Bulletins | CERT@VDE

1
2
3 (current)
4
5
…

April 2025

08.04.2025

SIEMENS CERT

SSA-277137 V1.0: Multiple Vulnerabilities in SIDIS Prime Before V4.0.700

Titel

SSA-277137 V1.0: Multiple Vulnerabilities in SIDIS Prime Before V4.0.700

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-277137.html

Text

SIDIS Prime before V4.0.700 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, Boost C++ Libraries and several Microsoft components as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.

08.04.2025

SIEMENS CERT

SSA-876787 V1.5 (Last Update: 2025-04-08): Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs

Titel

SSA-876787 V1.5 (Last Update: 2025-04-08): Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-876787.html

Text

Several SIMATIC S7-1500 and S7-1200 CPU versions are affected by an open redirect vulnerability that could allow an attacker to make the web server of affected devices redirect a legitimate user to an attacker-chosen URL. For a successful attack, the legitimate user must actively click on an attacker-crafted link. Siemens ...

08.04.2025

SIEMENS CERT

SSA-874353 V1.0: Entity Enumeration Vulnerability in Mendix Runtime

Titel

SSA-874353 V1.0: Entity Enumeration Vulnerability in Mendix Runtime

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Text

Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has released new versions for several affected products and recommends to update to the latest ...

08.04.2025

SIEMENS CERT

SSA-819629 V1.0: Weak Authentication Vulnerability in Industrial Edge Device Kit

Titel

SSA-819629 V1.0: Weak Authentication Vulnerability in Industrial Edge Device Kit

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-819629.html

Text

Industrial Edge Device Kit contains a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Industrial Edge Device Builders integrate Industrial Edge Device Kit into their offerings within the open Industrial Edge ecosystem. See further details about affected Industrial Edge Devices ...

08.04.2025

SIEMENS CERT

SSA-503939 V1.1 (Last Update: 2025-04-08): Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP

Titel

SSA-503939 V1.1 (Last Update: 2025-04-08): Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-503939.html

Text

Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

08.04.2025

SIEMENS CERT

SSA-698820 V1.6 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices

Titel

SSA-698820 V1.6 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-698820.html

Text

Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

08.04.2025

SIEMENS CERT

SSA-770770 V1.2 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Titel

SSA-770770 V1.2 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-770770.html

Text

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

08.04.2025

SIEMENS CERT

SSA-767615 V1.2 (Last Update: 2025-04-08): Information Disclosure Vulnerability in SIPROTEC 5 Devices

Titel

SSA-767615 V1.2 (Last Update: 2025-04-08): Information Disclosure Vulnerability in SIPROTEC 5 Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-767615.html

Text

An information disclosure vulnerability in SIPROTEC 5 devices could allow an unauthenticated, remote attacker to retrieve sensitive information of the device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products ...

08.04.2025

SIEMENS CERT

SSA-195895 V1.2 (Last Update: 2025-04-08): User Enumeration Vulnerability in the Webserver of SIMATIC Products

Titel

SSA-195895 V1.2 (Last Update: 2025-04-08): User Enumeration Vulnerability in the Webserver of SIMATIC Products

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-195895.html

Text

The webserver of several SIMATIC products is affected by a user enumeration vulnerability that could allow an unauthenticated remote attacker to identify valid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.

08.04.2025

SIEMENS CERT

SSA-054046 V1.4 (Last Update: 2025-04-08): Unauthenticated Information Disclosure in Web Server of SIMATIC S7-1500 CPUs

Titel

SSA-054046 V1.4 (Last Update: 2025-04-08): Unauthenticated Information Disclosure in Web Server of SIMATIC S7-1500 CPUs

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-054046.html

Text

Several SIMATIC S7-1500 CPU versions are affected by an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain knowledge about actual and configured maximum cycle times and communication load of the CPU. Siemens has released new versions for several affected products and recommends to update to the ...

08.04.2025

SIEMENS CERT

SSA-187636 V1.0: Multiple Vulnerabilities in SENTRON 7KT PAC1260 Data Manager

Titel

SSA-187636 V1.0: Multiple Vulnerabilities in SENTRON 7KT PAC1260 Data Manager

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Text

SENTRON 7KT PAC1260 Data Manager is affected by multiple vulnerabilities as listed below. Software fixes can no longer be provided for The SENTRON 7KT PAC1260 Data Manager. This advisory documents the known open vulnerabilities. To fix the vulnerabilities, Siemens recommends to replace the device by the new SENTRON 7KT PAC1261 ...

08.04.2025

SIEMENS CERT

SSA-686975 V1.6 (Last Update: 2025-04-08): IPU 2022.3 Vulnerabilities in Siemens Industrial Products using Intel CPUs

Titel

SSA-686975 V1.6 (Last Update: 2025-04-08): IPU 2022.3 Vulnerabilities in Siemens Industrial Products using Intel CPUs

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-686975.html

Text

Intel has published information on vulnerabilities in Intel products in November 2022. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update (“2022.3 IPU – BIOS Advisory” Intel-SA-00688). Siemens has released new versions for several affected products and ...

08.04.2025

SIEMENS CERT

SSA-913875 V1.4 (Last Update: 2025-04-08): Frame Aggregation and Fragmentation Vulnerabilities in 802.11

Titel

SSA-913875 V1.4 (Last Update: 2025-04-08): Frame Aggregation and Fragmentation Vulnerabilities in 802.11

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-913875.html

Text

Twelve vulnerabilities in the implementation of frame aggregation and fragmentation of the 802.11 standard, under the name of FragAttacks, have been published. Successful exploitation of these vulnerabilities could allow an attacker within Wi-Fi range to forge encrypted frames, which could result in sensitive data disclosure and possibly traffic manipulation. The ...

08.04.2025

SIEMENS CERT

SSA-306654 V1.9 (Last Update: 2025-04-08): Insyde BIOS Vulnerabilities in Siemens Industrial Products

Titel

SSA-306654 V1.9 (Last Update: 2025-04-08): Insyde BIOS Vulnerabilities in Siemens Industrial Products

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-306654.html

Text

Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures ...

08.04.2025

SIEMENS CERT

SSA-369369 V1.1 (Last Update: 2025-04-08): Weak Registry Permission Vulnerability in SIMATIC IPC DiagBase and SIMATIC IPC DiagM...

Titel

SSA-369369 V1.1 (Last Update: 2025-04-08): Weak Registry Permission Vulnerability in SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-369369.html

Text

SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor contain a weak registry permission vulnerability that could allow an authenticated attacker to perform privilege escalation or bypass security measures. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

08.04.2025

SIEMENS CERT

SSA-364175 V1.5 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Dev...

Titel

SSA-364175 V1.5 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.4-h1

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-364175.html

Text

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available. Customers are advised to consult and implement the workarounds ...

08.04.2025

SIEMENS CERT

SSA-265688 V1.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP ...

Titel

SSA-265688 V1.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Text

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

08.04.2025

SIEMENS CERT

SSA-398330 V2.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...

Titel

SSA-398330 V2.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Text

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not ...

08.04.2025

SIEMENS CERT

SSA-935500 V1.2 (Last Update: 2025-04-08): Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON an...

Titel

SSA-935500 V1.2 (Last Update: 2025-04-08): Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-935500.html

Text

A denial of service vulnerability has been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-313313: https://cert-portal.siemens.com/productcert/html/ssa-313313.html. The products listed below use affected versions of the Nucleus software and inherently contain the vulnerability. Siemens has released new versions for several affected products and ...

08.04.2025

SIEMENS CERT

SSA-354569 V1.3 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices

Titel

SSA-354569 V1.3 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices

Veröffentlicht

8. April 2025 02:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-354569.html

Text

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/

März 2025

20.03.2025

SIEMENS CERT

SSA-656895 V1.2 (Last Update: 2025-03-20): Open Redirect Vulnerability in Teamcenter

Titel

SSA-656895 V1.2 (Last Update: 2025-03-20): Open Redirect Vulnerability in Teamcenter

Veröffentlicht

20. März 2025 01:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-656895.html

Text

The SSO login service in Teamcenter contains an open redirect vulnerability that could allow an attacker to redirect the legitimate user to an attacker-chosen URL to steal valid session data. Siemens has released hot fixes for the affected products and recommends to apply them as described in the related Software ...

13.03.2025

SIEMENS CERT

SSA-920092 V1.0: Memory Corruption Vulnerability in Simcenter Femap

Titel

SSA-920092 V1.0: Memory Corruption Vulnerability in Simcenter Femap

Veröffentlicht

13. März 2025 01:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-920092.html

Text

Siemens Simcenter Femap is affected by memory corruption vulnerability that could be triggered when the application reads files in .NEU format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to leak information or potentially perform remote code execution ...

11.03.2025

SIEMENS CERT

SSA-280834 V1.0: Improper OpenVPN Credential Validation Vulnerability in SCALANCE M-800 and SC-600 Families

Titel

SSA-280834 V1.0: Improper OpenVPN Credential Validation Vulnerability in SCALANCE M-800 and SC-600 Families

Veröffentlicht

11. März 2025 01:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-280834.html

Text

SCALANCE M-800 and SC-600 families are affected by improper input validation in the OpenVPN authentication. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not ...

11.03.2025

SIEMENS CERT

SSA-265688 V1.4 (Last Update: 2025-03-11): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP ...

Titel

SSA-265688 V1.4 (Last Update: 2025-03-11): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1

Veröffentlicht

11. März 2025 01:00

URL

https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Text

11.03.2025

SIEMENS CERT