April 2025
Title
Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX
Published
April 15, 2025, 2 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
Siemens Industrial Edge Device Kit
Published
April 15, 2025, 2 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
Lantronix Xport (Update A)
Published
April 15, 2025, 2 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Lantronix Equipment: XPort Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker unauthorized access to the configuration interface and cause disruption to monitoring and operations. 3. TECHNICAL ...
Title
SSA-874353 V1.2 (Last Update: 2025-04-14): Entity Enumeration Vulnerability in Mendix Runtime
Published
April 14, 2025, 2 a.m.
Summary
Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has released new versions for several affected products and recommends to update to the latest ...
Title
Siemens SIDIS Prime
Published
April 10, 2025, 2 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
Siemens License Server
Published
April 10, 2025, 2 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
ABB Arctic Wireless Gateways
Published
April 10, 2025, 2 p.m.
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: Arctic Wireless Gateways Vulnerabilities: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Improper Privilege Management, Exposure of Sensitive Information to an Unauthorized Actor, Improper Limitation of a Pathname to a Restricted Directory ...
Title
Siemens SENTRON 7KT PAC1260 Data Manager
Published
April 10, 2025, 2 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
Siemens Industrial Edge Devices
Published
April 10, 2025, 2 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
Siemens Insights Hub Private Cloud
Published
April 10, 2025, 2 p.m.
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
Title
SSA-874353 V1.1 (Last Update: 2025-04-10): Entity Enumeration Vulnerability in Mendix Runtime
Published
April 10, 2025, 2 a.m.
Summary
Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has released new versions for several affected products and recommends to update to the latest ...
Title
SSA-767615 V1.2 (Last Update: 2025-04-08): Information Disclosure Vulnerability in SIPROTEC 5 Devices
Published
April 8, 2025, 2 a.m.
Summary
An information disclosure vulnerability in SIPROTEC 5 devices could allow an unauthenticated, remote attacker to retrieve sensitive information of the device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products ...
Title
SSA-770770 V1.2 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices
Published
April 8, 2025, 2 a.m.
Summary
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.
Title
SSA-725549 V1.0: Denial of Service of ICMP in Industrial Devices
Published
April 8, 2025, 2 a.m.
Summary
A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The integrated ICMP services in the underlying TCP/IP stack is vulnerable to a denial of service attack through specially crafted ICMP packets. A successful attack will impact the availability ...
Title
SSA-819629 V1.0: Weak Authentication Vulnerability in Industrial Edge Device Kit
Published
April 8, 2025, 2 a.m.
Summary
Industrial Edge Device Kit contains a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Industrial Edge Device Builders integrate Industrial Edge Device Kit into their offerings within the open Industrial Edge ecosystem. See further details about affected Industrial Edge Devices ...
Title
SSA-874353 V1.0: Entity Enumeration Vulnerability in Mendix Runtime
Published
April 8, 2025, 2 a.m.
Summary
Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has released new versions for several affected products and recommends to update to the latest ...
Title
SSA-817234 V1.0: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud
Published
April 8, 2025, 2 a.m.
Summary
Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for ...
Title
SSA-195895 V1.2 (Last Update: 2025-04-08): User Enumeration Vulnerability in the Webserver of SIMATIC Products
Published
April 8, 2025, 2 a.m.
Summary
The webserver of several SIMATIC products is affected by a user enumeration vulnerability that could allow an unauthenticated remote attacker to identify valid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Title
SSA-913875 V1.4 (Last Update: 2025-04-08): Frame Aggregation and Fragmentation Vulnerabilities in 802.11
Published
April 8, 2025, 2 a.m.
Summary
Twelve vulnerabilities in the implementation of frame aggregation and fragmentation of the 802.11 standard, under the name of FragAttacks, have been published. Successful exploitation of these vulnerabilities could allow an attacker within Wi-Fi range to forge encrypted frames, which could result in sensitive data disclosure and possibly traffic manipulation. The ...
Title
SSA-935500 V1.2 (Last Update: 2025-04-08): Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products
Published
April 8, 2025, 2 a.m.
Summary
A denial of service vulnerability has been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-313313: https://cert-portal.siemens.com/productcert/html/ssa-313313.html. The products listed below use affected versions of the Nucleus software and inherently contain the vulnerability. Siemens has released new versions for several affected products and ...
Title
SSA-265688 V1.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1
Published
April 8, 2025, 2 a.m.
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Title
SSA-876787 V1.5 (Last Update: 2025-04-08): Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs
Published
April 8, 2025, 2 a.m.
Summary
Several SIMATIC S7-1500 and S7-1200 CPU versions are affected by an open redirect vulnerability that could allow an attacker to make the web server of affected devices redirect a legitimate user to an attacker-chosen URL. For a successful attack, the legitimate user must actively click on an attacker-crafted link. Siemens ...
Title
SSA-698820 V1.6 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices
Published
April 8, 2025, 2 a.m.
Summary
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.
Title
SSA-672923 V1.0: Out of Bounds Write Vulnerability in Solid Edge
Published
April 8, 2025, 2 a.m.
Summary
Solid Edge is affected by an out of bounds write vulnerability that could be triggered when the application is parsing X_T data or a specially crafted file in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability ...
Title
SSA-187636 V1.0: Multiple Vulnerabilities in SENTRON 7KT PAC1260 Data Manager
Published
April 8, 2025, 2 a.m.
Summary
SENTRON 7KT PAC1260 Data Manager is affected by multiple vulnerabilities as listed below. Software fixes can no longer be provided for The SENTRON 7KT PAC1260 Data Manager. This advisory documents the known open vulnerabilities. To fix the vulnerabilities, Siemens recommends to replace the device by the new SENTRON 7KT PAC1261 ...

Last Updates

BOSCH PSIRT
25.04.2025
SIEMENS CERT
17.04.2025
US CERT
01.04.2025
US CERT (ICS)
24.04.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds