February 2020
10.02.2020
SIEMENS CERT
SSA-100232 (Last Update: 2020-02-10): Denial-of-Service vulnerability in SCALANCE X switches
Title
SSA-100232 (Last Update: 2020-02-10): Denial-of-Service vulnerability in SCALANCE X switches
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-100232.pdf
Summary
A vulnerability in the affected devices could allow an unauthenticated attacker with network access to an affected device to perform a denial-of-service. Siemens is preparing updates and recommends specific countermeasures until patches are available.
10.02.2020
SIEMENS CERT
SSA-310688 (Last Update: 2020-02-10): Denial-of-Service Vulnerability in SIMATIC S7-1500 CPU
Title
SSA-310688 (Last Update: 2020-02-10): Denial-of-Service Vulnerability in SIMATIC S7-1500 CPU
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-310688.pdf
Summary
The latest firmware update for the SIMATIC S7-1500 CPU family fixes a vulnerability which could allow an attacker to perform a Denial-of-Service attack under certain conditions. The attacker must have network access to the device to exploit this vulnerability.
10.02.2020
SIEMENS CERT
SSA-253230 (Last Update: 2020-02-10): Vulnerabilities in SIMATIC S7-1500 CPU family
Title
SSA-253230 (Last Update: 2020-02-10): Vulnerabilities in SIMATIC S7-1500 CPU family
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-253230.pdf
Summary
Siemens has released a firmware update for the SIMATIC S7-1500 CPU family which fixes two vulnerabilities. The more severe of these vulnerabilities could allow attackers to cause a Denial-of-Service under certain conditions.
10.02.2020
SIEMENS CERT
SSA-130874 (Last Update: 2020-02-10): Multiple Security Vulnerabilities in SCALANCE X Switches
Title
SSA-130874 (Last Update: 2020-02-10): Multiple Security Vulnerabilities in SCALANCE X Switches
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-130874.pdf
Summary
A denial of service vulnerability was found in several Siemens Scalance X switches. Siemens addresses the vulnerability by two firmware upgrades. The web server of the vulnerable switches is susceptible to a remote denial of service attack. If the attack is executed, it causes a reboot of the device and ...
10.02.2020
SIEMENS CERT
SSA-134003 (Last Update: 2020-02-10): Web Vulnerability in SIMATIC S7-1200 Family
Title
SSA-134003 (Last Update: 2020-02-10): Web Vulnerability in SIMATIC S7-1200 Family
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-134003.pdf
Summary
The latest firmware update for SIMATIC S7-1200 CPUs fixes a vulnerability that could allow an attacker to perform a CSRF (Cross-Site Request Forgery) attack under certain conditions.
10.02.2020
SIEMENS CERT
SSA-944083 (Last Update: 2020-02-10): HTTP Header Injection in SIMATIC Panels and SIMATIC WinCC (TIA Portal)
Title
SSA-944083 (Last Update: 2020-02-10): HTTP Header Injection in SIMATIC Panels and SIMATIC WinCC (TIA Portal)
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf
Summary
The latest update for SIMATIC Panel software and SIMATIC WinCC (TIA Portal) fixes a vulnerability that could allow an attacker with network access to the web server to perform a HTTP header injection attack.
10.02.2020
SIEMENS CERT
SSA-597212 (Last Update: 2020-02-10): Web Vulnerability in SIMATIC S7-1200 CPU Family
Title
SSA-597212 (Last Update: 2020-02-10): Web Vulnerability in SIMATIC S7-1200 CPU Family
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-597212.pdf
Summary
The latest firmware version V4.1 of the SIMATIC S7-1200 CPU fixes one vulnerability. The vulnerability could allow an attacker to redirect users to untrusted sites under certain conditions.
10.02.2020
SIEMENS CERT
SSA-168644 (Last Update: 2020-02-10): Spectre and Meltdown Vulnerabilities in Industrial Products
Title
SSA-168644 (Last Update: 2020-02-10): Spectre and Meltdown Vulnerabilities in Industrial Products
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-168644.pdf
Summary
Security researchers published information on vulnerabilities known as Spectre and Meltdown. These vulnerabilities affect many modern processors from different vendors to a varying degree. Several Industrial Products include affected processors and are affected by the vulnerabilities.
10.02.2020
SIEMENS CERT
SSA-176087 (Last Update: 2020-02-10): Unauthenticated Access to Critical Services in SCALANCE X-200 Switch Family
Title
SSA-176087 (Last Update: 2020-02-10): Unauthenticated Access to Critical Services in SCALANCE X-200 Switch Family
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-176087.pdf
Summary
A potential vulnerability was discovered in the web server authentication of SCALANCE X-200 and X-200IRT switches that might allow attackers to perform administrative operations over the network without authentication. This issue only applies to switches using older firmware versions and has been fixed from firmware V4.5.0 (non-IRT) and V5.1.0 (IRT) ...
10.02.2020
SIEMENS CERT
SSA-87240 (Last Update: 2020-02-10): Vulnerabilities in SIEMENS LOGO!
Title
SSA-87240 (Last Update: 2020-02-10): Vulnerabilities in SIEMENS LOGO!
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-87240.pdf
Summary
Two vulnerabilities have been identified in SIEMENS LOGO!8 BM devices. The most severe vulnerability could allow an attacker to hijack existing web sessions. Siemens provides LOGO!8 BM FS-05 with firmware version V1.81.2, which fixes the first vulnerability, and recommends specific mitigations for the second vulnerability.
10.02.2020
SIEMENS CERT
SSA-654382 (Last Update: 2020-02-10): Vulnerabilities in SIMATIC S7-1200 CPU Familiy
Title
SSA-654382 (Last Update: 2020-02-10): Vulnerabilities in SIMATIC S7-1200 CPU Familiy
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf
Summary
The latest product release of the SIMATIC S7-1200 CPU fixes several vulnerabilities. The most severe of these vulnerabilities could allow an attacker to take over an authenticated web session if the session token can be predicted. The attacker must have network access to the device to exploit this vulnerability. Further ...
10.02.2020
SIEMENS CERT
SSA-774850 (Last Update: 2020-02-10): Vulnerabilities in SIEMENS LOGO!8 devices
Title
SSA-774850 (Last Update: 2020-02-10): Vulnerabilities in SIEMENS LOGO!8 devices
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf
Summary
Two vulnerabilities have been identified in SIEMENS LOGO!8 devices. The Session ID on the integrated webserver of LOGO!8 devices is not invalidated upon logout. The second vulnerability could allow an attacker with network access to port 10005/tcp to cause a Denial-of-Service condition by sending specifically crafted packages to the service. ...
10.02.2020
SIEMENS CERT
SSA-234763 (Last Update: 2020-02-10): OpenSSL Vulnerabilities in Siemens Industrial Products
Title
SSA-234763 (Last Update: 2020-02-10): OpenSSL Vulnerabilities in Siemens Industrial Products
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf
Summary
Vulnerabilities in OpenSSL (see https://www.openssl.org/news/secadv_20140605.txt) affect several Siemens industrial products. Siemens has released updates for all affected products.
10.02.2020
SIEMENS CERT
SSA-874235 (Last Update: 2020-02-10): Intel Vulnerability in Siemens Industrial Products
Title
SSA-874235 (Last Update: 2020-02-10): Intel Vulnerability in Siemens Industrial Products
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf
Summary
Several Intel chipsets for Intel Core i5, Intel Core i7 and Intel XEON are susceptible to remote code execution vulnerability (CVE-2017-5689) [1]. As several Siemens Industrial Products use Intel technology, they are also affected. Siemens has released updates for the affected Industrial PCs. [1] Intel Security Advisory – INTEL-SA-00075:https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
10.02.2020
SIEMENS CERT
SSA-254686 (Last Update: 2020-02-10): Foreshadow / L1 Terminal Fault Vulnerabilities in Industrial Products
Title
SSA-254686 (Last Update: 2020-02-10): Foreshadow / L1 Terminal Fault Vulnerabilities in Industrial Products
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-254686.pdf
Summary
Security researchers published information on vulnerabilities known as Foreshadow and L1 Terminal Fault (L1TF). These vulnerabilities affect many modern processors from different vendors to a varying degree. Several Siemens Industrial Products contain processors that are affected by the vulnerabilities.
10.02.2020
SIEMENS CERT
SSA-584286 (Last Update: 2020-02-10): Denial-of-Service Vulnerability in SIMATIC S7-1200 CPU and SIMATIC S7-1500 CPU
Title
SSA-584286 (Last Update: 2020-02-10): Denial-of-Service Vulnerability in SIMATIC S7-1200 CPU and SIMATIC S7-1500 CPU
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-584286.pdf
Summary
A vulnerability was identified in SIMATIC S7-1200 and S7-1500 CPUs that could allow an attacker to cause a denial-of-service condition preventing HMI or engineering access to the PLC over port 102/tcp. Siemens has released an update for the S7-1500 product and recommends that customers update to the new version. Siemens ...
10.02.2020
SIEMENS CERT
SSA-507847 (Last Update: 2020-02-10): Cross-Site Request Forgery Vulnerability in SIMATIC S7-1200 CPU Family Version 4
Title
SSA-507847 (Last Update: 2020-02-10): Cross-Site Request Forgery Vulnerability in SIMATIC S7-1200 CPU Family Version 4
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-507847.pdf
Summary
The latest firmware update for S7-1200 CPU family version 4 fixes a Cross-Site Request Forgery vulnerability. Siemens recommends to update affected devices as soon as possible.
10.02.2020
SIEMENS CERT
SSA-954136 (Last Update: 2020-02-10): User Impersonation Vulnerability in SCALANCE X-200IRT Switch Family
Title
SSA-954136 (Last Update: 2020-02-10): User Impersonation Vulnerability in SCALANCE X-200IRT Switch Family
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-954136.pdf
Summary
The latest firmware update for the SCALANCE X-200IRT switch family fixes a vulnerability which could allow attackers to impersonate legitimate users of the web interface.
10.02.2020
SIEMENS CERT
SSA-542701 (Last Update: 2020-02-10): Vulnerabilities in SIEMENS LOGO!
Title
SSA-542701 (Last Update: 2020-02-10): Vulnerabilities in SIEMENS LOGO!
Published
Feb. 10, 2020, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf
Summary
Multiple vulnerabilities have been identified in SIEMENS LOGO!8 BM devices. The most severe vulnerability could lead to an attacker reading and modifying the device configuration if the attacker has access to port 10005/tcp.
04.02.2020
US CERT (ICS)
AutomationDirect C-More Touch Panels
Title
AutomationDirect C-More Touch Panels
Published
Feb. 4, 2020, 4 p.m.
URL
https://www.us-cert.gov/ics/advisories/icsa-20-035-01
Summary
This advisory contains mitigations for an insufficiently protected credentials vulnerability in AutomationDirect's C-More Touch Panels software management platform.
January 2020
30.01.2020
US CERT (ICS)
Medtronic Conexus Radio Frequency Telemetry Protocol (Update A)
Title
Medtronic Conexus Radio Frequency Telemetry Protocol (Update A)
Published
Jan. 30, 2020, 4:05 p.m.
URL
https://www.us-cert.gov/ics/advisories/ICSMA-19-080-01
Summary
This updated advisory is a follow-up to the original advisory titled ICSMA-19-080-01 Medtronic Conexus Radio Frequency Telemetry Protocol that was published March 21, 2019, on the ICS webpage on us-cert.gov. This medical advisory includes mitigations for improper access control and cleartext transmission of sensitive information vulnerabilities reported in Medtronic's proprietary ...
30.01.2020
US CERT (ICS)
Medtronic 2090 Carelink Programmer Vulnerabilities (Update C)
Title
Medtronic 2090 Carelink Programmer Vulnerabilities (Update C)
Published
Jan. 30, 2020, 4 p.m.
URL
https://www.us-cert.gov/ics/advisories/ICSMA-18-058-01
Summary
This updated advisory is a follow-up to the updated advisory titled ICSMA-18-058-01 Medtronic 2090 Carelink Programmer Vulnerabilities (Update B) that was published October 11, 2018, ICS webpage on us-cert.gov. This medical device advisory contains mitigation details for vulnerabilities in Medtronic’s 2090 CareLink Programmer and its accompanying software deployment network.
29.01.2020
BOSCH PSIRT
Missing Authentication for Critical Function in Bosch Video Streaming Gateway
Title
Missing Authentication for Critical Function in Bosch Video Streaming Gateway
Published
Jan. 29, 2020, 1 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-260625-bt.html
Summary

BOSCH-SA-260625-BT: A recently discovered security vulnerability affects the Bosch Video Streaming Gateway (VSG). The vulnerability is exploitable via the network interface. An unauthorized attacker can retrieve and set arbitrary configuration data of the VSG. Bosch rates this vulnerability with a CVSS v3.1 Base Score of 10.0 (Critical) and strongly recommends ...

29.01.2020
BOSCH PSIRT
Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service
Title
Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service
Published
Jan. 29, 2020, 1 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-885551-bt.html
Summary

BOSCH-SA-885551-BT: A recently discovered security vulnerability affects the BVMS Mobile Video Service (BVMS MVS). The vulnerability is exploitable via the network interface. Bosch rates this vulnerability with a CVSS v3.1 Base Score of 10.0 (Critical) and recommends customers to update the vulnerable components with fixed software versions. The vulnerability was ...

29.01.2020
BOSCH PSIRT
Path Traversal in Bosch Video Management System
Title
Path Traversal in Bosch Video Management System
Published
Jan. 29, 2020, 1 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-381489-bt.html
Summary

BOSCH-SA-381489-BT: A path traversal vulnerability exists in the BVMS. An authenticated BVMS user can successfully request and fetch arbitrary files from the Central Server machine using the FileTransferService. Bosch rates this vulnerability with a CVSS v3.1 Base Score of 7.7 (High) and strongly recommends customers to update vulnerable components with ...

Last Updates

BOSCH PSIRT
25.04.2025
SIEMENS CERT
17.04.2025
US CERT
01.04.2025
US CERT (ICS)
24.04.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds