SIEMENS CERT
02/09/2021
The latest update for the below listed products fixes two security vulnerabilities that could allow an attacker to cause a partial Denial-of-Service on the UMC component of the affected devices under certain circumstances, and one vulnerability that could allow an attacker to locally escalate privileges from a user with administrative …
SIEMENS CERT
02/09/2021
The Climatix BACnet/IP (POL908) and AWM (POL909) modules contain two persistent cross-site scripting (XSS) vulnerabilities in the web interface that could allow a remote attacker to execute arbitrary JavaScript code in the context of other users’ web sessions. Siemens has released an update for Climatix POL909 and recommends to update …
SIEMENS CERT
02/09/2021
Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session on the administrative interface of the switch. Siemens has …
SIEMENS CERT
02/09/2021
There exists a directory traversal vulnerability which allows arbitrary file upload to an affected system. This type of vulnerability is also known as ‘Zip-Slip’. An authenticated attacker could exploit this vulnerability to gain arbitrary code execution by uploading a new or modifying an existing file to an affected system. Siemens …
SIEMENS CERT
02/09/2021
Some versions of Mentor Nucleus ReadyStart and Nucleus NET use Initial Sequence Numbers for TCP- Sessions that are predictable. Siemens has released updates for the affected products and recommends to update to the latest version(s).
SIEMENS CERT
02/09/2021
The latest update for ROX II contains multiple fixes for IPsec related vulnerabilities in Libreswan and NSS. Siemens has released updates for the affected products and recommends to update to the latest versions.
SIEMENS CERT
02/09/2021
The latest update for TIA Administrator, installed together with TIA Portal and PCS neo, fixes a privilege escalation vulnerability that could allow local users to escalate privileges and execute code as local SYSTEM user. Siemens has released an update for TIA Portal and recommends that customers update to the latest …
SIEMENS CERT
02/09/2021
A vertical privilege escalation vulnerability exists in DIGSI 4. Siemens has released an update for DIGSI 4 and recommends to update to the latest version.