28 CISA ICS advisories for Siemens in the last tracking window, 9 flagged as relevant to oil & gas. Newest first.
CISA reports 1 vulnerability in Siemens WTV676-HB6035 Web Interface, WTV776-HB6035 Web Interface. Weakness type: Improper Validation of Specified Type of Input. The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode under certain condit…
CISA reports 1 vulnerability in Siemens SIMOVE Fleetmanager V3.1, SIMOVE Fleetmanager V3.2, SIMOVE Fleetmanager V3.3, SIMOVE Fleetmanager V4.0 and 4 more. Weakness type: Relative Path Traversal. SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside o…
CISA reports 1 vulnerability in Siemens Industrial Edge Management Cloud, Industrial Edge Management Pro V1, Industrial Edge Management Pro V2, Industrial Edge Management Virtual. Weakness type: Weak Password Recovery Mechanism for Forgotten Password. Industrial Edge Management contains an authentication bypass vulnera…
CISA reports 1 vulnerability in Siemens Desigo CC family V6, Desigo CC family V7, Desigo CC family V8, Desigo CC family V9. Weakness type: Improper Control of Generation of Code ('Code Injection'). A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to exe…
CISA reports 1 vulnerability in Siemens SIMATIC AX Runtime Core Linux Common Debian, SIMATIC AX Runtime Core Linux Common Debian arm64, SIMATIC AX Runtime Core Linux Platform Container Common Debian Development, SIMATIC AX Runtime Core Linux VMWare Development and 63 more. Weakness type: Incorrect Resource Transfer Bet…
CISA reports 1 vulnerability in Siemens Siveillance Control Pro V3.0, Siveillance Control Pro V4.0, Siveillance Control V3.0, Siveillance Control V4.0. Weakness type: Unrestricted Upload of File with Dangerous Type. A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillanc…
CISA reports 1 vulnerability in Siemens Teamcenter V2412, Teamcenter V2506, Teamcenter V2512, Teamcenter V2606. Weakness type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter a…
CISA reports 1 vulnerability in Siemens Mendix SAML (Mendix 10 compatible), Mendix SAML (Mendix 11 compatible), Mendix SAML (Mendix 9.24 compatible). Weakness type: Improper Verification of Cryptographic Signature. Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack a…
CISA reports 14 vulnerabilities in Siemens Reyrolle 7SR5. Weakness types: Integer Overflow or Wraparound, Improper Neutralization of Delimiters, Use of Out-of-range Pointer Offset (+8 more). Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 …
CISA reports 1 vulnerability in Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2). Weakness type: Missing Authentication for Critical Function. SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allo…
CISA reports 1 vulnerability in Siemens Simcenter Femap, Simcenter Nastran. Weakness type: Stack-based Buffer Overflow. Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. Highest CVSS v3 score: 7.8 (High), not rem…
CISA reports 2 vulnerabilities in Siemens LOGO! Soft Comfort. Weakness types: Use of Hard-coded Cryptographic Key, Use of a One-Way Hash without a Salt. Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vuln…
CISA reports 7 vulnerabilities in Siemens Solid Edge SE2025, Solid Edge SE2026. Weakness types: Out-of-bounds Read, Out-of-bounds Write, Use After Free. Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR, PSM or DFT format. T…
CISA reports 2 vulnerabilities in Siemens Simcenter Femap. Weakness type: Out-of-bounds Read. Simcenter Femap contains two file parsing vulnerabilities that could be triggered when the application reads files in BMP file format. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector.
CISA reports 1 vulnerability in Siemens Parasolid V38.0, Parasolid V38.1. Weakness type: Out-of-bounds Read. Parasolid is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This could allow an attacker to crash the application or execute arbitrary cod…
CISA reports 1 vulnerability in Siemens Siveillance Video V2023 R3, Siveillance Video V2024 R1, Siveillance Video V2025. Weakness type: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Siveillance Video Management Servers contains a vulnerability that could allow a Remote Code…
CISA reports 1 vulnerability in Siemens Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5.E003 and 2 more. Weakness type: Improper Check for Unusual or Exceptional Conditions. A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sen…
CISA reports 2 vulnerabilities in Siemens Siemens License Server (SLS). Weakness types: Incorrect Permission Assignment for Critical Resource, Path Traversal: '.../...//'. Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on t…
CISA reports 2 vulnerabilities in Siemens RUGGEDCOM APE1808. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Fortinet has published information on vulnerabilities in FortiOS. This adviso…
CISA reports 352 vulnerabilities in Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0), SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) and 1 more. Weakness types: Missing Enc…
CISA reports 1 vulnerability in Siemens SIMATIC S7-PLCSIM Advanced. Weakness type: Allocation of Resources Without Limits or Throttling. SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific coun…
CISA reports 1 vulnerability in Siemens Mendix Runtime. Weakness type: Insecure Inherited Permissions. This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.
CISA reports 1 vulnerability in Siemens Desigo CC family V7, Desigo CC family V8, Desigo CC family V9. Weakness type: Out-of-bounds Write. OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Si…
CISA reports 11 vulnerabilities in Siemens CADRA. Weakness types: Improper Input Validation, Incorrect Bitwise Shift of Integer, Out-of-bounds Write (+3 more). CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Sieme…
CISA reports 1 vulnerability in Siemens COMOS V10.4.5, COMOS V10.6, Designcenter NX, Simcenter 3D and 12 more. Weakness type: Untrusted Search Path. Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalatio…
CISA reports 12 vulnerabilities in Siemens SIDIS Secured SmartPlug. Weakness types: Improper Enforcement of Message Integrity During Transmission in a Communication Channel, Reusing a Nonce, Key Pair in Encryption, Out-of-bounds Write (+6 more). SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerab…
CISA reports 1 vulnerability in Siemens Opcenter X. Weakness type: Improper Verification of Cryptographic Signature. Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X …
CISA reports 3 vulnerabilities in Siemens RUGGEDCOM APE1808. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authorization, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Palo Alto Networks has published [1] infor…
Every week: the new ICS advisories that touch oil & gas gear, what they mean, and what to do. Free.
TODO: signup form not connected to a provider yet