SIEMENS CERT
02/09/2021
There exists a directory traversal vulnerability which allows arbitrary file upload to an affected system. This type of vulnerability is also known as ‘Zip-Slip’. An authenticated attacker could exploit this vulnerability to gain arbitrary code execution by uploading a new or modifying an existing file to an affected system. Siemens …
SIEMENS CERT
02/09/2021
A vulnerability exists in several SCALANCE X switches that could allow external entities to reconstruct passwords for users of the affected devices if an attacker is able to obtain a backup of the device configuration. Siemens has released updates for several affected products and recommends to update to the latest …
SIEMENS CERT
02/09/2021
The latest update for the below listed products fixes two security vulnerabilities that could allow an attacker to cause a partial Denial-of-Service on the UMC component of the affected devices under certain circumstances, and one vulnerability that could allow an attacker to locally escalate privileges from a user with administrative …
SIEMENS CERT
02/09/2021
The Climatix BACnet/IP (POL908) and AWM (POL909) modules contain two persistent cross-site scripting (XSS) vulnerabilities in the web interface that could allow a remote attacker to execute arbitrary JavaScript code in the context of other users’ web sessions. Siemens has released an update for Climatix POL909 and recommends to update …
SIEMENS CERT
02/09/2021
A vulnerability in the SIMATIC WinCC Graphics Designer tool could allow an attacker that has physical access to a machine running the software to get access to the user’s private password-protected pictures. Siemens has released an update for SIMATIC WinCC and recommends to update to the latest version. Siemens recommends …
SIEMENS CERT
02/09/2021
Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session on the administrative interface of the switch. Siemens has …
SIEMENS CERT
02/09/2021
Several industrial products are affected by a vulnerability that could allow remote attackers to conduct a Denial-of-Service (DoS) attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released updates for several affected products and recommends to update to the new versions. Siemens is preparing further updates and …
SIEMENS CERT
02/09/2021
A vertical privilege escalation vulnerability exists in DIGSI 4. Siemens has released an update for DIGSI 4 and recommends to update to the latest version.