Bulletins

Multiple industrial products are affected by a vulnerability in the kernel known as TCP SACK PANIC. The vulnerability could allow a remote attacker to cause a denial of service condition. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing …

RUGGEDCOM Win is affected by multiple security vulnerabilities. These vulnerabilities could allow an attacker to leverage various attacks, e.g. to execute arbitrary code over the network. The vulnerabilities affect the underlying Wind River VxWorks network stack and were recently patched by Wind River. Siemens is working on updates for the …

Two vulnerabilities have been reported for the Siemens SCALANCE X-200 and X-200IRT switch families concerning a privilege escalation bug in the web interface and an authentication problem in the SNMPv3 implementation. Siemens has addressed both vulnerabilities by firmware upgrades.

SIMATIC CP 343-1 Advanced/CP-443-1 Advanced devices and SIMATIC S7-300/S7-400 CPUs are affected by two vulnerabilities. One of the vulnerabilities could allow remote attackers to perform operations as an authenticated user under certain conditions. Siemens has released updates for SIMATIC CP 343-1 Advanced and SIMATIC CP 443-1 Advanced devices. Siemens recommends …

There is an access mode used during manufacturing of S7-1200 CPUs that allows additional diagnostic functionality. Using this functionality requires physical access to the UART interface during boot process. Siemens is working on a solution and recommends specific countermeasures until the solution is available.

A vulnerability in the affected products could allow an unauthorized attacker with network access to the webserver of an affected device to perform a denial-of-service attack. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates and recommends …