Bulletins

The OPC UA implementations (ANSI C and C++) as used in several SIMATIC products contain a denial of service vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate. Siemens has released new versions for several affected products and …

Multiple SICAM products are affected by vulnerabilities that could lead to privilege escalation, remote code execution or information loss namely: SICAM A8000 device firmwares CPC80 for CP-8000/CP-8021/CP-8022 CPCI85 and OPUPI0 for CP-8031/CP-8050 SICAM EGS firmware CPCI85 and OPUPI0 SICAM 8 Software Solution SICORE Siemens has released new versions for the …

Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available. Siemens recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

Polarion ALM is affected by incorrect default path permissions in installation path, and improper authentication in the REST API endpoints of DOORS connector. An attacker could exploit the vulnerabilities for unauthenticated access, or privilege escalation. Siemens has released a new version for Polarion ALM and recommends to update to the …

The RUGGEDCOM CROSSBOW server application before V5.5 contains multiple vulnerabilities that could allow an attacker to execute arbitrary database queries via SQL injection attacks, or upload of arbitrary files to the application’s file system. The majority of the reported vulnerabilities might have a high impact in the availability of the …

Tecnomatix Plant Simulation contains an out of bounds write vulnerability that could be triggered when the application reads MODEL files. If a user is tricked to open a malicious file using the affected application, this could lead to a crash, and potentially also to arbitrary code execution on the target …

The Apache Lucene based query engine in Polarion ALM lacks proper access controls. This could allow an authenticated user to query items beyond the user’s allowed projects. Siemens has released a new version for Polarion ALM and recommends to update to the latest version.