Bulletins

Versions of Spectrum Power™ 4, that use the customer specific project enhancement (PE) Web Office Portal (WOP) are affected by a possible OS Command Injection vulnerability. Siemens has released patches for the affected version and recommends to apply specific countermeasures until these patches can be applied.

The latest updates for SINEMA Remote Connect Client and Server fix multiple vulnerabilities. One of these vulnerabilities could allow an attacker to circumvent the authorization of the system for certain functionalities and to execute privileged functions. Siemens has released firmware updates for SINEMA Remote Connect Client and Server.

The latest update for RUGGEDCOM ROX II fixes multiple vulnerabilities in third party component software. The most severe vulnerability could allow an attacker to run arbitrary code on the device. Siemens has released firmware updates for RUGGEDCOM ROX II and recommends that customers update to the new version.

Security researchers published information on vulnerabilities known as Spectre and Meltdown. These vulnerabilities affect many modern processors from different vendors to a varying degree. Several Industrial Products include affected processors and are affected by the vulnerabilities.

A vulnerability was identified in several SCALANCE X switches that could allow an attacker to feed information into a network via the mirror port with the monitor barrier feature enabled. The monitor barrier implementation in various SCALANCE products does allow traffic to be directed back into the mirroring network. This …

The latest update for Desigo PXC devices fixes a vulnerability that could allow unauthenticated remote attackers to upload malicious firmware without prior authentication. Siemens recommends updating to the new version.