Bulletins | CERT@VDE

1
2
3 (current)
4

Tuesday, 12.08.2025

SSA-265688 V1.8 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP ...

Title

SSA-265688 V1.8 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Summary

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

02:00

SIEMENS CERT

SSA-256353 V1.6 (Last Update: 2025-08-12): Third-Party Component Vulnerabilities in RUGGEDCOM ROS

Title

SSA-256353 V1.6 (Last Update: 2025-08-12): Third-Party Component Vulnerabilities in RUGGEDCOM ROS

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-256353.html

Summary

Multiple vulnerabilities affect various third-party components of the RUGGEDCOM Operating System (ROS). If exploited, an attacker could cause a denial-of-service, act as a man-in-the-middle or retrieval of sensitive information or gain privileged functions. Siemens has released new versions for several affected products and recommends to update to the latest versions. ...

02:00

SIEMENS CERT

SSA-186293 V1.0: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER

Title

SSA-186293 V1.0: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-186293.html

Summary

SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER are affected by an XXE injection vulnerability that could allow an attacker to access arbitrary application files. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends ...

02:00

SIEMENS CERT

SSA-177847 V1.0: Improper VNC Password Check Vulnerability in SINUMERIK Controllers

Title

SSA-177847 V1.0: Improper VNC Password Check Vulnerability in SINUMERIK Controllers

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-177847.html

Summary

Siemens SINUMERIK Controllers are affected by an improper VNC password check vulnerability. Siemens has released new versions for the affected products and recommends to update to the latest versions.

02:00

SIEMENS CERT

SSA-170375 V1.1 (Last Update: 2025-08-12): Multiple Vulnerabilities in RUGGEDCOM ROS Before V5.9

Title

SSA-170375 V1.1 (Last Update: 2025-08-12): Multiple Vulnerabilities in RUGGEDCOM ROS Before V5.9

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-170375.html

Summary

Multiple vulnerabilities affect the RUGGEDCOM Operating System (ROS). The common denominator to all vulnerabilities is the leak of confidential information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet ...

02:00

SIEMENS CERT

SSA-097435 V1.9 (Last Update: 2025-08-12): Usernames Disclosure Vulnerability in Mendix Runtime

Title

SSA-097435 V1.9 (Last Update: 2025-08-12): Usernames Disclosure Vulnerability in Mendix Runtime

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-097435.html

Summary

Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.

02:00

SIEMENS CERT

SSA-094954 V1.0: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II

Title

SSA-094954 V1.0: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-094954.html

Summary

RUGGEDCOM ROX II devices do not properly limit access through their Built-In-Self-Test (BIST) mode. This could allow a local attacker to bypass authentication and access a root shell on the device. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

02:00

SIEMENS CERT

SSA-082556 V1.1 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...

Title

SSA-082556 V1.1 (Last Update: 2025-08-12): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Summary

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available.

02:00

SIEMENS CERT

SSA-028723 V1.0: Multiple OpenSSL Vulnerabilities in BFCClient Before V2.17

Title

SSA-028723 V1.0: Multiple OpenSSL Vulnerabilities in BFCClient Before V2.17

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-028723.html

Summary

Siemens BFCClient contains multiple vulnerabilities in the integrated OpenSSL component that could allow an attacker to read memory contents, to change the application behaviour or to create a denial of service condition. Siemens has released a new version for BFCClient and recommends to update to the latest version.

02:00

SIEMENS CERT

SSA-770902 V1.2 (Last Update: 2025-08-12): Denial of Service Vulnerability in the Web Server of RUGGEDCOM ROS Devices

Title

SSA-770902 V1.2 (Last Update: 2025-08-12): Denial of Service Vulnerability in the Web Server of RUGGEDCOM ROS Devices

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-770902.html

Summary

A denial of service vulnerability could allow an unauthorized attacker to cause total loss of availability in the web server of the affected devices. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are ...

02:00

SIEMENS CERT

SSA-769791 V1.0: Local Arbitrary Code Execution Vulnerability in COMOS Before V10.6

Title

SSA-769791 V1.0: Local Arbitrary Code Execution Vulnerability in COMOS Before V10.6

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-769791.html

Summary

COMOS before V10.6 is affected by a local arbitrary code execution vulnerability in the integrated Open Design Alliance Drawings SDK. Siemens has released a new version for COMOS and recommends to update to the latest version.

02:00

SIEMENS CERT

SSA-767615 V1.4 (Last Update: 2025-08-12): Information Disclosure Vulnerability in SIPROTEC 5 Devices

Title

SSA-767615 V1.4 (Last Update: 2025-08-12): Information Disclosure Vulnerability in SIPROTEC 5 Devices

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-767615.html

Summary

An information disclosure vulnerability in SIPROTEC 5 devices could allow an unauthenticated, remote attacker to retrieve sensitive information of the device. Siemens has released new versions for the affected products and recommends to update to the latest versions.

02:00

SIEMENS CERT

SSA-764417 V1.9 (Last Update: 2025-08-12): Weak Encryption Vulnerability in RUGGEDCOM ROS Devices

Title

SSA-764417 V1.9 (Last Update: 2025-08-12): Weak Encryption Vulnerability in RUGGEDCOM ROS Devices

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-764417.html

Summary

The SSH server on RUGGEDCOM ROS devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device. Siemens has released new versions for the affected ...

02:00

SIEMENS CERT

SSA-707630 V1.0: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager Before V3.3

Title

SSA-707630 V1.0: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager Before V3.3

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-707630.html

Summary

Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version.

02:00

SIEMENS CERT

SSA-693808 V1.0: Deserialization Vulnerability in Siemens Engineering Platforms

Title

SSA-693808 V1.0: Deserialization Vulnerability in Siemens Engineering Platforms

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-693808.html

Summary

Affected products do not properly restrict access permissions to a local Windows Named Pipe and do not properly sanitize user-controllable input sent to that Named Pipe. This could allow a local authenticated attacker to cause a type confusion and execute arbitrary code within the affected application and its privileges. Siemens ...

02:00

SIEMENS CERT

SSA-687955 V1.1 (Last Update: 2025-08-12): Accessible Development Shell via Physical Interface in SIPROTEC 5

Title

SSA-687955 V1.1 (Last Update: 2025-08-12): Accessible Development Shell via Physical Interface in SIPROTEC 5

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-687955.html

Summary

Affected SIPROTEC 5 devices contain a development shell which is accessible via a physical interface which is not properly restricted. This could allow an unauthenticated attacker with physical access to an affected device to execute arbitrary commands on the device. Siemens has released new versions for several affected products and ...

02:00

SIEMENS CERT

SSA-674084 V1.0: File Parsing Vulnerabilities in Simcenter Femap Before V2506

Title

SSA-674084 V1.0: File Parsing Vulnerabilities in Simcenter Femap Before V2506

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-674084.html

Summary

Simcenter Femap contains a file parsing vulnerability that could be triggered when the application reads files in STP or BMP file format. If a user is tricked to open a malicious file with the affected application, this could lead the application to crash or potentially lead to arbitrary code execution. ...

02:00

SIEMENS CERT

SSA-665108 V1.0: Arbitrary File Upload Vulnerability in RUGGEDCOM ROX II

Title

SSA-665108 V1.0: Arbitrary File Upload Vulnerability in RUGGEDCOM ROX II

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-665108.html

Summary

RUGGEDCOM ROX II devices does not properly enforce limitations on type and size of files that can be uploaded through their web interface. This could allow an attacker with a legitimate, highly privileged account on the web interface to upload arbitrary files onto the filesystem of the devices. Siemens is ...

02:00

SIEMENS CERT

SSA-908185 V1.2 (Last Update: 2025-08-12): Mirror Port Isolation Vulnerability in RUGGEDCOM ROS Devices

Title

SSA-908185 V1.2 (Last Update: 2025-08-12): Mirror Port Isolation Vulnerability in RUGGEDCOM ROS Devices

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-908185.html

Summary

A vulnerability was identified in RUGGEDCOM ROS devices with mirror port enabled, that could allow an attacker to inject information into the network via the mirror port. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products ...

02:00

SIEMENS CERT

SSA-894058 V1.0: Improper Bandwidth Limitation of Network Packets Over Local USB Port Vulnerability in SIPROTEC 5

Title

SSA-894058 V1.0: Improper Bandwidth Limitation of Network Packets Over Local USB Port Vulnerability in SIPROTEC 5

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-894058.html

Summary

Affected SIPROTEC 5 devices do not properly limit the bandwidth for incoming network packets over their local USB port. This could allow an attacker with physical access to send specially crafted packets with high bandwidth to the affected devices thus forcing them to exhaust their memory and stop responding to ...

02:00

SIEMENS CERT

SSA-864900 V1.2 (Last Update: 2025-08-12): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Title

SSA-864900 V1.2 (Last Update: 2025-08-12): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-864900.html

Summary

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.

02:00

SIEMENS CERT

SSA-856721 V1.3 (Last Update: 2025-08-12): Vulnerability in RUGGEDCOM Discovery Protocol (RCDP) of Industrial Communication Dev...

Title

SSA-856721 V1.3 (Last Update: 2025-08-12): Vulnerability in RUGGEDCOM Discovery Protocol (RCDP) of Industrial Communication Devices

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-856721.html

Summary

The RUGGEDCOM RCDP protocol is not properly configured after commissioning of RUGGEDCOM ROS based devices and some SCALANCE X switch models and could allow unauthenticated remote users to perform administrative operations. An attacker must be in the same adjacent network and the RCDP daemon must be enabled in order to ...

02:00

SIEMENS CERT

SSA-840800 V1.5 (Last Update: 2025-08-12): Code Injection Vulnerability in RUGGEDCOM ROS

Title

SSA-840800 V1.5 (Last Update: 2025-08-12): Code Injection Vulnerability in RUGGEDCOM ROS

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-840800.html

Summary

RUGGEDCOM ROS-based devices are vulnerable to a web-based code injection attack. To execute this attack, it is necessary to access the system via the Command Line Interface (CLI). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for ...

02:00

SIEMENS CERT

SSA-800126 V1.1 (Last Update: 2025-08-12): Deserialization Vulnerability in Siemens Engineering Platforms before V20

Title

SSA-800126 V1.1 (Last Update: 2025-08-12): Deserialization Vulnerability in Siemens Engineering Platforms before V20

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-800126.html

Summary

Affected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further ...

02:00

SIEMENS CERT

SSA-794185 V1.1 (Last Update: 2025-08-12): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC,...

Title

SSA-794185 V1.1 (Last Update: 2025-08-12): RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products

Published

Aug. 12, 2025, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/html/ssa-794185.html

Summary

This advisory documents the impact of CVE-2024-3596 (also dubbed “Blastradius”), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in ...

1
2
3 (current)
4

Last Updates

By Source

Archive

2025

2024

2023

2022

2021

2020

2019

2018

2017

Feeds