January 2025
14.01.2025
SIEMENS CERT
SSA-413565 V1.4 (Last Update: 2025-01-14): Multiple Vulnerabilities in SCALANCE Products
Title
SSA-413565 V1.4 (Last Update: 2025-01-14): Multiple Vulnerabilities in SCALANCE Products
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-413565.html
Summary
Multiple SCALANCE devices are affected by several vulnerabilities that could allow an attacker to inject code, retrieve data as debug information as well as user CLI passwords or set the CLI to an irresponsive state. Siemens has released updates for the affected products and recommends to update to the latest ...
14.01.2025
SIEMENS CERT
SSA-876787 V1.3 (Last Update: 2025-01-14): Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs
Title
SSA-876787 V1.3 (Last Update: 2025-01-14): Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-876787.html
Summary
Several SIMATIC S7-1500 and S7-1200 CPU versions are affected by an open redirect vulnerability that could allow an attacker to make the web server of affected devices redirect a legitimate user to an attacker-chosen URL. For a successful attack, the legitimate user must actively click on an attacker-crafted link. Siemens ...
14.01.2025
SIEMENS CERT
SSA-039007 V1.3 (Last Update: 2025-01-14): Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)
Title
SSA-039007 V1.3 (Last Update: 2025-01-14): Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-039007.html
Summary
Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures ...
14.01.2025
SIEMENS CERT
SSA-482757 V1.5 (Last Update: 2025-01-14): Missing Immutable Root of Trust in S7-1500 CPU devices
Title
SSA-482757 V1.5 (Last Update: 2025-01-14): Missing Immutable Root of Trust in S7-1500 CPU devices
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-482757.html
Summary
Affected models of the S7-1500 CPU product family do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to replace the boot ...
14.01.2025
SIEMENS CERT
SSA-314390 V1.0: LDAP Injection Vulnerability in Mendix LDAP Module
Title
SSA-314390 V1.0: LDAP Injection Vulnerability in Mendix LDAP Module
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-314390.html
Summary
The Mendix LDAP module is affected by an LDAP injection vulnerability that could allow an unauthenticated remote attacker to bypass username verification. Siemens has released a new version for Mendix LDAP and recommends to update to the latest version.
14.01.2025
SIEMENS CERT
SSA-054046 V1.2 (Last Update: 2025-01-14): Unauthenticated Information Disclosure in Web Server of SIMATIC S7-1500 CPUs
Title
SSA-054046 V1.2 (Last Update: 2025-01-14): Unauthenticated Information Disclosure in Web Server of SIMATIC S7-1500 CPUs
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-054046.html
Summary
Several SIMATIC S7-1500 CPU versions are affected by an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain knowledge about actual and configured maximum cycle times and communication load of the CPU. Siemens has released new versions for several affected products and recommends to update to the ...
14.01.2025
SIEMENS CERT
SSA-446448 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Title
SSA-446448 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-446448.html
Summary
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, contains a vulnerability that could allow an attacker to cause a denial of service condition on affected industrial products. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific ...
14.01.2025
SIEMENS CERT
SSA-416411 V1.0: Cross-Site Scripting Vulnerability in Industrial Edge Management
Title
SSA-416411 V1.0: Cross-Site Scripting Vulnerability in Industrial Edge Management
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-416411.html
Summary
Industrial Edge Management is affected by a reflected cross-site scripting (XSS) vulnerability that could allow an attacker to extract sensitive information by tricking users into accessing a malicious link. Siemens recommends countermeasures for products where fixes are not, or not yet available.
14.01.2025
SIEMENS CERT
SSA-711309 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products
Title
SSA-711309 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-711309.html
Summary
The OPC UA implementations (ANSI C and C++) as used in several SIMATIC products contain a denial of service vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate. Siemens has released new versions for several affected products and ...
14.01.2025
SIEMENS CERT
SSA-593272 V2.3 (Last Update: 2025-01-14): SegmentSmack in Interniche IP-Stack based Industrial Devices
Title
SSA-593272 V2.3 (Last Update: 2025-01-14): SegmentSmack in Interniche IP-Stack based Industrial Devices
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-593272.html
Summary
A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released new versions for ...
14.01.2025
SIEMENS CERT
SSA-404759 V1.0: Information Disclosure Vulnerability in Siveillance Video Camera Drivers
Title
SSA-404759 V1.0: Information Disclosure Vulnerability in Siveillance Video Camera Drivers
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-404759.html
Summary
Several HikVision camera device drivers in the Siveillance Video Device Pack store camera credentials in their log file when authentication fails. This could allow a local attacker to read camera credentials stored in the Recording Server under specific conditions. Siemens has released an update of the Device Pack and recommends ...
14.01.2025
SIEMENS CERT
SSA-398330 V2.2 (Last Update: 2025-01-14): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...
Title
SSA-398330 V2.2 (Last Update: 2025-01-14): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not ...
14.01.2025
SIEMENS CERT
SSA-097435 V1.8 (Last Update: 2025-01-14): Usernames Disclosure Vulnerability in Mendix Runtime
Title
SSA-097435 V1.8 (Last Update: 2025-01-14): Usernames Disclosure Vulnerability in Mendix Runtime
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-097435.html
Summary
Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.
14.01.2025
SIEMENS CERT
SSA-194557 V1.0: Improper Limitation of Filesystem Access through Web Server Vulnerability in SIPROTEC 5
Title
SSA-194557 V1.0: Improper Limitation of Filesystem Access through Web Server Vulnerability in SIPROTEC 5
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-194557.html
Summary
Affected SIPROTEC 5 devices do not properly limit the access of the web server to the filesystem. This could allow an authenticated remote attacker to read arbitrary files or the entire filesystem of the device. Siemens has released new versions for several affected products and recommends to update to the ...
14.01.2025
SIEMENS CERT
SSA-730482 V1.2 (Last Update: 2025-01-14): Denial of Service Vulnerability in SIMATIC WinCC
Title
SSA-730482 V1.2 (Last Update: 2025-01-14): Denial of Service Vulnerability in SIMATIC WinCC
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-730482.html
Summary
A vulnerability in the login dialog box of SIMATIC WinCC could allow a local attacker to cause a denial of service condition in the runtime of the SCADA system. Siemens has released new versions for the affected products and recommends to update to the latest versions.
14.01.2025
SIEMENS CERT
SSA-871035 V1.1 (Last Update: 2025-01-14): Session-Memory Deserialization Vulnerability in Siemens Engineering Platforms Before...
Title
SSA-871035 V1.1 (Last Update: 2025-01-14): Session-Memory Deserialization Vulnerability in Siemens Engineering Platforms Before V19
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-871035.html
Summary
Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for ...
14.01.2025
SIEMENS CERT
SSA-999588 V1.7 (Last Update: 2025-01-14): Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2
Title
SSA-999588 V1.7 (Last Update: 2025-01-14): Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-999588.html
Summary
Siemens User Management Component (UMC) before V2.11.2 is affected by multiple vulnerabilities where the most severe could lead to a restart of the UMC server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes ...
14.01.2025
SIEMENS CERT
SSA-773256 V1.3 (Last Update: 2025-01-14): Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products
Title
SSA-773256 V1.3 (Last Update: 2025-01-14): Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-773256.html
Summary
A Socket.IO vulnerability affects multiple Siemens industrial products. This vulnerability consists of a specially crafted Socket.IO packet that triggers an uncaught exception on the Socket.IO server killing the Node.js process allowing a remote attacker to cause Denial-of-Service condition in the affected products. Siemens has released new versions for several affected ...
14.01.2025
SIEMENS CERT
SSA-723487 V1.4 (Last Update: 2025-01-14): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE,...
Title
SSA-723487 V1.4 (Last Update: 2025-01-14): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-723487.html
Summary
This advisory documents the impact of CVE-2024-3596 (also dubbed “Blastradius”), a vulnerability in the RADIUS protocol, to SCALANCE, RUGGEDCOM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., SCALANCE or RUGGEDCOM devices) and a RADIUS server (e.g., SINEC INS), to ...
14.01.2025
SIEMENS CERT
SSA-717113 V1.0: Cross-Site Request Forgery (CSRF) Vulnerability in SIMATIC S7-1200 CPUs before V4.7
Title
SSA-717113 V1.0: Cross-Site Request Forgery (CSRF) Vulnerability in SIMATIC S7-1200 CPUs before V4.7
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-717113.html
Summary
The web interface of SIMATIC S7-1200 CPUs before V4.7 is affected by a cross-site request forgery (CSRF) vulnerability. Siemens has released new versions for the affected products and recommends to update to the latest versions.
14.01.2025
SIEMENS CERT
SSA-690517 V1.2 (Last Update: 2025-01-14): Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11ax Family
Title
SSA-690517 V1.2 (Last Update: 2025-01-14): Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11ax Family
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-690517.html
Summary
SCALANCE W-700 IEEE 802.11ax family devices are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11ax family and recommends to update to the latest version. Siemens recommends countermeasures for vulnerabilities where fixes are not, or not yet available.
14.01.2025
SIEMENS CERT
SSA-629254 V1.3 (Last Update: 2025-01-14): Remote Code Execution Vulnerability in SIMATIC SCADA and PCS 7 systems
Title
SSA-629254 V1.3 (Last Update: 2025-01-14): Remote Code Execution Vulnerability in SIMATIC SCADA and PCS 7 systems
Published
Jan. 14, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-629254.html
Summary
The products listed below contain a remote code execution vulnerability that could allow an authenticated remote attacker to execute arbitrary code with high privileges. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, ...
10.01.2025
US CERT (ICS)
Delta Electronics DRASimuCAD
Title
Delta Electronics DRASimuCAD
Published
Jan. 10, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-03-0
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DRASimuCAD Vulnerabilities: Out-of-bounds Write, Type Confusion 2. RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device or potentially allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ...
10.01.2025
US CERT (ICS)
Schneider Electric PowerChute Serial Shutdown
Title
Schneider Electric PowerChute Serial Shutdown
Published
Jan. 10, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: PowerChute Serial Shutdown Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial of access to the web interface when someone on the local network repeatedly requests the ...
10.01.2025
US CERT (ICS)
Schneider Electric Harmony HMI and Pro-face HMI Products
Title
Schneider Electric Harmony HMI and Pro-face HMI Products
Published
Jan. 10, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Harmony HMI and Pro-face HMI Products Vulnerability: Use of Unmaintained Third-Party Components 2. RISK EVALUATION Successful exploitation of this vulnerability could cause complete control of the device when an authenticated user installs malicious ...

Last Updates

BOSCH PSIRT
06.12.2024
SIEMENS CERT
14.01.2025
US CERT
08.11.2024
US CERT (ICS)
10.01.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds