Bulletins | CERT@VDE

Siemens SICAM Q100/Q200

Titel

Siemens SICAM Q100/Q200

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-16

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Siemens Opcenter Quality

Titel

Siemens Opcenter Quality

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-06

Text

Siemens Web Installer

Titel

Siemens Web Installer

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-22

Text

Rockwell Automation ControlLogix Ethernet Modules

Titel

Rockwell Automation ControlLogix Ethernet Modules

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-28

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ControlLogix Ethernet Modules Vulnerability: Initialization of a Resource with an Insecure Default 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote attackers to perform memory dumps, modify memory, and control execution ...

Rockwell Automation FactoryTalk Viewpoint

Titel

Rockwell Automation FactoryTalk Viewpoint

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-23

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Viewpoint Vulnerability: Improper Handling of Insufficient Permissions or Privileges 2. RISK EVALUATION Successful exploitation of this vulnerability could result in full privilege escalation. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following version of ...

Rockwell FactoryTalk Linx

Titel

Rockwell FactoryTalk Linx

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-24

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Rockwell Equipment: FactoryTalk Linx Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to to create, update, and delete FTLinx drivers. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Rockwell ...

Rockwell Automation FLEX 5000 I/O

Titel

Rockwell Automation FLEX 5000 I/O

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-26

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Rockwell Automation Equipment: FLEX 5000 I/O Vulnerabilities: Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could create a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following version of FLEX 5000 I/O ...

Rockwell Automation ArmorBlock 5000 I/O - Webserver

Titel

Rockwell Automation ArmorBlock 5000 I/O - Webserver

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-27

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ArmorBlock 5000 I/O Vulnerabilities: Incorrect Authorization, Improper Authentication 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to predict session numbers or perform privileged actions. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

Rockwell Automation Micro800

Titel

Rockwell Automation Micro800

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-25

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Micro800 Vulnerabilities: Dependency on Vulnerable Third-Party Component, Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in remote code execution or may lead to privilege escalation. 3. TECHNICAL DETAILS ...

Siemens SIMOTION SCOUT, SIMOTION SCOUT TIA, and SINAMICS STARTER

Titel

Siemens SIMOTION SCOUT, SIMOTION SCOUT TIA, and SINAMICS STARTER

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-18

Text

Siemens SIPROTEC 4 and SIPROTEC 4 Compact

Titel

Siemens SIPROTEC 4 and SIPROTEC 4 Compact

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-12

Text

Siemens Wibu CodeMeter Runtime

Titel

Siemens Wibu CodeMeter Runtime

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-05

Text

Siemens RUGGEDCOM CROSSBOW Station Access Controller

Titel

Siemens RUGGEDCOM CROSSBOW Station Access Controller

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-08

Text

Siemens Third-Party Components in SINEC OS

Titel

Siemens Third-Party Components in SINEC OS

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Text

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Siemens SINEC OS

Titel

Siemens SINEC OS

Veröffentlicht

14. August 2025 14:00

URL

Text

Rockwell Automation FactoryTalk Action Manager

Titel

Rockwell Automation FactoryTalk Action Manager

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-30

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Action Manager Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local unauthenticated attacker to listen to communications and manipulate the device. ...

Siemens SIMATIC RTLS Locating Manager

Titel

Siemens SIMATIC RTLS Locating Manager

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-01

Text

Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT

Titel

Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT

Veröffentlicht

14. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-31

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT Vulnerabilities: Improper Input Validation, Improper Handling of Exceptional Conditions 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker causing a denial of service condition. 3. TECHNICAL DETAILS ...

Schneider Electric EcoStruxure Power Monitoring Expert

Titel

Schneider Electric EcoStruxure Power Monitoring Expert

Veröffentlicht

12. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: EcoStruxure Power Monitoring Expert Vulnerabilities: Path Traversal, Deserialization of Untrusted Data, Server-Side Request Forgery 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a remote attacker to read arbitrary files from the ...

Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

Titel

Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

Veröffentlicht

12. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Ashlar-Vellum Equipment: Cobalt, Xenon, Argon, Lithium, Cobalt Share Vulnerabilities: Out-of-bounds Write, Out-of-bounds Read, Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose information and execute arbitrary code. 3. TECHNICAL ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04

AVEVA PI Integrator

Titel

AVEVA PI Integrator

Veröffentlicht

12. August 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: PI Integrator Vulnerabilities: Unrestricted Upload of File with Dangerous Type, Insertion of Sensitive Information into Sent Data 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, or ...

Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2

Titel

Johnson Controls iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2

Veröffentlicht

12. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Equipment: iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR, ULTRA G2 SE, iSTAR Edge G2 Vulnerabilities: OS Command Injection, Insufficient Verification of Data Authenticity, Use of Default Credentials, Missing Protection Mechanism for Alternate ...

07.08.2025

Burk Technology ARC Solo

Titel

Burk Technology ARC Solo

Veröffentlicht

7. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Burk Technology Equipment: ARC Solo Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker gaining access to the device, locking out authorized users, or disrupting operations. ...

07.08.2025

EG4 Electronics EG4 Inverters

Titel

EG4 Electronics EG4 Inverters

Veröffentlicht

7. August 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: EG4 Electronics Equipment: EG4 Inverters Vulnerabilities: Cleartext Transmission of Sensitive Information, Download of Code Without Integrity Check, Observable Discrepancy, Improper Restriction of Excessive Authentication Attempts 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...

07.08.2025