Bulletins | CERT@VDE

SSA-910883 V1.0: DHCP Client Vulnerability in SINAMICS PERFECT HARMONY GH180 Drives

Title

SSA-910883 V1.0: DHCP Client Vulnerability in SINAMICS PERFECT HARMONY GH180 Drives

Published

July 12, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-910883.pdf

Summary

Several models of SINAMICS PERFECT HARMONY GH180 Drives are affected by a DHCP client vulnerability (CVE-2021-29998) in the integrated SCALANCE X206-1 device. The vulnerability could allow an attacker to cause a heap-based buffer overflow on that device and use it to get access to the drive’s internal network. The list ...

SSA-599506 V1.0: Command Injection in RUGGEDCOM ROX

Title

SSA-599506 V1.0: Command Injection in RUGGEDCOM ROX

Published

July 12, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-599506.pdf

Summary

RUGGEDCOM ROX devices are affected by a command injection vulnerability that could allow an attacker with administrative privileges to gain root access. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-439148 V1.0: File Parsing Vulnerabilities in PADS Standard/Plus Viewer

Title

SSA-439148 V1.0: File Parsing Vulnerabilities in PADS Standard/Plus Viewer

Published

July 12, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-439148.pdf

Summary

Siemens PADS Standard/Plus Viewer is affected by multiple memory corruption vulnerabilities that could be triggered when the application reads files in PCB format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to perform remote code execution in the ...

SSA-433782 V1.0: Improper Access Control Vulnerability in Mendix

Title

SSA-433782 V1.0: Improper Access Control Vulnerability in Mendix

Published

July 12, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-433782.pdf

Summary

An improper access control vulnerability in Mendix applications was discovered. In case of access to an active user session, the vulnerability could allow to change that user’s password bypassing password validations within a Mendix application. Siemens has released updates for the affected products and recommends to update to the latest ...

June 2022

21.06.2022

SSA-111512 V1.0: Client-side Authentication in SIMATIC WinCC OA

Title

SSA-111512 V1.0: Client-side Authentication in SIMATIC WinCC OA

Published

June 21, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-111512.pdf

Summary

SIMATIC WinCC OA implements client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated. Siemens recommends to enable server-side authentication (SSA) or Kerberos authentication for all WinCC OA projects, as documented ...

SSA-662649 V1.1 (Last Update: 2022-06-14): Denial of Service Vulnerability in Desigo DXR and PXC Controllers

Title

SSA-662649 V1.1 (Last Update: 2022-06-14): Denial of Service Vulnerability in Desigo DXR and PXC Controllers

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-662649.pdf

Summary

A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to disable and reset a device to factory state using a denial of service attack. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-539476 V1.2 (Last Update: 2022-06-14): Siemens SIMATIC NET CP, SINEMA and SCALANCE Products Affected by Vulnerabilities in ...

Title

SSA-539476 V1.2 (Last Update: 2022-06-14): Siemens SIMATIC NET CP, SINEMA and SCALANCE Products Affected by Vulnerabilities in Third-Party Component strongSwan

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-539476.pdf

Summary

Vulnerabilities in the third-party component strongSwan could allow an attacker to cause a denial of service (DoS) condition in affected devices by exploiting integer overflow bugs. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends countermeasures ...

SSA-764417 V1.3 (Last Update: 2022-06-14): Weak Encryption Vulnerability in RUGGEDCOM ROS Devices

Title

SSA-764417 V1.3 (Last Update: 2022-06-14): Weak Encryption Vulnerability in RUGGEDCOM ROS Devices

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-764417.pdf

Summary

The SSH server on RUGGEDCOM ROS devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device. Siemens recommends specific countermeasures for products where updates ...

SSA-535997 V1.1 (Last Update: 2022-06-14): Cleartext Storage of Sensitive Information in Multiple SIMATIC Products

Title

SSA-535997 V1.1 (Last Update: 2022-06-14): Cleartext Storage of Sensitive Information in Multiple SIMATIC Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-535997.pdf

Summary

A cleartext vulnerability was found in the SIMATIC communication processors CP 1543-1 and CP 1545-1 that could allow an attacker to read sensitive information. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-740594 V1.0: Privilege Escalation Vulnerability in Mendix SAML Module

Title

SSA-740594 V1.0: Privilege Escalation Vulnerability in Mendix SAML Module

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-740594.pdf

Summary

The latest updates of Mendix the SAML module fixes two vulnerabilities. One is an XML External Entity (XXE) attack that could allow an attacker to potentially disclose confidential data under certain circumstances the other is an Cross Site Scripting (XSS) attack allowing to execute malicious code by tricking users into ...

SSA-388239 V1.0: Default Password Leakage affecting the Component Shared HIS used in Spectrum Power Systems

Title

SSA-388239 V1.0: Default Password Leakage affecting the Component Shared HIS used in Spectrum Power Systems

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-388239.pdf

Summary

Siemens has been made aware of a default password leakage in the internet affecting the component Shared HIS (SHHIS) used in Spectrum Power systems. The products listed below are affected by this default password leakage. This could allow an attacker to access the component Shared HIS of those products with ...

SSA-549234 V1.2 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in SIMATIC NET CP Modules

Title

SSA-549234 V1.2 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in SIMATIC NET CP Modules

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-549234.pdf

Summary

A denial of service vulnerability was identified in different types of Communication Processors. An attacker could exploit this vulnerability causing the device to become un-operational until the device is restarted. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.

SSA-254054 V1.2 (Last Update: 2022-06-14): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impac...

Title

SSA-254054 V1.2 (Last Update: 2022-06-14): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf

Summary

A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as “Spring4Shell” or “SpringShell”. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as ...

SSA-414513 V1.1 (Last Update: 2022-06-14): Information Disclosure Vulnerability in Mendix

Title

SSA-414513 V1.1 (Last Update: 2022-06-14): Information Disclosure Vulnerability in Mendix

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-414513.pdf

Summary

An information disclosure vulnerability in Mendix applications was discovered. The vulnerability could allow to read sensitive data. Siemens has released updates for several Mendix Applications and recommends to update to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not yet ...

SSA-685781 V1.0: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products

Title

SSA-685781 V1.0: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf

Summary

Multiple vulnerabilities were identified in the Apache HTTP Server software. These include NULL Pointer Dereferencing, Out-of-bounds Write and Server-Side Request Forgery related vulnerabilities. Siemens has released an update for the SINEMA Remote Connect Server and recommends to update to the latest version. Siemens is preparing further updates and recommends specific ...

SSA-443566 V1.2 (Last Update: 2022-06-14): Authentication Bypass in SCALANCE X Switches Families

Title

SSA-443566 V1.2 (Last Update: 2022-06-14): Authentication Bypass in SCALANCE X Switches Families

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-443566.pdf

Summary

Several SCALANCE X switches are affected by an Authentication Bypass vulnerability. The vulnerability allows an unauthenticated attacker to violate access-control rules. The vulnerability can be exploited by sending a GET request to a specific uniform resource locator on the web configuration interface of the device. The security vulnerability could be ...

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Title

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf

Summary

Siemens has released updates for JT2Go, Solid Edge and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as PDF, DXF or PAR) with any of the affected products, this could lead the application to crash or potentially lead to ...

SSA-145224 V1.0: Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices

Title

SSA-145224 V1.0: Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-145224.pdf

Summary

SCALANCE XM-400 and XR-500 devices contain a vulnerability in the OSPF protocol implementation that could allow an unauthenticated remote attacker to cause interruptions in the network. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-102233 V2.0 (Last Update: 2022-06-14): SegmentSmack in VxWorks-based Industrial Devices

Title

SSA-102233 V2.0 (Last Update: 2022-06-14): SegmentSmack in VxWorks-based Industrial Devices

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-102233.pdf

Summary

The products listed below contain a vulnerability that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released an update ...

SSA-661247 V2.9 (Last Update: 2022-06-14): Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to...

Title

SSA-661247 V2.9 (Last Update: 2022-06-14): Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf

Summary

On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as “Log4Shell”. On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) ...

SSA-462066 V3.0 (Last Update: 2022-06-14): Vulnerability known as TCP SACK PANIC in Industrial Products

Title

SSA-462066 V3.0 (Last Update: 2022-06-14): Vulnerability known as TCP SACK PANIC in Industrial Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf

Summary

Multiple industrial products are affected by a vulnerability in the kernel known as TCP SACK PANIC. The vulnerability could allow a remote attacker to cause a denial of service condition. Siemens has released updates for several affected products and recommends to update to the new versions. Siemens is preparing further ...

SSA-484086 V1.0: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.1

Title

SSA-484086 V1.0: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.1

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Summary

SINEMA Remote Connect Server is affected by multiple vulnerabilities, including A cross-site scripting vulnerability in an error message pop up window (CVE-2022-29034) Several authentication bypass, privilege escalation and integrity check vulnerabilities (CVE-2022-32251 through -32261) A command injection vulnerability in the file upload service (CVE-2022-32262) A chosen-plaintext attack against HTTP over ...

SSA-988345 V1.0: Local Privilege Escalation Vulnerability in Xpedition Designer

Title

SSA-988345 V1.0: Local Privilege Escalation Vulnerability in Xpedition Designer

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-988345.pdf

Summary

A vulnerability in Xpedition Designer could allow an attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges. Siemens has released an update for the Xpedition Designer and recommends to update to the latest version.

SSA-401167 V1.0: Cross-site scripting Vulnerability in Teamcenter Active Workspace

Title

SSA-401167 V1.0: Cross-site scripting Vulnerability in Teamcenter Active Workspace

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-401167.pdf

Summary

Teamcenter Active Workspace is affected by a cross site scripting vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.