April 2025
08.04.2025
SIEMENS CERT
SSA-354569 V1.3 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Title
SSA-354569 V1.3 (Last Update: 2025-04-08): Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Published
April 8, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-354569.html
Summary
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available. [1] https://security.paloaltonetworks.com/
08.04.2025
SIEMENS CERT
SSA-265688 V1.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP ...
Title
SSA-265688 V1.5 (Last Update: 2025-04-08): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1
Published
April 8, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
08.04.2025
SIEMENS CERT
SSA-935500 V1.2 (Last Update: 2025-04-08): Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON an...
Title
SSA-935500 V1.2 (Last Update: 2025-04-08): Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products
Published
April 8, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-935500.html
Summary
A denial of service vulnerability has been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-313313: https://cert-portal.siemens.com/productcert/html/ssa-313313.html. The products listed below use affected versions of the Nucleus software and inherently contain the vulnerability. Siemens has released new versions for several affected products and ...
08.04.2025
SIEMENS CERT
SSA-913875 V1.4 (Last Update: 2025-04-08): Frame Aggregation and Fragmentation Vulnerabilities in 802.11
Title
SSA-913875 V1.4 (Last Update: 2025-04-08): Frame Aggregation and Fragmentation Vulnerabilities in 802.11
Published
April 8, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-913875.html
Summary
Twelve vulnerabilities in the implementation of frame aggregation and fragmentation of the 802.11 standard, under the name of FragAttacks, have been published. Successful exploitation of these vulnerabilities could allow an attacker within Wi-Fi range to forge encrypted frames, which could result in sensitive data disclosure and possibly traffic manipulation. The ...
08.04.2025
SIEMENS CERT
SSA-770770 V1.2 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices
Title
SSA-770770 V1.2 (Last Update: 2025-04-08): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices
Published
April 8, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-770770.html
Summary
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.
08.04.2025
SIEMENS CERT
SSA-672923 V1.0: Out of Bounds Write Vulnerability in Solid Edge
Title
SSA-672923 V1.0: Out of Bounds Write Vulnerability in Solid Edge
Published
April 8, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-672923.html
Summary
Solid Edge is affected by an out of bounds write vulnerability that could be triggered when the application is parsing X_T data or a specially crafted file in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability ...
08.04.2025
SIEMENS CERT
SSA-876787 V1.5 (Last Update: 2025-04-08): Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs
Title
SSA-876787 V1.5 (Last Update: 2025-04-08): Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs
Published
April 8, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-876787.html
Summary
Several SIMATIC S7-1500 and S7-1200 CPU versions are affected by an open redirect vulnerability that could allow an attacker to make the web server of affected devices redirect a legitimate user to an attacker-chosen URL. For a successful attack, the legitimate user must actively click on an attacker-crafted link. Siemens ...
08.04.2025
SIEMENS CERT
SSA-817234 V1.0: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud
Title
SSA-817234 V1.0: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud
Published
April 8, 2025, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-817234.html
Summary
Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for ...
03.04.2025
US CERT (ICS)
B&R APROL
Title
B&R APROL
Published
April 3, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: B&R Equipment: APROL Vulnerabilities: Inclusion of Functionality from Untrusted Control Sphere, Incomplete Filtering of Special Elements, Improper Control of Generation of Code ('Code Injection'), Improper Handling of Insufficient Permissions or Privileges , Allocation of Resources Without ...
03.04.2025
US CERT (ICS)
ABB ACS880 Drives Containing CODESYS RTS
Title
ABB ACS880 Drives Containing CODESYS RTS
Published
April 3, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: ACS880 Drives with IEC 61131-3 license Vulnerabilities: Improper Input Validation, Out-of-bounds Write, Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...
03.04.2025
US CERT (ICS)
Hitachi Energy RTU500 Series
Title
Hitachi Energy RTU500 Series
Published
April 3, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: RTU500 series Vulnerabilities: Null Pointer Dereference, Insufficient Resource Pool, Missing Synchronization 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
03.04.2025
US CERT (ICS)
ABB Low Voltage DC Drives and Power Controllers CODESYS RTS
Title
ABB Low Voltage DC Drives and Power Controllers CODESYS RTS
Published
April 3, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: DCT880 memory unit incl. ABB Drive Application Builder license (IEC 61131-3), DCT880 memory unit incl. Power Optimizer, DCS880 memory unit incl. ABB Drive Application Builder license (IEC 61131-3), DCS880 memory unit incl. DEMag, DCS880 ...
03.04.2025
US CERT (ICS)
Hitachi Energy TRMTracker
Title
Hitachi Energy TRMTracker
Published
April 3, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: TRMTracker Vulnerabilities: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'), Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Neutralization of Input During Web ...
01.04.2025
US CERT
Fast Flux: A National Security Threat
Title
Fast Flux: A National Security Threat
Published
April 1, 2025, 9 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-093a
Summary
Executive summary Many networks have a gap in their defenses for detecting and blocking a malicious technique known as “fast flux.” This technique poses a significant threat to national security, enabling malicious cyber actors to consistently evade detection. Malicious cyber actors, including cybercriminals and nation-state actors, use fast flux to ...
01.04.2025
US CERT (ICS)
Rockwell Automation Lifecycle Services with Veeam Backup and Replication
Title
Rockwell Automation Lifecycle Services with Veeam Backup and Replication
Published
April 1, 2025, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-091-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Lifecycle Services with Veeam Backup and Replication Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker with administrative privileges to execute code on the target ...
March 2025
25.03.2025
US CERT (ICS)
ABB RMC-100
Title
ABB RMC-100
Published
March 25, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: RMC-100 Vulnerability: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send a specially crafted message to the web UI, causing ...
25.03.2025
US CERT (ICS)
Inaba Denki Sangyo CHOCO TEI WATCHER mini
Title
Inaba Denki Sangyo CHOCO TEI WATCHER mini
Published
March 25, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Inaba Denki Sangyo Co., Ltd. Equipment: CHOCO TEI WATCHER mini Vulnerabilities: Use of Client-Side Authentication, Storing Passwords in a Recoverable Format, Weak Password Requirements, Direct Request ('Forced Browsing') 2. RISK EVALUATION Successful exploitation of these vulnerabilities ...
25.03.2025
US CERT (ICS)
Rockwell Automation 440G TLS-Z
Title
Rockwell Automation 440G TLS-Z
Published
March 25, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.3 ATTENTION: High attack complexity Vendor: Rockwell Automation Equipment: 440G TLS-Z Vulnerability: Improper Neutralization of Special Elements in Output Used by a Downstream Component 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to take over the device. 3. TECHNICAL ...
20.03.2025
US CERT (ICS)
Schneider Electric EcoStruxure™
Title
Schneider Electric EcoStruxure™
Published
March 20, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-079-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: EcoStruxure™ Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a local privilege escalation, which could result in loss of confidentiality, integrity and availability of ...
20.03.2025
US CERT (ICS)
Schneider Electric Enerlin’X IFE and eIFE
Title
Schneider Electric Enerlin’X IFE and eIFE
Published
March 20, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-079-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Enerlin'X IFE interface and Enerlin'X eIFE Vulnerabilities: Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition which would require the device to ...
20.03.2025
US CERT (ICS)
SMA Sunny Portal
Title
SMA Sunny Portal
Published
March 20, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-079-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: SMA Equipment: Sunny Portal Vulnerability: Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to upload and remotely execute code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...
20.03.2025
SIEMENS CERT
SSA-656895 V1.2 (Last Update: 2025-03-20): Open Redirect Vulnerability in Teamcenter
Title
SSA-656895 V1.2 (Last Update: 2025-03-20): Open Redirect Vulnerability in Teamcenter
Published
March 20, 2025, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-656895.html
Summary
The SSO login service in Teamcenter contains an open redirect vulnerability that could allow an attacker to redirect the legitimate user to an attacker-chosen URL to steal valid session data. Siemens has released hot fixes for the affected products and recommends to apply them as described in the related Software ...
18.03.2025
US CERT (ICS)
Schneider Electric ASCO 5310/5350 Remote Annunciator
Title
Schneider Electric ASCO 5310/5350 Remote Annunciator
Published
March 18, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: ASCO 5310 / 5350 Vulnerabilities: Download of Code Without Integrity Check, Allocation of Resources Without Limits or Throttling, Cleartext Transmission of Sensitive Information, Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION ...
18.03.2025
US CERT (ICS)
Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI)
Title
Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI)
Published
March 18, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.0 ATTENTION: Low Attack Complexity Vendor: Schneider Electric Equipment: EcoStruxure Power Automation System User Interface (EPAS-UI) Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass device authentication, potentially gain access to sensitive information, or execute ...
18.03.2025
US CERT (ICS)
Rockwell Automation Lifecycle Services with VMware
Title
Rockwell Automation Lifecycle Services with VMware
Published
March 18, 2025, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.4 ATTENTION: Low attack complexity/public exploits are available/known public exploitation Vendor: Rockwell Automation Equipment: Industrial Data Center (IDC) with VMware, VersaVirtual Appliance (VVA) with VMware, Threat Detection Managed Services (TDMS) with VMware, Endpoint Protection Service with RA Proxy & VMware, Engineered and Integrated ...

Last Updates

BOSCH PSIRT
25.04.2025
SIEMENS CERT
23.05.2025
US CERT
20.05.2025
US CERT (ICS)
22.05.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds