Siemens
Monthly
Siemens Software Center (all versions) loads dynamic-link libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to stage a crafted DLL where the application will load it and achieve arbitrary code execution in the application's context, with full confidentiality, integrity, and availability impact on the affected host. The vendor scores this CWE-427 DLL-hijacking issue CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N), and our independent assessment agrees on the local vector, no user interaction, unchanged scope, and high C/I/A impact. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is constrained to a local, already highly privileged actor able to write to a directory on the loader's search path.
A stack-based buffer overflow in the web service upload-handling code of Siemens APOGEE and TALON building-automation controllers allows an unauthenticated remote attacker to crash the device, producing a denial-of-service condition. Affected platforms include APOGEE PXC Compact and PXC Modular (BACnet all versions before V3.5.7, P2 Ethernet all versions before V2.8.21), TALON TC Compact and TC Modular (BACnet all versions before V3.5.7), and the APOGEE MBC/MEC (PPC) variants in BACnet and P2 Ethernet builds, which are listed as affected in all versions. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but exploitation is trivial from a network standpoint - the CVSS vector confirms PR:N/UI:N with low attack complexity - so any controller whose HTTP upload interface is reachable is at risk. Siemens rates this CVSS 4.0 8.7; our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Denial of service in the embedded web service of Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, and TALON TC building-automation controllers, caused by improper validation of multipart input that can crash the service via a stack buffer overflow (CWE-121). An unauthenticated remote attacker with network reachability to the controller's HTTP interface (CVSS PR:N/UI:N) can send a crafted multipart request and take the web service down; the assessed impact is availability-only (C:N/I:N/A:H), with no confidentiality or integrity loss demonstrated. Exploitation is bounded by exposure: these are OT field panels normally expected on segmented building networks, and no public exploit code has been identified at time of analysis - this is a credible OT risk for internet- or IT-reachable controllers, not a confirmed widespread-exploitation emergency. All-version APOGEE MBC/MEC (PPC) models carry the highest residual risk because no fixed version is listed for them, whereas APOGEE PXC Compact/Modular (BACnet) and TALON TC are fixed at V3.5.7 and the P2 Ethernet PXC Compacts at V2.8.21.
Unauthenticated remote attackers can cause a denial of service on Siemens APOGEE MBC/MEC, PXC, and TALON building automation controllers by sending a crafted input that triggers a stack-based buffer overflow (CWE-121) in the device's FTP service. The flaw affects all versions of the MBC and MEC PPC families and PXC/TALON TC models below BACnet V3.5.7 or P2 Ethernet V2.8.21. No public exploit code or confirmed active exploitation has been identified, and the impact is limited to availability (no confidentiality or integrity impact); real-world risk hinges on whether the FTP service is enabled and reachable from an attacker's position on the OT network.
Unauthenticated remote attackers can read portions of device memory or cause a denial-of-service condition in Siemens APOGEE MBC/MEC and PXC, and TALON TC building controllers through the embedded web service, due to improper length validation of user-controllable input (CWE-191 integer underflow). Affected versions include APOGEE PXC Compact/Modular (BACnet) before V3.5.7 and (P2 Ethernet) before V2.8.21, TALON TC Compact/Modular (BACnet) before V3.5.7, and all versions of APOGEE MBC and MEC. No public exploit has been identified at the time of analysis; the vendor has released patches for the PXC and TALON variants, but no fix is available for MBC/MEC.
Authenticated attackers with minimal privileges can disconnect active sessions of other users, including administrators, in Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 due to missing authorization checks on device-disconnection requests, causing a denial of service. The flaw is network-reachable, requires low privileges (PR:L) and no user interaction, and affects only availability (VA:H) with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows an authenticated user who can create or edit device group or facility names to execute arbitrary SQL commands against the underlying database, with the injected payload only firing when those stored names are subsequently processed by the Bulk Export workflow. Attackers must hold valid credentials with name-editing privileges, and the assessed vectors (CVSS 4.0 base 7.7 with AC:H/PR:L; independent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicate additional non-default preconditions must be satisfied before the payload executes. No public exploit code has been identified at time of analysis, and this is a credentialed, moderate-priority vulnerability rather than a mass-exploitation emergency, with realistic exposure largely limited to insiders or attackers who have already compromised an operator account on an unpatched installation.
SQL injection in RUGGEDCOM CROSSBOW versions below V6.0 lets an attacker who already holds administrative credentials inject arbitrary SQL commands through the Name and Value fields of custom file labels, compromising the underlying database. The vendor-assessed vector (CVSS 4.0 8.4, PR:H, AV:L) and our independent assessment converge on a high-severity but access-gated issue: exploitation requires an authenticated administrative session and local access, with no user interaction, and no public exploit code identified at time of analysis. Siemens has released a fix in V6.0, so the practical priority is moderate and centered on insider or compromised-admin scenarios rather than external mass exploitation.
Authenticated, low-privilege users of Siemens RUGGEDCOM CROSSBOW running any version earlier than V6.0 can bypass access controls on sensitive configuration records and retrieve administrative credentials for various internal systems, yielding unauthorized information disclosure and follow-on privilege escalation. The defect is an authorization bypass through a user-controlled key (CWE-639) that is network-reachable with low attack complexity but requires a valid session, consistent with the CVSS 4.0 vector's PR:L and high confidentiality, integrity and availability impact confined to the CROSSBOW system itself. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Siemens has released V6.0 to correct the condition.
SQL injection in the firmware-upload filename handling of Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) lets an authenticated attacker who holds firmware-upload privileges run arbitrary SQL commands against the product's underlying database, giving high confidentiality, integrity, and availability impact to the CROSSBOW server itself (CVSS 4.0 base 8.7; assessed CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not pre-authentication: valid credentials with the specific firmware-upload right are mandatory, and the injected payload must be placed in the uploaded file's name rather than its contents, while no second-party user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), and because CROSSBOW is a specialized OT access-management server normally deployed on segmented management networks, this is a credible but not top-tier priority.
SQL injection in the Value field of notification conditions handled by the Notification Profile configuration in RUGGEDCOM CROSSBOW (all versions before V6.0) allows an authenticated, suitably privileged user to execute arbitrary SQL commands against the product's underlying database. The flaw is network-reachable with no user interaction required, but it is gated by the privilege prerequisite - only accounts that can reach the Notification Profile configuration workflow can trigger it - so unauthenticated outsiders cannot exploit it directly; there is no public exploit identified at time of analysis. Siemens has published advisory SSA-508506 and V6.0 is the fixed release; given the high confidentiality, integrity, and availability impact on the CROSSBOW database and its OT-context role, this is a credible, actionable patch priority rather than an inflated alert.
Authenticated SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows a user with the specific privileges needed to use the Bulk Import/Export workflow to execute arbitrary SQL commands against the underlying database via unsanitized facility name fields. The vulnerability is network-reachable, low-complexity, and requires no user interaction, but it is access-gated: a valid privileged account is mandatory, so an attacker lacking that workflow privilege cannot reach the vulnerable code. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an advisory (SSA-508506) addressing the issue.
Path traversal in the Siemens .NET Client Library for the SIMATIC S7 Webserver API (all versions prior to V3.3.61) lets a remote attacker who controls or man-in-the-middles the server that the client downloads tickets from specify a crafted filename and thereby write arbitrary files outside the intended download directory. Integrity impact is high (VI:H) while confidentiality and availability impacts are none, consistent with the vendor's CVSS 4.0 base score of 8.7; the CVSS vector indicates no privileges (PR:N) or user interaction (UI:N) are required, so the only real prerequisite is that the attacker already occupies the server/MITM position relative to the victim client. The additional ability to replace existing files is limited to deployments where file overwriting is enabled. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation.
Siemens Industrial Edge App Publisher versions below V1.27.9 fails to sanitize or escape data received from the backend before rendering it in its integrated Node.js front end, enabling injected JavaScript to execute with the client's privileges and escalate to remote code execution on the victim's machine. Exploitation requires an attacker to control or influence backend-delivered data and a victim to actively view that data in the vulnerable client, making this a targeted threat rather than opportunistic mass exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a patch in V1.27.9.
Siemens Industrial Edge App Publisher versions prior to V1.27.9 fail to validate the server certificate when establishing TLS connections, allowing an attacker who already occupies a privileged man-in-the-middle position on the network path to intercept, relay, and spoof trusted server communication. The flaw is unauthenticated from a credential standpoint (CVSS vector PR:N) but requires on-path access plus victim-initiated connection activity (AT:P, UI:P), so exploitation is constrained to environments where an adversary can insert themselves between the client and the intended server - a meaningful hurdle in segmented industrial networks where App Publisher normally operates. No public exploit code or in-the-wild activity has been identified at time of analysis, and the practical risk is medium-to-high rather than emergency priority: integrity and confidentiality of publisher-to-server traffic are fully exposed (C:H/I:H), while availability is unaffected (A:N).
Siemens SIMATIC IPC devices (BX-21A, RW-543A, IPC227G/277G/277G PRO/327G/377G) contain a BIOS vendor test key in the UEFI Secure Boot key database, enabling an attacker with local physical or administrative access to boot an OS or UEFI application signed with that key and completely bypass Secure Boot protections. Exploitation is access-gated - requiring hands-on device access or existing administrative privilege - and no public exploit code or confirmed active exploitation has been identified at time of analysis, but successful compromise results in full loss of confidentiality, integrity, and availability of the device.
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Authenticated database users can escalate privileges and execute arbitrary operating-system commands on hosts running SIMATIC WinCC V7.5 (all versions), V8.0 before Update 11, and V8.1 before Update 7 because the application assigns excessive permissions to a database role (CWE-266). Exploitation requires a remote attacker to already hold valid database credentials and network reachability to the WinCC database service, but no user interaction is needed; no public exploit code has been identified at time of analysis. Siemens rates the issue 8.7, and while the impact is high, our independent assessment classifies it as a credible operational-technology priority rather than an emergency because the prerequisite of authenticated database access and network segmentation limits the realistic attack surface.
Authenticated, privileged remote attackers on affected Siemens Industrial Edge Device Kit installations (arm64 and x86-64, versions 1.5 through 1.28) and the listed SIMATIC/SIPLUS HMI Unified Comfort panels can reach internal APIs and file paths that the software fails to restrict, exposing sensitive internal information and - per the vendor's description - potentially enabling further unauthorized system access or deletion of data. Siemens rates this CVSS 4.0 8.9 High (AV:N/AC:L/AT:P/PR:H/UI:N with full VC/VI/VA:H on the vulnerable system plus SC/SI/SA:H on subsequent systems); our independent assessment concurs with the high impact rating but emphasizes that the score is driven by impact breadth rather than ease of access, because exploitation requires a valid privileged session and an additional attack precondition is signalled by the AT:P metric. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments.
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate practical risk for any internet- or OT-network-exposed deployment.
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact.
Reflected XSS in Siemens Teamcenter's authentication redirect endpoint (/auth/) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an already-authenticated user by delivering a crafted URL. Four active Teamcenter release trains are affected across versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. Successful exploitation enables the attacker to act within the victim's live Teamcenter PLM session - accessing engineering data, modifying records, or pivoting laterally - with no public exploit identified at time of analysis.
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
SAML response signature validation is absent or insufficient in the Mendix SAML module across all Mendix 9.24, 10, and 11 compatible releases prior to their respective patches, enabling unauthenticated remote attackers to forge SAML assertions and hijack arbitrary user sessions under specific SSO configurations. The flaw (CWE-347) is conditional on deployment configuration and requires passive user participation in an active SSO flow, moderating its exploitability from a mass-opportunistic standpoint. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance.
Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments.
Out-of-bounds read in Siemens Parasolid V38.0 and V38.1 allows code execution when a user opens a specially crafted X_T geometry file. The flaw (CWE-125) resides in the X_T file parser and can result in arbitrary code executing within the context of the host process - typically a CAD or PLM application embedding the Parasolid kernel. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 7.3 reflects the local attack vector and passive user interaction requirement that constrain opportunistic exploitation.
Out-of-bounds read during BMP file parsing in Siemens Simcenter Femap (all versions prior to V2606.0001) enables code execution within the context of the running process. An attacker must deliver a specially crafted BMP file and induce a local user to open it with the application. No public exploit or active exploitation has been identified at time of analysis, but the high CIA impact scores in the CVSS 4.0 vector confirm that successful exploitation achieves full process compromise.
Out-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code execution in the context of the running process. The flaw is triggered when a user opens a specially crafted BMP file, making it a classic file-format attack against a CAE/FEA desktop application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality/integrity/availability impact and the availability of a vendor-confirmed patch make prompt upgrading advisable.
Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices.
LOGO! Soft Comfort, Siemens' programming environment for LOGO! small programmable logic controllers, stores project protection passwords as unsalted SHA-256 hashes, enabling efficient offline recovery attacks against anyone who obtains a project file. All versions prior to V9 are affected according to Siemens advisory SSA-751328. An attacker who acquires the project file - through file system access, network share exposure, backup theft, or insider access - can bypass password protection by cracking the hash offline without rate-limiting or account lockout constraints. No public exploit has been identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Hardcoded AES encryption in Siemens LOGO! Soft Comfort (all versions before V9) exposes every password-protected project file to decryption without knowledge of any user-defined password. A local attacker who can access the application installation - via shared workstation access, insider position, or post-compromise foothold - can extract the static master key from binaries or process memory and apply it universally to any project file ever encrypted by the affected software. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains.
Out-of-bounds read in Siemens Solid Edge's PAR file parser enables code execution within the running process when a victim opens a specially crafted part file. Both active product branches are affected: SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7. No public exploit code or CISA KEV listing exists at time of analysis, but the vendor-confirmed code-execution primitive elevates this beyond a typical information-disclosure finding tagged under CWE-125.
Use-after-free in Siemens Solid Edge SE2025 and SE2026 enables arbitrary code execution in the context of the current process when a user opens a specially crafted DFT file. Both affected annual release branches are vulnerable until patched - SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7 - as confirmed by Siemens Security Advisory SSA-621657. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 AC:H rating indicates non-trivial exploit development is required.
Use-after-free memory corruption in Siemens Solid Edge SE2025 and SE2026 allows code execution in the context of the current user process when a specially crafted DFT (draft) file is parsed. Affected are all SE2025 releases prior to V225.0 Update 15 and all SE2026 releases prior to V226.0 Update 7, as confirmed by Siemens advisory SSA-621657. No public exploit code or active exploitation has been identified at time of analysis, and the local attack vector combined with required user interaction meaningfully constrains real-world exposure.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657.
Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations.
Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV.
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Malicious firmware installation is possible on Siemens CPCI85 Central Processing/Communication firmware (versions before V26.20) and the SICORE Base System (before V26.20.0) because the firmware update mechanism fails to properly validate signatures. An attacker with high privileges and local access can push crafted, tampered firmware to achieve persistent code execution and full device compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial of service in Siemens CPCI85 Central Processing/Communication firmware and SICORE Base System (all versions before V26.20 / V26.20.0) allows an authenticated attacker to crash the device's web process via a leftover debugging interface exposed on HTTP endpoints. The flaw stems from active debug code shipped in production firmware and affects only availability, not data confidentiality or integrity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in Siemens SINEC INS (versions prior to V1.0 SP2 Update 6) stems from a binary shipped with the Linux cap_dac_override capability, which bypasses filesystem discretionary access control checks. An authenticated local attacker can leverage this overly broad capability to read or modify any file on the system, ultimately obtaining root. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated command injection in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 allows remote attackers to execute arbitrary OS commands as the sinecins service account by submitting crafted directory names to the /api/sftp/uploadFiles endpoint. The injected payloads are stored and triggered later when directory listings are retrieved, producing a stored/second-order command injection. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability of the underlying host.
Sensitive key material extraction is possible in Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to V21 Update 2) due to insufficient protection in the WinCC Certificate Manager component. A local attacker on an affected HMI/SCADA workstation could harvest cryptographic key material that protects operator certificates, potentially enabling impersonation or downstream attacks against industrial control networks. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in Siemens Solid Edge SE2026 allows arbitrary code execution when users open malicious PAR files. Attackers must deliver a weaponized PAR file and convince the user to open it, after which code executes with user's privileges. All versions prior to V226.0 Update 5 are vulnerable. No active exploitation confirmed (not in CISA KEV), but the attack relies on user interaction with a common CAD file format, making social engineering feasible in engineering/manufacturing environments.
Uninitialized pointer access in Siemens Solid Edge SE2026 enables arbitrary code execution when processing malicious PAR files. Attackers must deliver a crafted PAR file and convince users to open it (CVSS:4.0 AV:L/UI:P), achieving full compromise of the victim's workstation with high confidentiality, integrity, and availability impact. No active exploitation confirmed at time of analysis, though the local attack vector and user interaction requirement limit automated mass exploitation. EPSS data not available for risk calibration.
Remote path traversal in Siemens ROS# versions prior to V2.2.2 enables unauthenticated attackers to read arbitrary files from affected systems due to insufficient input sanitization. The vulnerability affects the ROS# library, a C# .NET implementation for Robot Operating System communication, with CVSS 9.3 critical severity. No active exploitation or public exploit code has been identified at time of analysis, though the network-accessible attack vector and lack of authentication requirements present significant risk for robotics systems using this library.
Hardcoded cryptographic keys in Siemens Teamcenter PLM software enable remote attackers to bypass authentication and gain unauthorized access to confidential product lifecycle management data. The vulnerability affects multiple Teamcenter versions (V2312, V2406, V2412, V2506, V2512) and is remotely exploitable without authentication (CVSS:4.0 AV:N/AC:L/PR:N). While no active exploitation or public POC has been identified at time of analysis, the straightforward nature of hardcoded credential extraction (AC:L) combined with the criticality of Teamcenter as an enterprise PLM platform housing intellectual property makes this a high-priority remediation target for manufacturing and engineering organizations.
Stored cross-site scripting (XSS) in Siemens Teamcenter allows authenticated attackers with low privileges to inject malicious JavaScript that executes in other users' browser sessions, enabling session hijacking, credential theft, or unauthorized actions within the product lifecycle management platform. Affects Teamcenter versions V2312 through V2512 with vendor patches released for all branches. CVSS v4.0 scores 8.5 (High) due to network attack vector with low complexity, though exploitation requires user interaction and authenticated access. No public exploit code or CISA KEV listing identified at time of analysis.
Local unauthenticated attackers can access the web browser on Siemens SIMATIC HMI Unified Comfort and Comfort Pro panels (all models <V21) via the Control Panel when security mechanisms are not configured. The CVSS v4.0 score of 7.0 reflects high integrity and availability impact (VI:H/VA:H) with local attack vector (AV:L), low complexity (AC:L), and no authentication required (PR:N). The vulnerability is classified as CWE-1188 (Initialization of a Resource with an Insecure Default) and tagged as Authentication Bypass. No public exploit or active exploitation confirmed at time of analysis, but the local access requirement and lack of default protections significantly lower the attack bar in environments where physical or local system access is feasible, such as industrial control settings.
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attackers with high privileges to inject malicious scripts via Technology Object (TO) names when downloading TIA Portal projects. The scripts execute when authorized users access the Motion Control Diagnostics web interface page, enabling session hijacking, credential theft, or privileged actions performed under the victim's context. This affects over 100 product variants across industrial automation controllers, software controllers, and open controllers. No active exploitation confirmed (not in CISA KEV). EPSS score not provided in dataset. CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability in both vulnerable and subsequent systems.
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access.
Siemens SIMATIC CN 4100 versions prior to V5.0 can be rendered unavailable through TCP SYN flood attacks, allowing remote unauthenticated attackers to exhaust system resources and cause complete service disruption. The CVSS 4.0 score of 8.7 reflects the high availability impact (VA:H) combined with network-accessible attack vector requiring no privileges or user interaction. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though SYN flood techniques are well-documented and trivial to execute.
Remote unauthenticated attackers can exhaust resources and bypass authentication controls in Siemens SIMATIC CN 4100 versions before V5.0, enabling denial of service conditions and unauthorized actions that compromise system availability and integrity. The vulnerability stems from improper connection validation (CWE-306), allowing network-based exploitation without any user interaction or privileges. Siemens has released V5.0 to address this flaw, documented in security advisory SSA-032379.
Privilege escalation in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions prior to V5.8 allows authenticated User Administrators to escalate their own privileges through improper group administration controls. Authenticated attackers with low-privilege User Administrator credentials can exploit flawed group membership logic to grant themselves unrestricted access to any device group at any access level, achieving full administrative control over critical industrial infrastructure. CVSS 8.8 (High) reflects network-accessible attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis, though the attack path is straightforward for authenticated insiders.
SINEC NMS versions prior to V4.0 SP3 allow authenticated remote attackers to reset any user account password due to improper authorization validation (CWE-639). An attacker with low-privilege credentials can escalate to administrative access by resetting privileged user passwords, enabling complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit code identified at time of analysis, though the network attack vector (AV:N) and low complexity (AC:L) increase exploitation feasibility for authenticated attackers.
Out-of-bounds write vulnerabilities in Siemens CPCI85 Central Processing/Communication and SICORE Base system (versions below V26.10) allow unauthenticated remote attackers to crash critical industrial control system services through maliciously crafted XML requests, resulting in denial-of-service conditions. CISA's SSVC framework marks this as automatable with partial technical impact, though no public exploit has been identified at time of analysis. The CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network accessibility requiring no authentication (PR:N).
Remote denial-of-service in Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base (versions below V26.10) allows adjacent network attackers to exhaust system resources via high-volume requests, forcing device reset or reboot to restore parameterization functionality. No public exploit identified at time of analysis. CVSS 7.1 (High) with adjacent network access vector and no privileges required indicates moderate real-world risk for industrial environments where these RTU and control processing devices operate.
Command injection in SICAM SIAPP SDK versions prior to 2.1.7 allows unauthenticated local attackers to manipulate shell command construction and achieve arbitrary code execution with full system privileges. The vulnerability stems from insufficient input validation when building and executing system commands with user-supplied data. No patch is currently available, leaving all affected versions vulnerable to complete system compromise.
Insufficient input validation in SICAM SIAPP SDK versions prior to V2.1.7 enables stack overflow attacks, permitting local attackers to execute arbitrary code or trigger denial of service. The vulnerability affects all versions below the patched release, with no currently available remediation for deployed systems. Attackers with local access can leverage malformed input to corrupt the stack and gain code execution privileges.
Out-of-bounds write vulnerability in SICAM SIAPP SDK versions prior to V2.1.7 allows local attackers to corrupt memory and achieve arbitrary code execution or denial of service. The vulnerability requires local access and specific conditions to trigger, but no patch is currently available. Affected organizations using vulnerable SDK versions should immediately implement compensating controls or upgrade to V2.1.7 or later.
Arbitrary code execution with SYSTEM privileges in SINEC NMS User Management Component (all versions prior to V2.15.2.1) stems from improper access controls allowing low-privileged users to modify configuration files and load malicious DLLs. An authenticated attacker can exploit this to achieve complete system compromise. No patch is currently available.
Arbitrary code execution in Siemens SINEC NMS versions prior to V4.0 SP2 can be achieved when a low-privileged user modifies configuration files to load malicious DLLs, resulting in administrative privilege execution. This local vulnerability affects all current deployments and currently has no available patch. An authenticated attacker with local access can exploit this to gain full system compromise.
Code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds read flaw triggered when parsing malicious NDB files. A local attacker with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.
Heap-based buffer overflow in Simcenter Femap and Nastran versions prior to V2512 allows local attackers to achieve arbitrary code execution by crafting malicious NDB files. The vulnerability requires user interaction to trigger and affects all current versions of both products. No patch is currently available, leaving affected systems at risk of privilege escalation and system compromise.
Out-of-bounds read in Simcenter Femap and Nastran versions prior to V2512 during NDB file parsing enables local code execution under the current process context. An attacker can exploit this vulnerability through specially crafted NDB files to achieve arbitrary code execution. No patch is currently available for this high-severity vulnerability affecting both products.
Simcenter Femap and Nastran versions prior to 2512 are vulnerable to out-of-bounds memory reads when processing maliciously crafted XDB files, enabling arbitrary code execution with the privileges of the affected application. Local attackers can exploit this vulnerability through specially designed files to achieve full system compromise. No patch is currently available for this high-severity flaw.
Arbitrary code execution in Simcenter Femap and Nastran versions prior to 2512 results from an out-of-bounds read when processing malicious XDB files, enabling local attackers to achieve process-level code execution. An attacker with local access can craft a specially designed XDB file to trigger the memory vulnerability and execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.
Arbitrary code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds write flaw triggered by parsing malicious XDB files. Local attackers with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this high-severity vulnerability.
Nx versions prior to V2512 contain an insufficient input validation flaw in the PDF export functionality that permits local attackers to corrupt internal data structures and achieve arbitrary code execution. An attacker with local file system access can exploit this vulnerability to manipulate the export process and gain code execution privileges. No patch is currently available for this vulnerability.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote code execution through crafted log messages, affecting virtually every Java application on Earth and triggering the largest vulnerability remediation effort in history.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.48 and earlier. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Siemens Software Center (all versions) loads dynamic-link libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to stage a crafted DLL where the application will load it and achieve arbitrary code execution in the application's context, with full confidentiality, integrity, and availability impact on the affected host. The vendor scores this CWE-427 DLL-hijacking issue CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N), and our independent assessment agrees on the local vector, no user interaction, unchanged scope, and high C/I/A impact. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is constrained to a local, already highly privileged actor able to write to a directory on the loader's search path.
A stack-based buffer overflow in the web service upload-handling code of Siemens APOGEE and TALON building-automation controllers allows an unauthenticated remote attacker to crash the device, producing a denial-of-service condition. Affected platforms include APOGEE PXC Compact and PXC Modular (BACnet all versions before V3.5.7, P2 Ethernet all versions before V2.8.21), TALON TC Compact and TC Modular (BACnet all versions before V3.5.7), and the APOGEE MBC/MEC (PPC) variants in BACnet and P2 Ethernet builds, which are listed as affected in all versions. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but exploitation is trivial from a network standpoint - the CVSS vector confirms PR:N/UI:N with low attack complexity - so any controller whose HTTP upload interface is reachable is at risk. Siemens rates this CVSS 4.0 8.7; our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Denial of service in the embedded web service of Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, and TALON TC building-automation controllers, caused by improper validation of multipart input that can crash the service via a stack buffer overflow (CWE-121). An unauthenticated remote attacker with network reachability to the controller's HTTP interface (CVSS PR:N/UI:N) can send a crafted multipart request and take the web service down; the assessed impact is availability-only (C:N/I:N/A:H), with no confidentiality or integrity loss demonstrated. Exploitation is bounded by exposure: these are OT field panels normally expected on segmented building networks, and no public exploit code has been identified at time of analysis - this is a credible OT risk for internet- or IT-reachable controllers, not a confirmed widespread-exploitation emergency. All-version APOGEE MBC/MEC (PPC) models carry the highest residual risk because no fixed version is listed for them, whereas APOGEE PXC Compact/Modular (BACnet) and TALON TC are fixed at V3.5.7 and the P2 Ethernet PXC Compacts at V2.8.21.
Unauthenticated remote attackers can cause a denial of service on Siemens APOGEE MBC/MEC, PXC, and TALON building automation controllers by sending a crafted input that triggers a stack-based buffer overflow (CWE-121) in the device's FTP service. The flaw affects all versions of the MBC and MEC PPC families and PXC/TALON TC models below BACnet V3.5.7 or P2 Ethernet V2.8.21. No public exploit code or confirmed active exploitation has been identified, and the impact is limited to availability (no confidentiality or integrity impact); real-world risk hinges on whether the FTP service is enabled and reachable from an attacker's position on the OT network.
Unauthenticated remote attackers can read portions of device memory or cause a denial-of-service condition in Siemens APOGEE MBC/MEC and PXC, and TALON TC building controllers through the embedded web service, due to improper length validation of user-controllable input (CWE-191 integer underflow). Affected versions include APOGEE PXC Compact/Modular (BACnet) before V3.5.7 and (P2 Ethernet) before V2.8.21, TALON TC Compact/Modular (BACnet) before V3.5.7, and all versions of APOGEE MBC and MEC. No public exploit has been identified at the time of analysis; the vendor has released patches for the PXC and TALON variants, but no fix is available for MBC/MEC.
Authenticated attackers with minimal privileges can disconnect active sessions of other users, including administrators, in Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 due to missing authorization checks on device-disconnection requests, causing a denial of service. The flaw is network-reachable, requires low privileges (PR:L) and no user interaction, and affects only availability (VA:H) with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows an authenticated user who can create or edit device group or facility names to execute arbitrary SQL commands against the underlying database, with the injected payload only firing when those stored names are subsequently processed by the Bulk Export workflow. Attackers must hold valid credentials with name-editing privileges, and the assessed vectors (CVSS 4.0 base 7.7 with AC:H/PR:L; independent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicate additional non-default preconditions must be satisfied before the payload executes. No public exploit code has been identified at time of analysis, and this is a credentialed, moderate-priority vulnerability rather than a mass-exploitation emergency, with realistic exposure largely limited to insiders or attackers who have already compromised an operator account on an unpatched installation.
SQL injection in RUGGEDCOM CROSSBOW versions below V6.0 lets an attacker who already holds administrative credentials inject arbitrary SQL commands through the Name and Value fields of custom file labels, compromising the underlying database. The vendor-assessed vector (CVSS 4.0 8.4, PR:H, AV:L) and our independent assessment converge on a high-severity but access-gated issue: exploitation requires an authenticated administrative session and local access, with no user interaction, and no public exploit code identified at time of analysis. Siemens has released a fix in V6.0, so the practical priority is moderate and centered on insider or compromised-admin scenarios rather than external mass exploitation.
Authenticated, low-privilege users of Siemens RUGGEDCOM CROSSBOW running any version earlier than V6.0 can bypass access controls on sensitive configuration records and retrieve administrative credentials for various internal systems, yielding unauthorized information disclosure and follow-on privilege escalation. The defect is an authorization bypass through a user-controlled key (CWE-639) that is network-reachable with low attack complexity but requires a valid session, consistent with the CVSS 4.0 vector's PR:L and high confidentiality, integrity and availability impact confined to the CROSSBOW system itself. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Siemens has released V6.0 to correct the condition.
SQL injection in the firmware-upload filename handling of Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) lets an authenticated attacker who holds firmware-upload privileges run arbitrary SQL commands against the product's underlying database, giving high confidentiality, integrity, and availability impact to the CROSSBOW server itself (CVSS 4.0 base 8.7; assessed CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not pre-authentication: valid credentials with the specific firmware-upload right are mandatory, and the injected payload must be placed in the uploaded file's name rather than its contents, while no second-party user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), and because CROSSBOW is a specialized OT access-management server normally deployed on segmented management networks, this is a credible but not top-tier priority.
SQL injection in the Value field of notification conditions handled by the Notification Profile configuration in RUGGEDCOM CROSSBOW (all versions before V6.0) allows an authenticated, suitably privileged user to execute arbitrary SQL commands against the product's underlying database. The flaw is network-reachable with no user interaction required, but it is gated by the privilege prerequisite - only accounts that can reach the Notification Profile configuration workflow can trigger it - so unauthenticated outsiders cannot exploit it directly; there is no public exploit identified at time of analysis. Siemens has published advisory SSA-508506 and V6.0 is the fixed release; given the high confidentiality, integrity, and availability impact on the CROSSBOW database and its OT-context role, this is a credible, actionable patch priority rather than an inflated alert.
Authenticated SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows a user with the specific privileges needed to use the Bulk Import/Export workflow to execute arbitrary SQL commands against the underlying database via unsanitized facility name fields. The vulnerability is network-reachable, low-complexity, and requires no user interaction, but it is access-gated: a valid privileged account is mandatory, so an attacker lacking that workflow privilege cannot reach the vulnerable code. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an advisory (SSA-508506) addressing the issue.
Path traversal in the Siemens .NET Client Library for the SIMATIC S7 Webserver API (all versions prior to V3.3.61) lets a remote attacker who controls or man-in-the-middles the server that the client downloads tickets from specify a crafted filename and thereby write arbitrary files outside the intended download directory. Integrity impact is high (VI:H) while confidentiality and availability impacts are none, consistent with the vendor's CVSS 4.0 base score of 8.7; the CVSS vector indicates no privileges (PR:N) or user interaction (UI:N) are required, so the only real prerequisite is that the attacker already occupies the server/MITM position relative to the victim client. The additional ability to replace existing files is limited to deployments where file overwriting is enabled. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation.
Siemens Industrial Edge App Publisher versions below V1.27.9 fails to sanitize or escape data received from the backend before rendering it in its integrated Node.js front end, enabling injected JavaScript to execute with the client's privileges and escalate to remote code execution on the victim's machine. Exploitation requires an attacker to control or influence backend-delivered data and a victim to actively view that data in the vulnerable client, making this a targeted threat rather than opportunistic mass exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a patch in V1.27.9.
Siemens Industrial Edge App Publisher versions prior to V1.27.9 fail to validate the server certificate when establishing TLS connections, allowing an attacker who already occupies a privileged man-in-the-middle position on the network path to intercept, relay, and spoof trusted server communication. The flaw is unauthenticated from a credential standpoint (CVSS vector PR:N) but requires on-path access plus victim-initiated connection activity (AT:P, UI:P), so exploitation is constrained to environments where an adversary can insert themselves between the client and the intended server - a meaningful hurdle in segmented industrial networks where App Publisher normally operates. No public exploit code or in-the-wild activity has been identified at time of analysis, and the practical risk is medium-to-high rather than emergency priority: integrity and confidentiality of publisher-to-server traffic are fully exposed (C:H/I:H), while availability is unaffected (A:N).
Siemens SIMATIC IPC devices (BX-21A, RW-543A, IPC227G/277G/277G PRO/327G/377G) contain a BIOS vendor test key in the UEFI Secure Boot key database, enabling an attacker with local physical or administrative access to boot an OS or UEFI application signed with that key and completely bypass Secure Boot protections. Exploitation is access-gated - requiring hands-on device access or existing administrative privilege - and no public exploit code or confirmed active exploitation has been identified at time of analysis, but successful compromise results in full loss of confidentiality, integrity, and availability of the device.
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Authenticated database users can escalate privileges and execute arbitrary operating-system commands on hosts running SIMATIC WinCC V7.5 (all versions), V8.0 before Update 11, and V8.1 before Update 7 because the application assigns excessive permissions to a database role (CWE-266). Exploitation requires a remote attacker to already hold valid database credentials and network reachability to the WinCC database service, but no user interaction is needed; no public exploit code has been identified at time of analysis. Siemens rates the issue 8.7, and while the impact is high, our independent assessment classifies it as a credible operational-technology priority rather than an emergency because the prerequisite of authenticated database access and network segmentation limits the realistic attack surface.
Authenticated, privileged remote attackers on affected Siemens Industrial Edge Device Kit installations (arm64 and x86-64, versions 1.5 through 1.28) and the listed SIMATIC/SIPLUS HMI Unified Comfort panels can reach internal APIs and file paths that the software fails to restrict, exposing sensitive internal information and - per the vendor's description - potentially enabling further unauthorized system access or deletion of data. Siemens rates this CVSS 4.0 8.9 High (AV:N/AC:L/AT:P/PR:H/UI:N with full VC/VI/VA:H on the vulnerable system plus SC/SI/SA:H on subsequent systems); our independent assessment concurs with the high impact rating but emphasizes that the score is driven by impact breadth rather than ease of access, because exploitation requires a valid privileged session and an additional attack precondition is signalled by the AT:P metric. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments.
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate practical risk for any internet- or OT-network-exposed deployment.
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact.
Reflected XSS in Siemens Teamcenter's authentication redirect endpoint (/auth/) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an already-authenticated user by delivering a crafted URL. Four active Teamcenter release trains are affected across versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. Successful exploitation enables the attacker to act within the victim's live Teamcenter PLM session - accessing engineering data, modifying records, or pivoting laterally - with no public exploit identified at time of analysis.
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
SAML response signature validation is absent or insufficient in the Mendix SAML module across all Mendix 9.24, 10, and 11 compatible releases prior to their respective patches, enabling unauthenticated remote attackers to forge SAML assertions and hijack arbitrary user sessions under specific SSO configurations. The flaw (CWE-347) is conditional on deployment configuration and requires passive user participation in an active SSO flow, moderating its exploitability from a mass-opportunistic standpoint. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance.
Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments.
Out-of-bounds read in Siemens Parasolid V38.0 and V38.1 allows code execution when a user opens a specially crafted X_T geometry file. The flaw (CWE-125) resides in the X_T file parser and can result in arbitrary code executing within the context of the host process - typically a CAD or PLM application embedding the Parasolid kernel. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 7.3 reflects the local attack vector and passive user interaction requirement that constrain opportunistic exploitation.
Out-of-bounds read during BMP file parsing in Siemens Simcenter Femap (all versions prior to V2606.0001) enables code execution within the context of the running process. An attacker must deliver a specially crafted BMP file and induce a local user to open it with the application. No public exploit or active exploitation has been identified at time of analysis, but the high CIA impact scores in the CVSS 4.0 vector confirm that successful exploitation achieves full process compromise.
Out-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code execution in the context of the running process. The flaw is triggered when a user opens a specially crafted BMP file, making it a classic file-format attack against a CAE/FEA desktop application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality/integrity/availability impact and the availability of a vendor-confirmed patch make prompt upgrading advisable.
Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices.
LOGO! Soft Comfort, Siemens' programming environment for LOGO! small programmable logic controllers, stores project protection passwords as unsalted SHA-256 hashes, enabling efficient offline recovery attacks against anyone who obtains a project file. All versions prior to V9 are affected according to Siemens advisory SSA-751328. An attacker who acquires the project file - through file system access, network share exposure, backup theft, or insider access - can bypass password protection by cracking the hash offline without rate-limiting or account lockout constraints. No public exploit has been identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Hardcoded AES encryption in Siemens LOGO! Soft Comfort (all versions before V9) exposes every password-protected project file to decryption without knowledge of any user-defined password. A local attacker who can access the application installation - via shared workstation access, insider position, or post-compromise foothold - can extract the static master key from binaries or process memory and apply it universally to any project file ever encrypted by the affected software. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains.
Out-of-bounds read in Siemens Solid Edge's PAR file parser enables code execution within the running process when a victim opens a specially crafted part file. Both active product branches are affected: SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7. No public exploit code or CISA KEV listing exists at time of analysis, but the vendor-confirmed code-execution primitive elevates this beyond a typical information-disclosure finding tagged under CWE-125.
Use-after-free in Siemens Solid Edge SE2025 and SE2026 enables arbitrary code execution in the context of the current process when a user opens a specially crafted DFT file. Both affected annual release branches are vulnerable until patched - SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7 - as confirmed by Siemens Security Advisory SSA-621657. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 AC:H rating indicates non-trivial exploit development is required.
Use-after-free memory corruption in Siemens Solid Edge SE2025 and SE2026 allows code execution in the context of the current user process when a specially crafted DFT (draft) file is parsed. Affected are all SE2025 releases prior to V225.0 Update 15 and all SE2026 releases prior to V226.0 Update 7, as confirmed by Siemens advisory SSA-621657. No public exploit code or active exploitation has been identified at time of analysis, and the local attack vector combined with required user interaction meaningfully constrains real-world exposure.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657.
Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations.
Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV.
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Malicious firmware installation is possible on Siemens CPCI85 Central Processing/Communication firmware (versions before V26.20) and the SICORE Base System (before V26.20.0) because the firmware update mechanism fails to properly validate signatures. An attacker with high privileges and local access can push crafted, tampered firmware to achieve persistent code execution and full device compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial of service in Siemens CPCI85 Central Processing/Communication firmware and SICORE Base System (all versions before V26.20 / V26.20.0) allows an authenticated attacker to crash the device's web process via a leftover debugging interface exposed on HTTP endpoints. The flaw stems from active debug code shipped in production firmware and affects only availability, not data confidentiality or integrity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in Siemens SINEC INS (versions prior to V1.0 SP2 Update 6) stems from a binary shipped with the Linux cap_dac_override capability, which bypasses filesystem discretionary access control checks. An authenticated local attacker can leverage this overly broad capability to read or modify any file on the system, ultimately obtaining root. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated command injection in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 allows remote attackers to execute arbitrary OS commands as the sinecins service account by submitting crafted directory names to the /api/sftp/uploadFiles endpoint. The injected payloads are stored and triggered later when directory listings are retrieved, producing a stored/second-order command injection. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability of the underlying host.
Sensitive key material extraction is possible in Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to V21 Update 2) due to insufficient protection in the WinCC Certificate Manager component. A local attacker on an affected HMI/SCADA workstation could harvest cryptographic key material that protects operator certificates, potentially enabling impersonation or downstream attacks against industrial control networks. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in Siemens Solid Edge SE2026 allows arbitrary code execution when users open malicious PAR files. Attackers must deliver a weaponized PAR file and convince the user to open it, after which code executes with user's privileges. All versions prior to V226.0 Update 5 are vulnerable. No active exploitation confirmed (not in CISA KEV), but the attack relies on user interaction with a common CAD file format, making social engineering feasible in engineering/manufacturing environments.
Uninitialized pointer access in Siemens Solid Edge SE2026 enables arbitrary code execution when processing malicious PAR files. Attackers must deliver a crafted PAR file and convince users to open it (CVSS:4.0 AV:L/UI:P), achieving full compromise of the victim's workstation with high confidentiality, integrity, and availability impact. No active exploitation confirmed at time of analysis, though the local attack vector and user interaction requirement limit automated mass exploitation. EPSS data not available for risk calibration.
Remote path traversal in Siemens ROS# versions prior to V2.2.2 enables unauthenticated attackers to read arbitrary files from affected systems due to insufficient input sanitization. The vulnerability affects the ROS# library, a C# .NET implementation for Robot Operating System communication, with CVSS 9.3 critical severity. No active exploitation or public exploit code has been identified at time of analysis, though the network-accessible attack vector and lack of authentication requirements present significant risk for robotics systems using this library.
Hardcoded cryptographic keys in Siemens Teamcenter PLM software enable remote attackers to bypass authentication and gain unauthorized access to confidential product lifecycle management data. The vulnerability affects multiple Teamcenter versions (V2312, V2406, V2412, V2506, V2512) and is remotely exploitable without authentication (CVSS:4.0 AV:N/AC:L/PR:N). While no active exploitation or public POC has been identified at time of analysis, the straightforward nature of hardcoded credential extraction (AC:L) combined with the criticality of Teamcenter as an enterprise PLM platform housing intellectual property makes this a high-priority remediation target for manufacturing and engineering organizations.
Stored cross-site scripting (XSS) in Siemens Teamcenter allows authenticated attackers with low privileges to inject malicious JavaScript that executes in other users' browser sessions, enabling session hijacking, credential theft, or unauthorized actions within the product lifecycle management platform. Affects Teamcenter versions V2312 through V2512 with vendor patches released for all branches. CVSS v4.0 scores 8.5 (High) due to network attack vector with low complexity, though exploitation requires user interaction and authenticated access. No public exploit code or CISA KEV listing identified at time of analysis.
Local unauthenticated attackers can access the web browser on Siemens SIMATIC HMI Unified Comfort and Comfort Pro panels (all models <V21) via the Control Panel when security mechanisms are not configured. The CVSS v4.0 score of 7.0 reflects high integrity and availability impact (VI:H/VA:H) with local attack vector (AV:L), low complexity (AC:L), and no authentication required (PR:N). The vulnerability is classified as CWE-1188 (Initialization of a Resource with an Insecure Default) and tagged as Authentication Bypass. No public exploit or active exploitation confirmed at time of analysis, but the local access requirement and lack of default protections significantly lower the attack bar in environments where physical or local system access is feasible, such as industrial control settings.
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attackers with high privileges to inject malicious scripts via Technology Object (TO) names when downloading TIA Portal projects. The scripts execute when authorized users access the Motion Control Diagnostics web interface page, enabling session hijacking, credential theft, or privileged actions performed under the victim's context. This affects over 100 product variants across industrial automation controllers, software controllers, and open controllers. No active exploitation confirmed (not in CISA KEV). EPSS score not provided in dataset. CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability in both vulnerable and subsequent systems.
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access.
Siemens SIMATIC CN 4100 versions prior to V5.0 can be rendered unavailable through TCP SYN flood attacks, allowing remote unauthenticated attackers to exhaust system resources and cause complete service disruption. The CVSS 4.0 score of 8.7 reflects the high availability impact (VA:H) combined with network-accessible attack vector requiring no privileges or user interaction. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though SYN flood techniques are well-documented and trivial to execute.
Remote unauthenticated attackers can exhaust resources and bypass authentication controls in Siemens SIMATIC CN 4100 versions before V5.0, enabling denial of service conditions and unauthorized actions that compromise system availability and integrity. The vulnerability stems from improper connection validation (CWE-306), allowing network-based exploitation without any user interaction or privileges. Siemens has released V5.0 to address this flaw, documented in security advisory SSA-032379.
Privilege escalation in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions prior to V5.8 allows authenticated User Administrators to escalate their own privileges through improper group administration controls. Authenticated attackers with low-privilege User Administrator credentials can exploit flawed group membership logic to grant themselves unrestricted access to any device group at any access level, achieving full administrative control over critical industrial infrastructure. CVSS 8.8 (High) reflects network-accessible attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis, though the attack path is straightforward for authenticated insiders.
SINEC NMS versions prior to V4.0 SP3 allow authenticated remote attackers to reset any user account password due to improper authorization validation (CWE-639). An attacker with low-privilege credentials can escalate to administrative access by resetting privileged user passwords, enabling complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit code identified at time of analysis, though the network attack vector (AV:N) and low complexity (AC:L) increase exploitation feasibility for authenticated attackers.
Out-of-bounds write vulnerabilities in Siemens CPCI85 Central Processing/Communication and SICORE Base system (versions below V26.10) allow unauthenticated remote attackers to crash critical industrial control system services through maliciously crafted XML requests, resulting in denial-of-service conditions. CISA's SSVC framework marks this as automatable with partial technical impact, though no public exploit has been identified at time of analysis. The CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network accessibility requiring no authentication (PR:N).
Remote denial-of-service in Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base (versions below V26.10) allows adjacent network attackers to exhaust system resources via high-volume requests, forcing device reset or reboot to restore parameterization functionality. No public exploit identified at time of analysis. CVSS 7.1 (High) with adjacent network access vector and no privileges required indicates moderate real-world risk for industrial environments where these RTU and control processing devices operate.
Command injection in SICAM SIAPP SDK versions prior to 2.1.7 allows unauthenticated local attackers to manipulate shell command construction and achieve arbitrary code execution with full system privileges. The vulnerability stems from insufficient input validation when building and executing system commands with user-supplied data. No patch is currently available, leaving all affected versions vulnerable to complete system compromise.
Insufficient input validation in SICAM SIAPP SDK versions prior to V2.1.7 enables stack overflow attacks, permitting local attackers to execute arbitrary code or trigger denial of service. The vulnerability affects all versions below the patched release, with no currently available remediation for deployed systems. Attackers with local access can leverage malformed input to corrupt the stack and gain code execution privileges.
Out-of-bounds write vulnerability in SICAM SIAPP SDK versions prior to V2.1.7 allows local attackers to corrupt memory and achieve arbitrary code execution or denial of service. The vulnerability requires local access and specific conditions to trigger, but no patch is currently available. Affected organizations using vulnerable SDK versions should immediately implement compensating controls or upgrade to V2.1.7 or later.
Arbitrary code execution with SYSTEM privileges in SINEC NMS User Management Component (all versions prior to V2.15.2.1) stems from improper access controls allowing low-privileged users to modify configuration files and load malicious DLLs. An authenticated attacker can exploit this to achieve complete system compromise. No patch is currently available.
Arbitrary code execution in Siemens SINEC NMS versions prior to V4.0 SP2 can be achieved when a low-privileged user modifies configuration files to load malicious DLLs, resulting in administrative privilege execution. This local vulnerability affects all current deployments and currently has no available patch. An authenticated attacker with local access can exploit this to gain full system compromise.
Code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds read flaw triggered when parsing malicious NDB files. A local attacker with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.
Heap-based buffer overflow in Simcenter Femap and Nastran versions prior to V2512 allows local attackers to achieve arbitrary code execution by crafting malicious NDB files. The vulnerability requires user interaction to trigger and affects all current versions of both products. No patch is currently available, leaving affected systems at risk of privilege escalation and system compromise.
Out-of-bounds read in Simcenter Femap and Nastran versions prior to V2512 during NDB file parsing enables local code execution under the current process context. An attacker can exploit this vulnerability through specially crafted NDB files to achieve arbitrary code execution. No patch is currently available for this high-severity vulnerability affecting both products.
Simcenter Femap and Nastran versions prior to 2512 are vulnerable to out-of-bounds memory reads when processing maliciously crafted XDB files, enabling arbitrary code execution with the privileges of the affected application. Local attackers can exploit this vulnerability through specially designed files to achieve full system compromise. No patch is currently available for this high-severity flaw.
Arbitrary code execution in Simcenter Femap and Nastran versions prior to 2512 results from an out-of-bounds read when processing malicious XDB files, enabling local attackers to achieve process-level code execution. An attacker with local access can craft a specially designed XDB file to trigger the memory vulnerability and execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.
Arbitrary code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds write flaw triggered by parsing malicious XDB files. Local attackers with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this high-severity vulnerability.
Nx versions prior to V2512 contain an insufficient input validation flaw in the PDF export functionality that permits local attackers to corrupt internal data structures and achieve arbitrary code execution. An attacker with local file system access can exploit this vulnerability to manipulate the export process and gain code execution privileges. No patch is currently available for this vulnerability.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote code execution through crafted log messages, affecting virtually every Java application on Earth and triggering the largest vulnerability remediation effort in history.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.48 and earlier. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.