SIEMENS CERT
04/13/2021
Siemens has released hotfixes for Siveillance Video Open Network Bridge (ONVIF) which fix a security vulnerability related to unsecure storage of ONVIF user credentials. The vulnerability could allow an authenticated remote attacker to retrieve and decrypt all user credentials stored on the ONVIF server. Siemens recommends to apply the hotfixes …
SIEMENS CERT
04/13/2021
Due to SmartClient Installation technology (ClickOnce) a customer/integrator needs to create a customer specific Smartclient installer. The mentioned products delivered a trusted but yet expired codesigning certificate. An attacker could have exploited the vulnerability by spoofing the code-signing certificate and signing a malicious executable resulting in having a trusted digital …
SIEMENS CERT
03/09/2021
Several industrial products are affected by a vulnerability that could allow remote attackers to conduct a Denial-of-Service (DoS) attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates …
SIEMENS CERT
03/09/2021
The Solid Edge installation package includes a specific version of the third-party product KeyShot from Luxion, which may not contain the latest security fixes provided by Luxion. Siemens recommends to update KeyShot according to the information in the Luxion Security Advisory LSA-192169.
SIEMENS CERT
03/09/2021
Multiple vulnerabilities affecting SIMATIC S7-PLCSIM V5.4 could allow an attacker with local access to the system to craft special project files that may lead to denial-of-service attacks. Siemens recommends specific workarounds and mitigations.
SIEMENS CERT
03/09/2021
Some firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the SSH authentication that could allow an attacker to cause a Denial-of-Service under certain conditions. Siemens has released an update for the SCALANCE SC-600 family and recommends to update to the latest version. …
SIEMENS CERT
03/09/2021
PLUSCONTROL 1st Gen devices are affected by a vulnerability as initially reported in SSA-362164 for the Mentor Nucleus TCP/IP stack. The vulnerability could allow an attacker located in the same network to hijack or terminate TCP/IP sessions of a vulnerable device. Siemens Energy recommends specific countermeasures for use cases of …
SIEMENS CERT
03/09/2021
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as “AMNESIA:33” vulnerabilities. This advisory describes the impact of two of these vulnerabilities (CVE-2020-13987, CVE-2020-17437) to Siemens products. Siemens has released updates for several affected products and recommends to update to the latest …