November 2022
08.11.2022
SIEMENS CERT
SSA-853037 V1.0: File Parsing Vulnerabilities in Parasolid
Title
SSA-853037 V1.0: File Parsing Vulnerabilities in Parasolid
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-853037.pdf
Summary
Parasolid is affected by out of bounds read/write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of ...
08.11.2022
SIEMENS CERT
SSA-478960 V1.0: Missing CSRF Protection in the Web Server Login Page of Industrial Controllers
Title
SSA-478960 V1.0: Missing CSRF Protection in the Web Server Login Page of Industrial Controllers
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-478960.pdf
Summary
The web server login page of affected products does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.. Siemens has released updates for several affected products and recommends to update to the latest versions. ...
08.11.2022
SIEMENS CERT
SSA-459643 V1.1 (Last Update: 2022-11-08): Denial of Service Vulnerability in RUGGEDCOM ROS before V5.6.0
Title
SSA-459643 V1.1 (Last Update: 2022-11-08): Denial of Service Vulnerability in RUGGEDCOM ROS before V5.6.0
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-459643.pdf
Summary
RUGGEDCOM ROS-based devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP connections. The web server recovers by itself once the attack ends. Siemens ...
08.11.2022
SIEMENS CERT
SSA-787941 V1.0: Denial of Service Vulnerability in RUGGEDCOM ROS V4
Title
SSA-787941 V1.0: Denial of Service Vulnerability in RUGGEDCOM ROS V4
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-787941.pdf
Summary
RUGGEDCOM ROS-based V4 devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP connections. The web server recovers by itself once the attack ends. ...
08.11.2022
SIEMENS CERT
SSA-400332 V1.1 (Last Update: 2022-11-08): Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Ques...
Title
SSA-400332 V1.1 (Last Update: 2022-11-08): Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Questa and ModelSim
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-400332.pdf
Summary
A security research [1] identified weaknesses in the IEEE 1735 recommended practice for encryption of Design IP, which could allow a sophisticated attacker access to unencrypted Design IP data in IEEE 1735-compliant products. This advisory addresses the specific details for the affected Siemens software products: Questa and ModelSim simulators. Siemens ...
08.11.2022
SIEMENS CERT
SSA-362164 V1.2 (Last Update: 2022-11-08): Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS
Title
SSA-362164 V1.2 (Last Update: 2022-11-08): Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf
Summary
The networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) use Initial Sequence Numbers for TCP-Sessions that are predictable. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
08.11.2022
SIEMENS CERT
SSA-501891 V1.1 (Last Update: 2022-11-08): Cross-Site Scripting Vulnerability in SCALANCE X-200 and X-200IRT Families
Title
SSA-501891 V1.1 (Last Update: 2022-11-08): Cross-Site Scripting Vulnerability in SCALANCE X-200 and X-200IRT Families
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-501891.pdf
Summary
There is a cross-site scripting vulnerability that affects the SCALANCE switches. This vulnerability if used by a threat actor could result in the stealing of session cookies and session hijacking. Siemens has released updates for the affected products and recommends to update to the latest versions.
08.11.2022
SIEMENS CERT
SSA-764417 V1.5 (Last Update: 2022-11-08): Weak Encryption Vulnerability in RUGGEDCOM ROS Devices
Title
SSA-764417 V1.5 (Last Update: 2022-11-08): Weak Encryption Vulnerability in RUGGEDCOM ROS Devices
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-764417.pdf
Summary
The SSH server on RUGGEDCOM ROS devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device. Siemens is preparing updates and recommends specific countermeasures ...
08.11.2022
SIEMENS CERT
SSA-371761 V1.0: Arbitrary Code Execution Vulnerability in the Logback Component of SINEC NMS before V1.0.3
Title
SSA-371761 V1.0: Arbitrary Code Execution Vulnerability in the Logback Component of SINEC NMS before V1.0.3
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf
Summary
SINEC NMS versions before V1.0.3 are affected by a vulnerability in the logback component (CVE-2021-42550) that could allow attackers with write access to the logback configuration file to execute arbitrary code on the system. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
08.11.2022
SIEMENS CERT
SSA-120378 V1.0: Multiple File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Title
SSA-120378 V1.0: Multiple File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go
Published
Nov. 8, 2022, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
Summary
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious TIF, CGM or PDF files. If a user is tricked to open a malicious TIF, CGM or PDF file with the affected products, this could lead the application to ...
03.11.2022
US CERT (ICS)
ETIC Telecom Remote Access Server (RAS)
Title
ETIC Telecom Remote Access Server (RAS)
Published
Nov. 3, 2022, 3:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-307-01
Summary
03.11.2022
US CERT (ICS)
Nokia ASIK AirScale System Module
Title
Nokia ASIK AirScale System Module
Published
Nov. 3, 2022, 3:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-307-02
Summary
01.11.2022
US CERT (ICS)
Mitsubishi Electric Multiple Factory Automation Products (Update C)
Title
Mitsubishi Electric Multiple Factory Automation Products (Update C)
Published
Nov. 1, 2022, 3 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-221-01
Summary
This updated advisory is a follow-up to the advisory update titled ICSA-22-221-01 Mitsubishi Electric Multiple Factory Automation Products (Update B) that was published August 18, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for an Mitsubishi Electric GOT2000 compatible HMI software, CC-Link IE TSN Industrial Managed Switch, ...
October 2022
27.10.2022
US CERT (ICS)
Rockwell Automation FactoryTalk Alarm and Events Server
Title
Rockwell Automation FactoryTalk Alarm and Events Server
Published
Oct. 27, 2022, 4:15 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-300-01
Summary
27.10.2022
US CERT (ICS)
SAUTER Controls moduWeb
Title
SAUTER Controls moduWeb
Published
Oct. 27, 2022, 4:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-300-02
Summary
27.10.2022
US CERT (ICS)
Rockwell Automation Stratix Devices Containing Cisco IOS
Title
Rockwell Automation Stratix Devices Containing Cisco IOS
Published
Oct. 27, 2022, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-300-03
Summary
27.10.2022
US CERT (ICS)
Trihedral VTScada
Title
Trihedral VTScada
Published
Oct. 27, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-300-04
Summary
25.10.2022
US CERT (ICS)
AliveCor KardiaMobile
Title
AliveCor KardiaMobile
Published
Oct. 25, 2022, 4:35 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsma-22-298-01
Summary
25.10.2022
US CERT (ICS)
Haas Controller
Title
Haas Controller
Published
Oct. 25, 2022, 4:25 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-01
Summary
25.10.2022
US CERT (ICS)
HEIDENHAIN Controller TNC on HARTFORD Machine
Title
HEIDENHAIN Controller TNC on HARTFORD Machine
Published
Oct. 25, 2022, 4:20 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-02
Summary
25.10.2022
US CERT (ICS)
Siemens Siveillance Video Mobile Server
Title
Siemens Siveillance Video Mobile Server
Published
Oct. 25, 2022, 4:15 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-03
Summary
25.10.2022
US CERT (ICS)
Hitachi Energy MicroSCADA X DMS600
Title
Hitachi Energy MicroSCADA X DMS600
Published
Oct. 25, 2022, 4:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-04
Summary
25.10.2022
US CERT (ICS)
Johnson Controls CKS CEVAS
Title
Johnson Controls CKS CEVAS
Published
Oct. 25, 2022, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-05
Summary
25.10.2022
US CERT (ICS)
Delta Electronics InfraSuite Device Master
Title
Delta Electronics InfraSuite Device Master
Published
Oct. 25, 2022, 3:55 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-07
Summary
22.10.2022
US CERT (ICS)
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (Update A)
Title
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (Update A)
Published
Oct. 22, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsma-20-296-02
Summary
This advisory contains mitigations for Cross-site Scripting, Open Redirect, XPath Injection, Session Fixation, Use of a One-way Hash without a Salt, Relative Path Traversal, Improper Verification of Cryptographic Signature, Improper Privilege Management, Use of Hard-coded Credentials, Active Debug Code, and Improper Access Control vulnerabilities in B. Braun's SpaceCom, Battery Pack ...

Last Updates

BOSCH PSIRT
14.08.2025
SIEMENS CERT
16.09.2025
US CERT
25.08.2025
US CERT (ICS)
18.09.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds