January 2024
09.01.2024
SIEMENS CERT
SSA-712929 V2.5 (Last Update: 2024-01-09): Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Prod...
Title
SSA-712929 V2.5 (Last Update: 2024-01-09): Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Products
Published
Jan. 9, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-712929.html
Summary
A vulnerability in the openSSL component (CVE-2022-0778, [0]) could allow an attacker to create a denial of service condition by providing specially crafted elliptic curve certificates to products that use a vulnerable version of openSSL. Siemens has released updates for several affected products and recommends to update to the latest ...
09.01.2024
SIEMENS CERT
SSA-761617 V1.2 (Last Update: 2024-01-09): Authentication Bypass and Information Disclosure Vulnerabilities in SiNVR/SiVMS Vide...
Title
SSA-761617 V1.2 (Last Update: 2024-01-09): Authentication Bypass and Information Disclosure Vulnerabilities in SiNVR/SiVMS Video Server
Published
Jan. 9, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-761617.html
Summary
The Video Server application in SiNVR/SiVMS solutions contains two vulnerabilities involving authentication bypass (CVE-2019-18339) and information disclosure (CVE-2019-18340). PKE has released an update of the application that fixes CVE-2019-18339. This update is not available under the former Siemens OEM brand name SiNVR. For details contact PKE (https://pke.at/). Siemens recommends specific ...
09.01.2024
SIEMENS CERT
SSA-711309 V1.4 (Last Update: 2024-01-09): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products
Title
SSA-711309 V1.4 (Last Update: 2024-01-09): Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products
Published
Jan. 9, 2024, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-711309.html
Summary
The OPC UA implementations (ANSI C and C++) as used in several SIMATIC products contain a denial of service vulnerability that could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate. Siemens has released updates for several affected products and recommends ...
08.01.2024
BOSCH PSIRT
Multiple vulnerabilities in Nexo cordless nutrunner
Title
Multiple vulnerabilities in Nexo cordless nutrunner
Published
Jan. 8, 2024, 1 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-711465.html
Summary

BOSCH-SA-711465: The Nexo cordless nutrunner running NEXO-OS V1500-SP2 has some vulnerabilities which allows an attacker: - to read/upload/download/delete arbitrary files in all paths of the system, - to inject and execute arbitrary client-side script code, arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim's session, - to ...

04.01.2024
US CERT (ICS)
Rockwell Automation FactoryTalk Activation
Title
Rockwell Automation FactoryTalk Activation
Published
Jan. 4, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-004-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Activation Manager Vulnerabilities: Out-of-Bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in a buffer overflow and allow the attacker to gain full access to the system. 3. TECHNICAL ...
December 2023
21.12.2023
US CERT (ICS)
FXC AE1021/AE1021PE
Title
FXC AE1021/AE1021PE
Published
Dec. 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor: FXC Equipment: AE1021, AE1021PE Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution on the device via NTP server ...
21.12.2023
US CERT (ICS)
QNAP VioStor NVR
Title
QNAP VioStor NVR
Published
Dec. 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor: QNAP Equipment: VioStor NVR Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution by exploiting NTP settings. 3. TECHNICAL ...
19.12.2023
US CERT
#StopRansomware: ALPHV Blackcat
Title
#StopRansomware: ALPHV Blackcat
Published
Dec. 19, 2023, 3:31 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
Summary
SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...
19.12.2023
US CERT (ICS)
EuroTel ETL3100 Radio Transmitter
Title
EuroTel ETL3100 Radio Transmitter
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: EuroTel Equipment: ETL3100 Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Authorization Bypass Through User-Controlled Key, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to gain ...
19.12.2023
US CERT (ICS)
Subnet Solutions Inc. PowerSYSTEM Center
Title
Subnet Solutions Inc. PowerSYSTEM Center
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Subnet Solutions Inc. Equipment: PowerSYSTEM Center Vulnerability: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker achieving arbitrary code execution and privilege escalation through the unquoted service path. ...
19.12.2023
US CERT (ICS)
EFACEC UC 500E
Title
EFACEC UC 500E
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: EFACEC Equipment: UC 500 Vulnerabilities: Cleartext Transmission of Sensitive Information, Open Redirect, Exposure of Sensitive Information to an Unauthorized Actor, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to ...
19.12.2023
US CERT (ICS)
Open Design Alliance Drawing SDK
Title
Open Design Alliance Drawing SDK
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Open Design Alliance (ODA) Equipment: Drawing SDK Vulnerabilities: Use after Free, Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote attackers to disclose sensitive information on affected installations of ODA Drawing SDK. ...
19.12.2023
US CERT (ICS)
EFACEC BCU 500
Title
EFACEC BCU 500
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: EFACEC Equipment: BCU 500 Vulnerabilities: Uncontrolled Resource Consumption, Cross-site Request Forgery 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product or compromise the web ...
14.12.2023
US CERT (ICS)
Siemens OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC
Title
Siemens OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-06
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens User Management Component (UMC)
Title
Siemens User Management Component (UMC)
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-03
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Johnson Controls Kantech Gen1 ioSmart
Title
Johnson Controls Kantech Gen1 ioSmart
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable from adjacent network Vendor: Sensormatic Electronics, LLC, an affiliate of Johnson Controls Inc. Equipment: Kantech Gen1 ioSmart card reader Vulnerability: Missing Release of Memory after Effective Lifetime 2. RISK EVALUATION An attacker with physical access to the Kantech Gen1 ioSmart ...
14.12.2023
US CERT (ICS)
Siemens SCALANCE and RUGGEDCOM M-800/S615 Family
Title
Siemens SCALANCE and RUGGEDCOM M-800/S615 Family
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-13
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens SIMATIC and SIPLUS Products
Title
Siemens SIMATIC and SIPLUS Products
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-05
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens RUGGEDCOM and SCALANCE M-800/S615 Family
Title
Siemens RUGGEDCOM and SCALANCE M-800/S615 Family
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-14
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Title
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens Web Server of Industrial Products
Title
Siemens Web Server of Industrial Products
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-08
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT
Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment
Title
Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment
Published
Dec. 14, 2023, 1:24 a.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-349a
Summary
SUMMARY In January 2023, the Cybersecurity and Infrastructure Security Agency (CISA) conducted a Risk and Vulnerability Assessment (RVA) at the request of a Healthcare and Public Health (HPH) sector organization to identify vulnerabilities and areas for improvement. An RVA is a two-week penetration test of an entire organization, with one ...
13.12.2023
BOSCH PSIRT
Denial of Service vulnerability in Bosch BT software products
Title
Denial of Service vulnerability in Bosch BT software products
Published
Dec. 13, 2023, 1 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-092656-bt.html
Summary

BOSCH-SA-092656-BT: An security vulnerability discovered in Bosch internal tests allows an unauthenticated attacker to interrupt normal functions and cause a Denial of Service / DoS.Bosch rates this vulnerability with a CVSSv3.1 base scores of 7.5 (High) for products using the vulnerable function as a server and 5.9 (medium) for products ...

13.12.2023
BOSCH PSIRT
Command injection vulnerability in Bosch IP Cameras
Title
Command injection vulnerability in Bosch IP Cameras
Published
Dec. 13, 2023, 1 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-638184-bt.html
Summary

BOSCH-SA-638184-BT: A vulnerability was discovered in Bosch IP cameras of families CPP13 and CPP14, that allows an authenticated user with administrative rights to execute arbitrary commands in the operating system of the camera.

12.12.2023
US CERT
Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally
Title
Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally
Published
Dec. 12, 2023, 6:33 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Summary
SUMMARY The U.S. Federal Bureau of Investigation (FBI), U.S. Cybersecurity & Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), Polish Military Counterintelligence Service (SKW), CERT Polska (CERT.PL), and the UK’s National Cyber Security Centre (NCSC) assess Russian Foreign Intelligence Service (SVR) cyber actors—also known as Advanced Persistent Threat 29 ...

Last Updates

BOSCH PSIRT
15.01.2025
SIEMENS CERT
17.04.2025
US CERT
01.04.2025
US CERT (ICS)
17.04.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds