary code with high privileges. Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version.

1
2 (current)
3
4
…

Letzte Updates

Nach Quelle

Archiv

2025

2024

2023

2022

2021

2020

2019

2018

2017

Feeds