November 2024
18.11.2024
SIEMENS CERT
SSA-824503 V1.0: Multiple WRL File Parsing Vulnerabilities in Tecnomatix Plant Simulation Before V2302.0018 and V2404.0007
Title
SSA-824503 V1.0: Multiple WRL File Parsing Vulnerabilities in Tecnomatix Plant Simulation Before V2302.0018 and V2404.0007
Published
Nov. 18, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-824503.html
Summary
Siemens Tecnomatix Plant Simulation contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code ...
14.11.2024
US CERT (ICS)
Siemens Engineering Platforms
Title
Siemens Engineering Platforms
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-07
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.11.2024
US CERT (ICS)
2N Access Commander
Title
2N Access Commander
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-17
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3.1 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: 2N Equipment: Access Commander Vulnerabilities: Path Traversal, Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate their privileges, execute arbitrary code, or gain root access to ...
14.11.2024
US CERT (ICS)
Rockwell Automation FactoryTalk Updater (Update A)
Title
Rockwell Automation FactoryTalk Updater (Update A)
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-14
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Updater Vulnerabilities: Insecure Storage of Sensitive Information, Improper Input Validation, Improperly Implemented Security Check for Standard 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an authentication bypass, remote code ...
14.11.2024
US CERT (ICS)
Rockwell Automation FactoryTalk Updater
Title
Rockwell Automation FactoryTalk Updater
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-14
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Updater Vulnerabilities: Insecure Storage of Sensitive Information, Improper Input Validation, Improperly Implemented Security Check for Standard 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an authentication bypass, remote code ...
14.11.2024
US CERT (ICS)
Rockwell Automation Arena Input Analyzer
Title
Rockwell Automation Arena Input Analyzer
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-15
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.0 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: Arena Input Analyzer Vulnerability: Improper Validation of Specified Quantity in Input 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code on the program. 3. ...
14.11.2024
US CERT (ICS)
Siemens SCALANCE M-800 Family
Title
Siemens SCALANCE M-800 Family
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-06
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.11.2024
US CERT (ICS)
Siemens TeleControl Server
Title
Siemens TeleControl Server
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-10
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.11.2024
US CERT (ICS)
Siemens SIPORT
Title
Siemens SIPORT
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-02
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.11.2024
US CERT (ICS)
Rockwell Automation Verve Reporting (Update A)
Title
Rockwell Automation Verve Reporting (Update A)
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-13
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Verve Reporting Vulnerability: Dependency on Vulnerable Third-Party Component 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to arbitrary code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Verve ...
14.11.2024
US CERT (ICS)
Siemens OZW672 and OZW772 Web Server
Title
Siemens OZW672 and OZW772 Web Server
Published
Nov. 14, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-03
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
13.11.2024
SIEMENS CERT
SSA-472448 V1.0: Security Bypass Vulnerability in the SQL Client-Server Communication in Siveillance Video
Title
SSA-472448 V1.0: Security Bypass Vulnerability in the SQL Client-Server Communication in Siveillance Video
Published
Nov. 13, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-472448.html
Summary
Siveillance Video is affected by a security bypass vulnerability in the Microsoft .NET implementation of SQL Client as described in CVE-2024-0056. Siemens has released new versions for the affected products and recommends to update to the latest versions.
12.11.2024
US CERT (ICS)
Hitachi Energy TRO600
Title
Hitachi Energy TRO600
Published
Nov. 12, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-317-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: TRO600 Series Vulnerabilities: Command Injection, Improper Removal of Sensitive Information Before Storage or Transfer 2. RISK EVALUATION Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for ...
12.11.2024
SIEMENS CERT
SSA-629254 V1.2 (Last Update: 2024-11-12): Remote Code Execution Vulnerability in SIMATIC SCADA and PCS 7 systems
Title
SSA-629254 V1.2 (Last Update: 2024-11-12): Remote Code Execution Vulnerability in SIMATIC SCADA and PCS 7 systems
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-629254.html
Summary
The products listed below contain a remote code execution vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code with high privileges. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures ...
12.11.2024
SIEMENS CERT
SSA-616032 V1.0: Local Privilege Escalation Vulnerability in Spectrum Power 7 Before V24Q3
Title
SSA-616032 V1.0: Local Privilege Escalation Vulnerability in Spectrum Power 7 Before V24Q3
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-616032.html
Summary
Spectrum Power 7 before V24Q3 contains several root-owned SUID binaries that could allow an authenticated local attacker to escalate privileges. Siemens has released a new version for Spectrum Power 7 and recommends to update to the latest version.
12.11.2024
SIEMENS CERT
SSA-599968 V1.7 (Last Update: 2024-11-12): Denial-of-Service Vulnerability in Profinet Devices
Title
SSA-599968 V1.7 (Last Update: 2024-11-12): Denial-of-Service Vulnerability in Profinet Devices
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-599968.html
Summary
A vulnerability in affected devices could allow an attacker to perform a denial-of-service attack if a large amount of Profinet Discovery and Configuration Protocol (DCP) reset packets is sent to the affected devices. Siemens has released new versions for several affected products and recommends to update to the latest versions. ...
12.11.2024
SIEMENS CERT
SSA-773256 V1.1 (Last Update: 2024-11-12): Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products
Title
SSA-773256 V1.1 (Last Update: 2024-11-12): Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-773256.html
Summary
A Socket.IO vulnerability affects multiple Siemens industrial products. This vulnerability consists of a specially crafted Socket.IO packet that triggers an uncaught exception on the Socket.IO server killing the Node.js process allowing a remote attacker to cause Denial-of-Service condition in the affected products. Siemens has released new versions for several affected ...
12.11.2024
SIEMENS CERT
SSA-398330 V2.0 (Last Update: 2024-11-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...
Title
SSA-398330 V2.0 (Last Update: 2024-11-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not ...
12.11.2024
SIEMENS CERT
SSA-351178 V1.0: Multiple Vulnerabilities in Solid Edge Before SE2024 Update 9
Title
SSA-351178 V1.0: Multiple Vulnerabilities in Solid Edge Before SE2024 Update 9
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-351178.html
Summary
Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as PAR or PSM format, and by a DLL hijacking vulnerability. This could allow an attacker to crash the application or execute arbitrary code. Siemens has ...
12.11.2024
SIEMENS CERT
SSA-265688 V1.3 (Last Update: 2024-11-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP ...
Title
SSA-265688 V1.3 (Last Update: 2024-11-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
12.11.2024
SIEMENS CERT
SSA-914892 V1.0: Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime
Title
SSA-914892 V1.0: Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-914892.html
Summary
The basic authentication mechanism of Mendix Runtime contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are ...
12.11.2024
SIEMENS CERT
SSA-915275 V1.0: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3
Title
SSA-915275 V1.0: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-915275.html
Summary
SINEC INS before V1.0 SP2 Update 3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC INS and recommends to update to the latest version.
12.11.2024
SIEMENS CERT
SSA-654798 V1.0: Incorrect Authorization Vulnerability in SIMATIC CP 1543-1 Devices
Title
SSA-654798 V1.0: Incorrect Authorization Vulnerability in SIMATIC CP 1543-1 Devices
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-654798.html
Summary
SIMATIC CP 1543-1 devices contain an Incorrect Authorization vulnerability that could allow an unauthenticated attacker to gain access to the filesystem. Siemens has released a new version for SIMATIC CP 1543-1 V4.0 and recommends to update to the latest version.
12.11.2024
SIEMENS CERT
SSA-723487 V1.2 (Last Update: 2024-11-12): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE,...
Title
SSA-723487 V1.2 (Last Update: 2024-11-12): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-723487.html
Summary
This advisory documents the impact of CVE-2024-3596 (also dubbed “Blastradius”), a vulnerability in the RADIUS protocol, to SCALANCE, RUGGEDCOM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., SCALANCE or RUGGEDCOM devices) and a RADIUS server (e.g., SINEC INS), to ...
12.11.2024
SIEMENS CERT
SSA-883918 V1.2 (Last Update: 2024-11-12): Information Disclosure Vulnerability in SIMATIC WinCC
Title
SSA-883918 V1.2 (Last Update: 2024-11-12): Information Disclosure Vulnerability in SIMATIC WinCC
Published
Nov. 12, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-883918.html
Summary
Multiple versions of SIMATIC WinCC and SIMATIC PCS 7 do not properly handle certain requests to their web application (WinCC WebNavigator, PCS 7 Web Server, and PCS 7 Web Diagnostics Server), which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information ...

Last Updates

BOSCH PSIRT
31.10.2024
SIEMENS CERT
18.11.2024
US CERT
08.11.2024
US CERT (ICS)
14.11.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds