January 2025
Title
HMS Networks Ewon Flexy 202
Published
Jan. 23, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Low attack complexity Vendor: HMS Networks Equipment: Ewon Flexy 202 Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose sensitive user credentials. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following ...
Title
Schneider Electric EVlink Home Smart and Schneider Charge
Published
Jan. 23, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: EVlink Home Smart and Schneider Charge Vulnerability: Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability may expose test credentials in the firmware binary. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...
Title
Schneider Electric EcoStruxure Power Build Rapsody
Published
Jan. 23, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 4.6 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: EcoStruxure Power Build Rapsody Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of this vulnerability could allow local attackers to potentially execute arbitrary code when ...
Title
Hitachi Energy RTU500 Series Product
Published
Jan. 23, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: RTU500 series products Vulnerability: Improperly Implemented Security Check for Standard 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to to update the RTU500 with unsigned firmware. 3. TECHNICAL DETAILS ...
Title
Siemens SIMATIC S7-1200 CPUs
Published
Jan. 21, 2025, 1 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
ZF Roll Stability Support Plus (RSSPlus)
Published
Jan. 21, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Exploitable from an adjacent network/low attack complexity Vendor: ZF Equipment: RSSPlus Vulnerability: Authentication Bypass By Primary Weakness 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to remotely (proximal/adjacent with RF equipment) call diagnostic functions which could ...
Title
Traffic Alert and Collision Avoidance System (TCAS) II
Published
Jan. 21, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Exploitable from adjacent network Standard: Traffic Alert and Collision Avoidance System (TCAS) II Equipment: Collision Avoidance Systems Vulnerabilities: Reliance on Untrusted Inputs in a Security Decision, External Control of System or Configuration Setting 2. RISK EVALUATION Successful exploitation of these vulnerabilities ...
Title
Siemens SIPROTEC 5 Products
Published
Jan. 16, 2025, 1 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
Hitachi Energy FOX61x, FOXCST, and FOXMAN-UN Products
Published
Jan. 16, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 4.9 ATTENTION: Low attack complexity Vendor: Hitachi Energy Equipment: FOX61x, FOXCST, FOXMAN-UN Vulnerability: Improper Validation of Certificate with Host Mismatch 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to intercept or falsify data exchanges between the client and the server. ...
Title
Fuji Electric Alpha5 SMART
Published
Jan. 16, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Fuji Electric Equipment: Alpha5 SMART Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Fuji Electric ...
Title
Siemens Mendix LDAP
Published
Jan. 16, 2025, 1 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
Hitachi Energy FOX61x Products
Published
Jan. 16, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 4.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: FOX61x Products Vulnerability: Relative Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to traverse the file system to access files or directories that would otherwise be inaccessible. ...
Title
Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications
Published
Jan. 15, 2025, 6:26 p.m.
Summary
Note: The CVEs in this advisory are unrelated to vulnerabilities (CVE-2025-0282 and CVE-2025-0283) in Ivanti’s Connect Secure, Policy Secure and ZTA Gateways. For more information on mitigating CVE -2025-0282 and CVE-2025-0283, see Ivanti Releases Security Updates for Connect Secure, Policy Secure, and ZTA Gateways. Summary The Cybersecurity and Infrastructure Security ...
Title
Unquoted Service Path Enumeration on SMCWatchDog Agent
Published
Jan. 15, 2025, 1 a.m.
Summary

BOSCH-SA-904062-BT: An unquoted service path enumeration vulnerability on SMCWatchDog agent has been found affecting the DIVAR IP all-in-one 7000 (DIP-72xx) devices. This vulnerability can allow a local attacker to gain elevated privileges.

Title
SSA-404759 V1.1 (Last Update: 2025-01-15): Information Disclosure Vulnerability in Siveillance Video Camera Drivers
Published
Jan. 15, 2025, 1 a.m.
Summary
Several camera device drivers in the Siveillance Video Device Pack store camera credentials in their log file when authentication fails. This could allow a local attacker to read camera credentials stored in the Recording Server under specific conditions. Siemens has released an update of the Device Pack and recommends to ...
Title
Schneider Electric Vijeo Designer
Published
Jan. 14, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low Attack Complexity Vendor: Schneider Electric Equipment: Vijeo Designer Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause a non-admin authenticated user to perform privilege escalation by tampering with the binaries. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
Title
Belledonne Communications Linphone-Desktop
Published
Jan. 14, 2025, 1 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Belledonne Communications Equipment: Linphone-Desktop Vulnerability: NULL Pointer Dereference 2. RISK EVALUATION Successful exploitation of this vulnerability could could result in a remote attacker causing a denial-of-service condition on the affected devices. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
Title
SSA-416411 V1.0: Cross-Site Scripting Vulnerability in Industrial Edge Management
Published
Jan. 14, 2025, 1 a.m.
Summary
Industrial Edge Management is affected by a reflected cross-site scripting (XSS) vulnerability that could allow an attacker to extract sensitive information by tricking users into accessing a malicious link. Siemens recommends countermeasures for products where fixes are not, or not yet available.
Title
SSA-482757 V1.5 (Last Update: 2025-01-14): Missing Immutable Root of Trust in S7-1500 CPU devices
Published
Jan. 14, 2025, 1 a.m.
Summary
Affected models of the S7-1500 CPU product family do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to replace the boot ...
Title
SSA-593272 V2.3 (Last Update: 2025-01-14): SegmentSmack in Interniche IP-Stack based Industrial Devices
Published
Jan. 14, 2025, 1 a.m.
Summary
A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released new versions for ...
Title
SSA-446448 V2.3 (Last Update: 2025-01-14): Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Published
Jan. 14, 2025, 1 a.m.
Summary
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, contains a vulnerability that could allow an attacker to cause a denial of service condition on affected industrial products. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific ...
Title
SSA-413565 V1.4 (Last Update: 2025-01-14): Multiple Vulnerabilities in SCALANCE Products
Published
Jan. 14, 2025, 1 a.m.
Summary
Multiple SCALANCE devices are affected by several vulnerabilities that could allow an attacker to inject code, retrieve data as debug information as well as user CLI passwords or set the CLI to an irresponsive state. Siemens has released updates for the affected products and recommends to update to the latest ...
Title
SSA-690517 V1.2 (Last Update: 2025-01-14): Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11ax Family
Published
Jan. 14, 2025, 1 a.m.
Summary
SCALANCE W-700 IEEE 802.11ax family devices are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11ax family and recommends to update to the latest version. Siemens recommends countermeasures for vulnerabilities where fixes are not, or not yet available.
Title
SSA-629254 V1.3 (Last Update: 2025-01-14): Remote Code Execution Vulnerability in SIMATIC SCADA and PCS 7 systems
Published
Jan. 14, 2025, 1 a.m.
Summary
The products listed below contain a remote code execution vulnerability that could allow an authenticated remote attacker to execute arbitrary code with high privileges. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, ...
Title
SSA-876787 V1.3 (Last Update: 2025-01-14): Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs
Published
Jan. 14, 2025, 1 a.m.
Summary
Several SIMATIC S7-1500 and S7-1200 CPU versions are affected by an open redirect vulnerability that could allow an attacker to make the web server of affected devices redirect a legitimate user to an attacker-chosen URL. For a successful attack, the legitimate user must actively click on an attacker-crafted link. Siemens ...

Last Updates

BOSCH PSIRT
15.01.2025
SIEMENS CERT
15.01.2025
US CERT
15.01.2025
US CERT (ICS)
23.01.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds