Siemens
Monthly
Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments.
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate practical risk for any internet- or OT-network-exposed deployment.
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact.
Reflected XSS in Siemens Teamcenter's authentication redirect endpoint (/auth/) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an already-authenticated user by delivering a crafted URL. Four active Teamcenter release trains are affected across versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. Successful exploitation enables the attacker to act within the victim's live Teamcenter PLM session - accessing engineering data, modifying records, or pivoting laterally - with no public exploit identified at time of analysis.
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
SAML response signature validation is absent or insufficient in the Mendix SAML module across all Mendix 9.24, 10, and 11 compatible releases prior to their respective patches, enabling unauthenticated remote attackers to forge SAML assertions and hijack arbitrary user sessions under specific SSO configurations. The flaw (CWE-347) is conditional on deployment configuration and requires passive user participation in an active SSO flow, moderating its exploitability from a mass-opportunistic standpoint. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance.
Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments.
Out-of-bounds read in Siemens Parasolid V38.0 and V38.1 allows code execution when a user opens a specially crafted X_T geometry file. The flaw (CWE-125) resides in the X_T file parser and can result in arbitrary code executing within the context of the host process - typically a CAD or PLM application embedding the Parasolid kernel. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 7.3 reflects the local attack vector and passive user interaction requirement that constrain opportunistic exploitation.
Out-of-bounds read during BMP file parsing in Siemens Simcenter Femap (all versions prior to V2606.0001) enables code execution within the context of the running process. An attacker must deliver a specially crafted BMP file and induce a local user to open it with the application. No public exploit or active exploitation has been identified at time of analysis, but the high CIA impact scores in the CVSS 4.0 vector confirm that successful exploitation achieves full process compromise.
Out-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code execution in the context of the running process. The flaw is triggered when a user opens a specially crafted BMP file, making it a classic file-format attack against a CAE/FEA desktop application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality/integrity/availability impact and the availability of a vendor-confirmed patch make prompt upgrading advisable.
Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices.
LOGO! Soft Comfort, Siemens' programming environment for LOGO! small programmable logic controllers, stores project protection passwords as unsalted SHA-256 hashes, enabling efficient offline recovery attacks against anyone who obtains a project file. All versions prior to V9 are affected according to Siemens advisory SSA-751328. An attacker who acquires the project file - through file system access, network share exposure, backup theft, or insider access - can bypass password protection by cracking the hash offline without rate-limiting or account lockout constraints. No public exploit has been identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Hardcoded AES encryption in Siemens LOGO! Soft Comfort (all versions before V9) exposes every password-protected project file to decryption without knowledge of any user-defined password. A local attacker who can access the application installation - via shared workstation access, insider position, or post-compromise foothold - can extract the static master key from binaries or process memory and apply it universally to any project file ever encrypted by the affected software. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains.
Out-of-bounds read in Siemens Solid Edge's PAR file parser enables code execution within the running process when a victim opens a specially crafted part file. Both active product branches are affected: SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7. No public exploit code or CISA KEV listing exists at time of analysis, but the vendor-confirmed code-execution primitive elevates this beyond a typical information-disclosure finding tagged under CWE-125.
Use-after-free in Siemens Solid Edge SE2025 and SE2026 enables arbitrary code execution in the context of the current process when a user opens a specially crafted DFT file. Both affected annual release branches are vulnerable until patched - SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7 - as confirmed by Siemens Security Advisory SSA-621657. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 AC:H rating indicates non-trivial exploit development is required.
Use-after-free memory corruption in Siemens Solid Edge SE2025 and SE2026 allows code execution in the context of the current user process when a specially crafted DFT (draft) file is parsed. Affected are all SE2025 releases prior to V225.0 Update 15 and all SE2026 releases prior to V226.0 Update 7, as confirmed by Siemens advisory SSA-621657. No public exploit code or active exploitation has been identified at time of analysis, and the local attack vector combined with required user interaction meaningfully constrains real-world exposure.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657.
Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations.
Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV.
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Malicious firmware installation is possible on Siemens CPCI85 Central Processing/Communication firmware (versions before V26.20) and the SICORE Base System (before V26.20.0) because the firmware update mechanism fails to properly validate signatures. An attacker with high privileges and local access can push crafted, tampered firmware to achieve persistent code execution and full device compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial of service in Siemens CPCI85 Central Processing/Communication firmware and SICORE Base System (all versions before V26.20 / V26.20.0) allows an authenticated attacker to crash the device's web process via a leftover debugging interface exposed on HTTP endpoints. The flaw stems from active debug code shipped in production firmware and affects only availability, not data confidentiality or integrity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in Siemens SINEC INS (versions prior to V1.0 SP2 Update 6) stems from a binary shipped with the Linux cap_dac_override capability, which bypasses filesystem discretionary access control checks. An authenticated local attacker can leverage this overly broad capability to read or modify any file on the system, ultimately obtaining root. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated command injection in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 allows remote attackers to execute arbitrary OS commands as the sinecins service account by submitting crafted directory names to the /api/sftp/uploadFiles endpoint. The injected payloads are stored and triggered later when directory listings are retrieved, producing a stored/second-order command injection. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability of the underlying host.
Sensitive key material extraction is possible in Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to V21 Update 2) due to insufficient protection in the WinCC Certificate Manager component. A local attacker on an affected HMI/SCADA workstation could harvest cryptographic key material that protects operator certificates, potentially enabling impersonation or downstream attacks against industrial control networks. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in Siemens Solid Edge SE2026 allows arbitrary code execution when users open malicious PAR files. Attackers must deliver a weaponized PAR file and convince the user to open it, after which code executes with user's privileges. All versions prior to V226.0 Update 5 are vulnerable. No active exploitation confirmed (not in CISA KEV), but the attack relies on user interaction with a common CAD file format, making social engineering feasible in engineering/manufacturing environments.
Uninitialized pointer access in Siemens Solid Edge SE2026 enables arbitrary code execution when processing malicious PAR files. Attackers must deliver a crafted PAR file and convince users to open it (CVSS:4.0 AV:L/UI:P), achieving full compromise of the victim's workstation with high confidentiality, integrity, and availability impact. No active exploitation confirmed at time of analysis, though the local attack vector and user interaction requirement limit automated mass exploitation. EPSS data not available for risk calibration.
Remote path traversal in Siemens ROS# versions prior to V2.2.2 enables unauthenticated attackers to read arbitrary files from affected systems due to insufficient input sanitization. The vulnerability affects the ROS# library, a C# .NET implementation for Robot Operating System communication, with CVSS 9.3 critical severity. No active exploitation or public exploit code has been identified at time of analysis, though the network-accessible attack vector and lack of authentication requirements present significant risk for robotics systems using this library.
Hardcoded cryptographic keys in Siemens Teamcenter PLM software enable remote attackers to bypass authentication and gain unauthorized access to confidential product lifecycle management data. The vulnerability affects multiple Teamcenter versions (V2312, V2406, V2412, V2506, V2512) and is remotely exploitable without authentication (CVSS:4.0 AV:N/AC:L/PR:N). While no active exploitation or public POC has been identified at time of analysis, the straightforward nature of hardcoded credential extraction (AC:L) combined with the criticality of Teamcenter as an enterprise PLM platform housing intellectual property makes this a high-priority remediation target for manufacturing and engineering organizations.
Stored cross-site scripting (XSS) in Siemens Teamcenter allows authenticated attackers with low privileges to inject malicious JavaScript that executes in other users' browser sessions, enabling session hijacking, credential theft, or unauthorized actions within the product lifecycle management platform. Affects Teamcenter versions V2312 through V2512 with vendor patches released for all branches. CVSS v4.0 scores 8.5 (High) due to network attack vector with low complexity, though exploitation requires user interaction and authenticated access. No public exploit code or CISA KEV listing identified at time of analysis.
Local unauthenticated attackers can access the web browser on Siemens SIMATIC HMI Unified Comfort and Comfort Pro panels (all models <V21) via the Control Panel when security mechanisms are not configured. The CVSS v4.0 score of 7.0 reflects high integrity and availability impact (VI:H/VA:H) with local attack vector (AV:L), low complexity (AC:L), and no authentication required (PR:N). The vulnerability is classified as CWE-1188 (Initialization of a Resource with an Insecure Default) and tagged as Authentication Bypass. No public exploit or active exploitation confirmed at time of analysis, but the local access requirement and lack of default protections significantly lower the attack bar in environments where physical or local system access is feasible, such as industrial control settings.
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attackers with high privileges to inject malicious scripts via Technology Object (TO) names when downloading TIA Portal projects. The scripts execute when authorized users access the Motion Control Diagnostics web interface page, enabling session hijacking, credential theft, or privileged actions performed under the victim's context. This affects over 100 product variants across industrial automation controllers, software controllers, and open controllers. No active exploitation confirmed (not in CISA KEV). EPSS score not provided in dataset. CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability in both vulnerable and subsequent systems.
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access.
Siemens SIMATIC CN 4100 versions prior to V5.0 can be rendered unavailable through TCP SYN flood attacks, allowing remote unauthenticated attackers to exhaust system resources and cause complete service disruption. The CVSS 4.0 score of 8.7 reflects the high availability impact (VA:H) combined with network-accessible attack vector requiring no privileges or user interaction. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though SYN flood techniques are well-documented and trivial to execute.
Remote unauthenticated attackers can exhaust resources and bypass authentication controls in Siemens SIMATIC CN 4100 versions before V5.0, enabling denial of service conditions and unauthorized actions that compromise system availability and integrity. The vulnerability stems from improper connection validation (CWE-306), allowing network-based exploitation without any user interaction or privileges. Siemens has released V5.0 to address this flaw, documented in security advisory SSA-032379.
Privilege escalation in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions prior to V5.8 allows authenticated User Administrators to escalate their own privileges through improper group administration controls. Authenticated attackers with low-privilege User Administrator credentials can exploit flawed group membership logic to grant themselves unrestricted access to any device group at any access level, achieving full administrative control over critical industrial infrastructure. CVSS 8.8 (High) reflects network-accessible attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis, though the attack path is straightforward for authenticated insiders.
SINEC NMS versions prior to V4.0 SP3 allow authenticated remote attackers to reset any user account password due to improper authorization validation (CWE-639). An attacker with low-privilege credentials can escalate to administrative access by resetting privileged user passwords, enabling complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit code identified at time of analysis, though the network attack vector (AV:N) and low complexity (AC:L) increase exploitation feasibility for authenticated attackers.
Out-of-bounds write vulnerabilities in Siemens CPCI85 Central Processing/Communication and SICORE Base system (versions below V26.10) allow unauthenticated remote attackers to crash critical industrial control system services through maliciously crafted XML requests, resulting in denial-of-service conditions. CISA's SSVC framework marks this as automatable with partial technical impact, though no public exploit has been identified at time of analysis. The CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network accessibility requiring no authentication (PR:N).
Remote denial-of-service in Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base (versions below V26.10) allows adjacent network attackers to exhaust system resources via high-volume requests, forcing device reset or reboot to restore parameterization functionality. No public exploit identified at time of analysis. CVSS 7.1 (High) with adjacent network access vector and no privileges required indicates moderate real-world risk for industrial environments where these RTU and control processing devices operate.
Command injection in SICAM SIAPP SDK versions prior to 2.1.7 allows unauthenticated local attackers to manipulate shell command construction and achieve arbitrary code execution with full system privileges. The vulnerability stems from insufficient input validation when building and executing system commands with user-supplied data. No patch is currently available, leaving all affected versions vulnerable to complete system compromise.
Insufficient input validation in SICAM SIAPP SDK versions prior to V2.1.7 enables stack overflow attacks, permitting local attackers to execute arbitrary code or trigger denial of service. The vulnerability affects all versions below the patched release, with no currently available remediation for deployed systems. Attackers with local access can leverage malformed input to corrupt the stack and gain code execution privileges.
Out-of-bounds write vulnerability in SICAM SIAPP SDK versions prior to V2.1.7 allows local attackers to corrupt memory and achieve arbitrary code execution or denial of service. The vulnerability requires local access and specific conditions to trigger, but no patch is currently available. Affected organizations using vulnerable SDK versions should immediately implement compensating controls or upgrade to V2.1.7 or later.
Arbitrary code execution with SYSTEM privileges in SINEC NMS User Management Component (all versions prior to V2.15.2.1) stems from improper access controls allowing low-privileged users to modify configuration files and load malicious DLLs. An authenticated attacker can exploit this to achieve complete system compromise. No patch is currently available.
Arbitrary code execution in Siemens SINEC NMS versions prior to V4.0 SP2 can be achieved when a low-privileged user modifies configuration files to load malicious DLLs, resulting in administrative privilege execution. This local vulnerability affects all current deployments and currently has no available patch. An authenticated attacker with local access can exploit this to gain full system compromise.
Code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds read flaw triggered when parsing malicious NDB files. A local attacker with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.
Heap-based buffer overflow in Simcenter Femap and Nastran versions prior to V2512 allows local attackers to achieve arbitrary code execution by crafting malicious NDB files. The vulnerability requires user interaction to trigger and affects all current versions of both products. No patch is currently available, leaving affected systems at risk of privilege escalation and system compromise.
Out-of-bounds read in Simcenter Femap and Nastran versions prior to V2512 during NDB file parsing enables local code execution under the current process context. An attacker can exploit this vulnerability through specially crafted NDB files to achieve arbitrary code execution. No patch is currently available for this high-severity vulnerability affecting both products.
Simcenter Femap and Nastran versions prior to 2512 are vulnerable to out-of-bounds memory reads when processing maliciously crafted XDB files, enabling arbitrary code execution with the privileges of the affected application. Local attackers can exploit this vulnerability through specially designed files to achieve full system compromise. No patch is currently available for this high-severity flaw.
Arbitrary code execution in Simcenter Femap and Nastran versions prior to 2512 results from an out-of-bounds read when processing malicious XDB files, enabling local attackers to achieve process-level code execution. An attacker with local access can craft a specially designed XDB file to trigger the memory vulnerability and execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.
Arbitrary code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds write flaw triggered by parsing malicious XDB files. Local attackers with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this high-severity vulnerability.
Nx versions prior to V2512 contain an insufficient input validation flaw in the PDF export functionality that permits local attackers to corrupt internal data structures and achieve arbitrary code execution. An attacker with local file system access can exploit this vulnerability to manipulate the export process and gain code execution privileges. No patch is currently available for this vulnerability.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote code execution through crafted log messages, affecting virtually every Java application on Earth and triggering the largest vulnerability remediation effort in history.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.48 and earlier. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Microsoft SMBv1 allows authenticated network attackers to execute arbitrary code on Windows systems via crafted packets. This vulnerability (part of the MS17-010 bulletin and known as 'EternalBlue') is confirmed actively exploited (CISA KEV) with EPSS score of 94.32%, indicating near-certain exploitation probability. Widely weaponized in 2017 WannaCry and NotPetya ransomware campaigns. Affects Windows Vista through Windows 10 1607 and Windows Server 2008-2016, plus Siemens medical imaging systems running vulnerable Windows embedded OS. Multiple public exploits available including DOUBLEPULSAR payload delivery framework.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.6%.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Windows Shell across XP through Windows 7 via malicious .LNK or .PIF shortcut files automatically processed when displayed in Windows Explorer. Confirmed actively exploited (CISA KEV) in 2010 Stuxnet campaign targeting Siemens WinCC SCADA systems, with 92.13% EPSS score reflecting historical widespread exploitation. Public exploits available. Originally weaponized as zero-day before Microsoft MS10-046 patch release.
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose internal function names, type definitions, and structure layouts to any party who downloads the publicly available firmware update packages. This does not directly compromise deployed devices but substantially reduces the skill and effort required for an attacker to identify exploitable weaknesses through static firmware analysis. No public exploit or active exploitation has been identified; Siemens has released firmware V2.70 as the fix per advisory SSA-142885.
SSH host key verification is persistently disabled in Siemens kas versions prior to 5.4 when the tool's internal SSH key setup path is triggered via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and the invoking user has no pre-existing ~/.ssh/config. The tool writes a global Host * rule with StrictHostKeyChecking no to ~/.ssh/config and does not remove it upon exit, leaving all subsequent SSH sessions of that local user silently accepting unverified host keys. No public exploit code exists and this vulnerability is not listed in CISA KEV; the low CVSS score of 3.3 correctly reflects a constrained local, multi-condition attack path, though the persistence of the misconfiguration indefinitely extends the exposure window beyond any single kas invocation.
Denial-of-service in Siemens Desigo building automation controllers (DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, PXC7) allows an unauthenticated adjacent-network attacker to permanently halt BACnet communication on the device by sending a single malformed BACnet packet. The device stops responding to all BACnet queries and requires a manual reset or reboot to recover, making this operationally disruptive in building management environments where HVAC, access control, or other OT functions may depend on continuous BACnet availability. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial of service in Siemens SIMATIC S7-PLCSIM Advanced (all versions) allows an unauthenticated attacker on the same local network segment to exhaust the application's memory by flooding it with high-volume multicast traffic, rendering the PLC simulation instance inaccessible until manually restarted. Exploitation is limited to instances running a specific active project configuration, and no project data is lost. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in Siemens' IAM Client SDK, a shared authentication component bundled across a wide range of Siemens engineering and PLM products (Solid Edge, Teamcenter Visualization, Simcenter, Tecnomatix, COMOS, Designcenter NX), allows an authenticated local user to load attacker-controlled code through an untrusted search path (CWE-426) and gain elevated privileges. The flaw carries a CVSS 4.0 base score of 8.5 and requires only low local privileges with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure default OPC UA configuration in Siemens CPCI85 Central Processing/Communication and SICORE Base System exposes industrial control system functions to unauthenticated network attackers. Both products ship with all OPC UA security mechanisms disabled, meaning any attacker who can reach the OPC UA endpoint over the network can interact with the system without authentication or encryption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the affected products operate in OT/ICS environments where unauthorized control access carries disproportionate operational and safety risk relative to the moderate CVSS score.
Code injection via malicious project files in Mendix Studio Pro 10.11 through 11.11 allows arbitrary code execution on a developer's workstation when a victim opens and runs a specially crafted project through the build pipeline. Siemens' own ProductCERT (SSA-779310) reported this flaw, classifying it under CWE-94, with patches available only for the 10.24 and 11.6 long-term support lines. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the breadth of affected versions - spanning the entire 10.x and 11.x release trees - means most active Mendix developer environments are exposed.
Weak password hashing in Siemens SINEC INS (all versions prior to V1.0 SP2 Update 6) exposes stored credentials to efficient offline recovery due to a static, hardcoded salt shared universally across all users and installations, combined with an insufficient iteration count. An attacker who has obtained high-privileged local access and can extract the password store can leverage the known static salt to construct targeted rainbow tables or run accelerated brute-force attacks, potentially recovering plaintext passwords and achieving unauthorized access to the application and downstream industrial network infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the cryptographic weakness is deterministic - once hashes are obtained, the static salt eliminates per-user uniqueness and dramatically reduces attack cost.
Path traversal in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 exposes arbitrary file system locations via the SFTP directory listing endpoint. An authenticated low-privileged network attacker can send a crafted path to GET /api/sftp/uploadFiles to read files outside the intended directory scope, resulting in unauthorized disclosure of file system contents. No active exploitation or public proof-of-concept has been identified at time of analysis; the impact is limited to confidentiality with no integrity or availability consequence.
Unrestricted file upload via the DIGSI 5 engineering protocol in Siemens SIPROTEC 5 protective relays enables authenticated, high-privileged users on an adjacent network to upload malicious configuration files, causing denial of service or potentially achieving code execution on the affected device. All hardware variants (CP050/CP100/CP150/CP200/CP300) across more than 60 distinct SIPROTEC 5 model lines are affected, with no patched firmware version available. No public exploit identified at time of analysis, but the presence of RCE and DoS tags alongside a confirmed CWE-434 root cause makes this a meaningful operational technology (OT) risk in poorly segmented substation environments.
Late signature validation in Siemens kas (pip/kas >= 4.8, < 5.3) allows an attacker who has already compromised a referenced upstream repository to substitute the cryptographic key used to validate that repository's tag signatures, effectively bypassing integrity checks entirely. Because kas processes and applies configuration includes from external repositories before verifying their signatures, a malicious repository can redirect the signature-validation key to one under attacker control. No public exploit code has been identified at time of analysis, and exploitation requires a highly specific multi-condition scenario including prior supply-chain access to a referenced upstream repo. Vendor-released patch version 5.3 resolves all related attack vectors.
Integrity bypass in Siemens kas (pip/kas < 5.3) allows an attacker who controls a referenced external git repository to substitute arbitrary commit content by creating a branch whose name matches the commit SHA recorded in a kas configuration file. Because kas passed the raw SHA string to `git checkout` without forcing disambiguation to a commit object, git resolves a branch of that name instead of the pinned commit, defeating the integrity guarantee users rely on. The primary impact falls on SHA-256 commit IDs; SHA-1 commits face a related but distinct risk through hash-collision substitution. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
linux-entra-sso, Siemens' Chrome browser extension for Microsoft Entra ID SSO on Linux, leaks the Entra ID Primary Refresh Token (PRT) cookie to attacker-controlled hosts due to missing URL origin validation in its Chrome adapter. Versions prior to 1.8.1 are affected; the Chrome adapter's declarativeNetRequest rule uses an unanchored urlFilter that performs substring matching, causing the PRT injection to fire on any request URL containing 'https://login.microsoftonline.com/' anywhere in the path - not just requests actually destined for Microsoft's login endpoint. A proof-of-concept exists per SSVC data, though exploitation is not confirmed in CISA KEV and EPSS is very low (0.03%), reflecting the niche product footprint and required user interaction.
Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments.
Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate practical risk for any internet- or OT-network-exposed deployment.
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact.
Reflected XSS in Siemens Teamcenter's authentication redirect endpoint (/auth/) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an already-authenticated user by delivering a crafted URL. Four active Teamcenter release trains are affected across versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. Successful exploitation enables the attacker to act within the victim's live Teamcenter PLM session - accessing engineering data, modifying records, or pivoting laterally - with no public exploit identified at time of analysis.
Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis.
Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis.
SAML response signature validation is absent or insufficient in the Mendix SAML module across all Mendix 9.24, 10, and 11 compatible releases prior to their respective patches, enabling unauthenticated remote attackers to forge SAML assertions and hijack arbitrary user sessions under specific SSO configurations. The flaw (CWE-347) is conditional on deployment configuration and requires passive user participation in an active SSO flow, moderating its exploitability from a mass-opportunistic standpoint. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance.
Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments.
Out-of-bounds read in Siemens Parasolid V38.0 and V38.1 allows code execution when a user opens a specially crafted X_T geometry file. The flaw (CWE-125) resides in the X_T file parser and can result in arbitrary code executing within the context of the host process - typically a CAD or PLM application embedding the Parasolid kernel. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 7.3 reflects the local attack vector and passive user interaction requirement that constrain opportunistic exploitation.
Out-of-bounds read during BMP file parsing in Siemens Simcenter Femap (all versions prior to V2606.0001) enables code execution within the context of the running process. An attacker must deliver a specially crafted BMP file and induce a local user to open it with the application. No public exploit or active exploitation has been identified at time of analysis, but the high CIA impact scores in the CVSS 4.0 vector confirm that successful exploitation achieves full process compromise.
Out-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code execution in the context of the running process. The flaw is triggered when a user opens a specially crafted BMP file, making it a classic file-format attack against a CAE/FEA desktop application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality/integrity/availability impact and the availability of a vendor-confirmed patch make prompt upgrading advisable.
Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices.
LOGO! Soft Comfort, Siemens' programming environment for LOGO! small programmable logic controllers, stores project protection passwords as unsalted SHA-256 hashes, enabling efficient offline recovery attacks against anyone who obtains a project file. All versions prior to V9 are affected according to Siemens advisory SSA-751328. An attacker who acquires the project file - through file system access, network share exposure, backup theft, or insider access - can bypass password protection by cracking the hash offline without rate-limiting or account lockout constraints. No public exploit has been identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Hardcoded AES encryption in Siemens LOGO! Soft Comfort (all versions before V9) exposes every password-protected project file to decryption without knowledge of any user-defined password. A local attacker who can access the application installation - via shared workstation access, insider position, or post-compromise foothold - can extract the static master key from binaries or process memory and apply it universally to any project file ever encrypted by the affected software. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains.
Out-of-bounds read in Siemens Solid Edge's PAR file parser enables code execution within the running process when a victim opens a specially crafted part file. Both active product branches are affected: SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7. No public exploit code or CISA KEV listing exists at time of analysis, but the vendor-confirmed code-execution primitive elevates this beyond a typical information-disclosure finding tagged under CWE-125.
Use-after-free in Siemens Solid Edge SE2025 and SE2026 enables arbitrary code execution in the context of the current process when a user opens a specially crafted DFT file. Both affected annual release branches are vulnerable until patched - SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7 - as confirmed by Siemens Security Advisory SSA-621657. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 AC:H rating indicates non-trivial exploit development is required.
Use-after-free memory corruption in Siemens Solid Edge SE2025 and SE2026 allows code execution in the context of the current user process when a specially crafted DFT (draft) file is parsed. Affected are all SE2025 releases prior to V225.0 Update 15 and all SE2026 releases prior to V226.0 Update 7, as confirmed by Siemens advisory SSA-621657. No public exploit code or active exploitation has been identified at time of analysis, and the local attack vector combined with required user interaction meaningfully constrains real-world exposure.
Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657.
Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations.
Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV.
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Malicious firmware installation is possible on Siemens CPCI85 Central Processing/Communication firmware (versions before V26.20) and the SICORE Base System (before V26.20.0) because the firmware update mechanism fails to properly validate signatures. An attacker with high privileges and local access can push crafted, tampered firmware to achieve persistent code execution and full device compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial of service in Siemens CPCI85 Central Processing/Communication firmware and SICORE Base System (all versions before V26.20 / V26.20.0) allows an authenticated attacker to crash the device's web process via a leftover debugging interface exposed on HTTP endpoints. The flaw stems from active debug code shipped in production firmware and affects only availability, not data confidentiality or integrity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in Siemens SINEC INS (versions prior to V1.0 SP2 Update 6) stems from a binary shipped with the Linux cap_dac_override capability, which bypasses filesystem discretionary access control checks. An authenticated local attacker can leverage this overly broad capability to read or modify any file on the system, ultimately obtaining root. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated command injection in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 allows remote attackers to execute arbitrary OS commands as the sinecins service account by submitting crafted directory names to the /api/sftp/uploadFiles endpoint. The injected payloads are stored and triggered later when directory listings are retrieved, producing a stored/second-order command injection. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability of the underlying host.
Sensitive key material extraction is possible in Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to V21 Update 2) due to insufficient protection in the WinCC Certificate Manager component. A local attacker on an affected HMI/SCADA workstation could harvest cryptographic key material that protects operator certificates, potentially enabling impersonation or downstream attacks against industrial control networks. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in Siemens Solid Edge SE2026 allows arbitrary code execution when users open malicious PAR files. Attackers must deliver a weaponized PAR file and convince the user to open it, after which code executes with user's privileges. All versions prior to V226.0 Update 5 are vulnerable. No active exploitation confirmed (not in CISA KEV), but the attack relies on user interaction with a common CAD file format, making social engineering feasible in engineering/manufacturing environments.
Uninitialized pointer access in Siemens Solid Edge SE2026 enables arbitrary code execution when processing malicious PAR files. Attackers must deliver a crafted PAR file and convince users to open it (CVSS:4.0 AV:L/UI:P), achieving full compromise of the victim's workstation with high confidentiality, integrity, and availability impact. No active exploitation confirmed at time of analysis, though the local attack vector and user interaction requirement limit automated mass exploitation. EPSS data not available for risk calibration.
Remote path traversal in Siemens ROS# versions prior to V2.2.2 enables unauthenticated attackers to read arbitrary files from affected systems due to insufficient input sanitization. The vulnerability affects the ROS# library, a C# .NET implementation for Robot Operating System communication, with CVSS 9.3 critical severity. No active exploitation or public exploit code has been identified at time of analysis, though the network-accessible attack vector and lack of authentication requirements present significant risk for robotics systems using this library.
Hardcoded cryptographic keys in Siemens Teamcenter PLM software enable remote attackers to bypass authentication and gain unauthorized access to confidential product lifecycle management data. The vulnerability affects multiple Teamcenter versions (V2312, V2406, V2412, V2506, V2512) and is remotely exploitable without authentication (CVSS:4.0 AV:N/AC:L/PR:N). While no active exploitation or public POC has been identified at time of analysis, the straightforward nature of hardcoded credential extraction (AC:L) combined with the criticality of Teamcenter as an enterprise PLM platform housing intellectual property makes this a high-priority remediation target for manufacturing and engineering organizations.
Stored cross-site scripting (XSS) in Siemens Teamcenter allows authenticated attackers with low privileges to inject malicious JavaScript that executes in other users' browser sessions, enabling session hijacking, credential theft, or unauthorized actions within the product lifecycle management platform. Affects Teamcenter versions V2312 through V2512 with vendor patches released for all branches. CVSS v4.0 scores 8.5 (High) due to network attack vector with low complexity, though exploitation requires user interaction and authenticated access. No public exploit code or CISA KEV listing identified at time of analysis.
Local unauthenticated attackers can access the web browser on Siemens SIMATIC HMI Unified Comfort and Comfort Pro panels (all models <V21) via the Control Panel when security mechanisms are not configured. The CVSS v4.0 score of 7.0 reflects high integrity and availability impact (VI:H/VA:H) with local attack vector (AV:L), low complexity (AC:L), and no authentication required (PR:N). The vulnerability is classified as CWE-1188 (Initialization of a Resource with an Insecure Default) and tagged as Authentication Bypass. No public exploit or active exploitation confirmed at time of analysis, but the local access requirement and lack of default protections significantly lower the attack bar in environments where physical or local system access is feasible, such as industrial control settings.
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attackers with high privileges to inject malicious scripts via Technology Object (TO) names when downloading TIA Portal projects. The scripts execute when authorized users access the Motion Control Diagnostics web interface page, enabling session hijacking, credential theft, or privileged actions performed under the victim's context. This affects over 100 product variants across industrial automation controllers, software controllers, and open controllers. No active exploitation confirmed (not in CISA KEV). EPSS score not provided in dataset. CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability in both vulnerable and subsequent systems.
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access.
Siemens SIMATIC CN 4100 versions prior to V5.0 can be rendered unavailable through TCP SYN flood attacks, allowing remote unauthenticated attackers to exhaust system resources and cause complete service disruption. The CVSS 4.0 score of 8.7 reflects the high availability impact (VA:H) combined with network-accessible attack vector requiring no privileges or user interaction. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though SYN flood techniques are well-documented and trivial to execute.
Remote unauthenticated attackers can exhaust resources and bypass authentication controls in Siemens SIMATIC CN 4100 versions before V5.0, enabling denial of service conditions and unauthorized actions that compromise system availability and integrity. The vulnerability stems from improper connection validation (CWE-306), allowing network-based exploitation without any user interaction or privileges. Siemens has released V5.0 to address this flaw, documented in security advisory SSA-032379.
Privilege escalation in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions prior to V5.8 allows authenticated User Administrators to escalate their own privileges through improper group administration controls. Authenticated attackers with low-privilege User Administrator credentials can exploit flawed group membership logic to grant themselves unrestricted access to any device group at any access level, achieving full administrative control over critical industrial infrastructure. CVSS 8.8 (High) reflects network-accessible attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis, though the attack path is straightforward for authenticated insiders.
SINEC NMS versions prior to V4.0 SP3 allow authenticated remote attackers to reset any user account password due to improper authorization validation (CWE-639). An attacker with low-privilege credentials can escalate to administrative access by resetting privileged user passwords, enabling complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit code identified at time of analysis, though the network attack vector (AV:N) and low complexity (AC:L) increase exploitation feasibility for authenticated attackers.
Out-of-bounds write vulnerabilities in Siemens CPCI85 Central Processing/Communication and SICORE Base system (versions below V26.10) allow unauthenticated remote attackers to crash critical industrial control system services through maliciously crafted XML requests, resulting in denial-of-service conditions. CISA's SSVC framework marks this as automatable with partial technical impact, though no public exploit has been identified at time of analysis. The CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network accessibility requiring no authentication (PR:N).
Remote denial-of-service in Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base (versions below V26.10) allows adjacent network attackers to exhaust system resources via high-volume requests, forcing device reset or reboot to restore parameterization functionality. No public exploit identified at time of analysis. CVSS 7.1 (High) with adjacent network access vector and no privileges required indicates moderate real-world risk for industrial environments where these RTU and control processing devices operate.
Command injection in SICAM SIAPP SDK versions prior to 2.1.7 allows unauthenticated local attackers to manipulate shell command construction and achieve arbitrary code execution with full system privileges. The vulnerability stems from insufficient input validation when building and executing system commands with user-supplied data. No patch is currently available, leaving all affected versions vulnerable to complete system compromise.
Insufficient input validation in SICAM SIAPP SDK versions prior to V2.1.7 enables stack overflow attacks, permitting local attackers to execute arbitrary code or trigger denial of service. The vulnerability affects all versions below the patched release, with no currently available remediation for deployed systems. Attackers with local access can leverage malformed input to corrupt the stack and gain code execution privileges.
Out-of-bounds write vulnerability in SICAM SIAPP SDK versions prior to V2.1.7 allows local attackers to corrupt memory and achieve arbitrary code execution or denial of service. The vulnerability requires local access and specific conditions to trigger, but no patch is currently available. Affected organizations using vulnerable SDK versions should immediately implement compensating controls or upgrade to V2.1.7 or later.
Arbitrary code execution with SYSTEM privileges in SINEC NMS User Management Component (all versions prior to V2.15.2.1) stems from improper access controls allowing low-privileged users to modify configuration files and load malicious DLLs. An authenticated attacker can exploit this to achieve complete system compromise. No patch is currently available.
Arbitrary code execution in Siemens SINEC NMS versions prior to V4.0 SP2 can be achieved when a low-privileged user modifies configuration files to load malicious DLLs, resulting in administrative privilege execution. This local vulnerability affects all current deployments and currently has no available patch. An authenticated attacker with local access can exploit this to gain full system compromise.
Code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds read flaw triggered when parsing malicious NDB files. A local attacker with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.
Heap-based buffer overflow in Simcenter Femap and Nastran versions prior to V2512 allows local attackers to achieve arbitrary code execution by crafting malicious NDB files. The vulnerability requires user interaction to trigger and affects all current versions of both products. No patch is currently available, leaving affected systems at risk of privilege escalation and system compromise.
Out-of-bounds read in Simcenter Femap and Nastran versions prior to V2512 during NDB file parsing enables local code execution under the current process context. An attacker can exploit this vulnerability through specially crafted NDB files to achieve arbitrary code execution. No patch is currently available for this high-severity vulnerability affecting both products.
Simcenter Femap and Nastran versions prior to 2512 are vulnerable to out-of-bounds memory reads when processing maliciously crafted XDB files, enabling arbitrary code execution with the privileges of the affected application. Local attackers can exploit this vulnerability through specially designed files to achieve full system compromise. No patch is currently available for this high-severity flaw.
Arbitrary code execution in Simcenter Femap and Nastran versions prior to 2512 results from an out-of-bounds read when processing malicious XDB files, enabling local attackers to achieve process-level code execution. An attacker with local access can craft a specially designed XDB file to trigger the memory vulnerability and execute arbitrary code with the privileges of the affected application. No patch is currently available for this vulnerability.
Arbitrary code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds write flaw triggered by parsing malicious XDB files. Local attackers with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. No patch is currently available for this high-severity vulnerability.
Nx versions prior to V2512 contain an insufficient input validation flaw in the PDF export functionality that permits local attackers to corrupt internal data structures and achieve arbitrary code execution. An attacker with local file system access can exploit this vulnerability to manipulate the export process and gain code execution privileges. No patch is currently available for this vulnerability.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote code execution through crafted log messages, affecting virtually every Java application on Earth and triggering the largest vulnerability remediation effort in history.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.48 and earlier. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Microsoft SMBv1 allows authenticated network attackers to execute arbitrary code on Windows systems via crafted packets. This vulnerability (part of the MS17-010 bulletin and known as 'EternalBlue') is confirmed actively exploited (CISA KEV) with EPSS score of 94.32%, indicating near-certain exploitation probability. Widely weaponized in 2017 WannaCry and NotPetya ransomware campaigns. Affects Windows Vista through Windows 10 1607 and Windows Server 2008-2016, plus Siemens medical imaging systems running vulnerable Windows embedded OS. Multiple public exploits available including DOUBLEPULSAR payload delivery framework.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.6%.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in Windows Shell across XP through Windows 7 via malicious .LNK or .PIF shortcut files automatically processed when displayed in Windows Explorer. Confirmed actively exploited (CISA KEV) in 2010 Stuxnet campaign targeting Siemens WinCC SCADA systems, with 92.13% EPSS score reflecting historical widespread exploitation. Public exploits available. Originally weaponized as zero-day before Microsoft MS10-046 patch release.
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose internal function names, type definitions, and structure layouts to any party who downloads the publicly available firmware update packages. This does not directly compromise deployed devices but substantially reduces the skill and effort required for an attacker to identify exploitable weaknesses through static firmware analysis. No public exploit or active exploitation has been identified; Siemens has released firmware V2.70 as the fix per advisory SSA-142885.
SSH host key verification is persistently disabled in Siemens kas versions prior to 5.4 when the tool's internal SSH key setup path is triggered via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and the invoking user has no pre-existing ~/.ssh/config. The tool writes a global Host * rule with StrictHostKeyChecking no to ~/.ssh/config and does not remove it upon exit, leaving all subsequent SSH sessions of that local user silently accepting unverified host keys. No public exploit code exists and this vulnerability is not listed in CISA KEV; the low CVSS score of 3.3 correctly reflects a constrained local, multi-condition attack path, though the persistence of the misconfiguration indefinitely extends the exposure window beyond any single kas invocation.
Denial-of-service in Siemens Desigo building automation controllers (DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, PXC7) allows an unauthenticated adjacent-network attacker to permanently halt BACnet communication on the device by sending a single malformed BACnet packet. The device stops responding to all BACnet queries and requires a manual reset or reboot to recover, making this operationally disruptive in building management environments where HVAC, access control, or other OT functions may depend on continuous BACnet availability. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial of service in Siemens SIMATIC S7-PLCSIM Advanced (all versions) allows an unauthenticated attacker on the same local network segment to exhaust the application's memory by flooding it with high-volume multicast traffic, rendering the PLC simulation instance inaccessible until manually restarted. Exploitation is limited to instances running a specific active project configuration, and no project data is lost. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in Siemens' IAM Client SDK, a shared authentication component bundled across a wide range of Siemens engineering and PLM products (Solid Edge, Teamcenter Visualization, Simcenter, Tecnomatix, COMOS, Designcenter NX), allows an authenticated local user to load attacker-controlled code through an untrusted search path (CWE-426) and gain elevated privileges. The flaw carries a CVSS 4.0 base score of 8.5 and requires only low local privileges with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure default OPC UA configuration in Siemens CPCI85 Central Processing/Communication and SICORE Base System exposes industrial control system functions to unauthenticated network attackers. Both products ship with all OPC UA security mechanisms disabled, meaning any attacker who can reach the OPC UA endpoint over the network can interact with the system without authentication or encryption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the affected products operate in OT/ICS environments where unauthorized control access carries disproportionate operational and safety risk relative to the moderate CVSS score.
Code injection via malicious project files in Mendix Studio Pro 10.11 through 11.11 allows arbitrary code execution on a developer's workstation when a victim opens and runs a specially crafted project through the build pipeline. Siemens' own ProductCERT (SSA-779310) reported this flaw, classifying it under CWE-94, with patches available only for the 10.24 and 11.6 long-term support lines. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the breadth of affected versions - spanning the entire 10.x and 11.x release trees - means most active Mendix developer environments are exposed.
Weak password hashing in Siemens SINEC INS (all versions prior to V1.0 SP2 Update 6) exposes stored credentials to efficient offline recovery due to a static, hardcoded salt shared universally across all users and installations, combined with an insufficient iteration count. An attacker who has obtained high-privileged local access and can extract the password store can leverage the known static salt to construct targeted rainbow tables or run accelerated brute-force attacks, potentially recovering plaintext passwords and achieving unauthorized access to the application and downstream industrial network infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the cryptographic weakness is deterministic - once hashes are obtained, the static salt eliminates per-user uniqueness and dramatically reduces attack cost.
Path traversal in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 exposes arbitrary file system locations via the SFTP directory listing endpoint. An authenticated low-privileged network attacker can send a crafted path to GET /api/sftp/uploadFiles to read files outside the intended directory scope, resulting in unauthorized disclosure of file system contents. No active exploitation or public proof-of-concept has been identified at time of analysis; the impact is limited to confidentiality with no integrity or availability consequence.
Unrestricted file upload via the DIGSI 5 engineering protocol in Siemens SIPROTEC 5 protective relays enables authenticated, high-privileged users on an adjacent network to upload malicious configuration files, causing denial of service or potentially achieving code execution on the affected device. All hardware variants (CP050/CP100/CP150/CP200/CP300) across more than 60 distinct SIPROTEC 5 model lines are affected, with no patched firmware version available. No public exploit identified at time of analysis, but the presence of RCE and DoS tags alongside a confirmed CWE-434 root cause makes this a meaningful operational technology (OT) risk in poorly segmented substation environments.
Late signature validation in Siemens kas (pip/kas >= 4.8, < 5.3) allows an attacker who has already compromised a referenced upstream repository to substitute the cryptographic key used to validate that repository's tag signatures, effectively bypassing integrity checks entirely. Because kas processes and applies configuration includes from external repositories before verifying their signatures, a malicious repository can redirect the signature-validation key to one under attacker control. No public exploit code has been identified at time of analysis, and exploitation requires a highly specific multi-condition scenario including prior supply-chain access to a referenced upstream repo. Vendor-released patch version 5.3 resolves all related attack vectors.
Integrity bypass in Siemens kas (pip/kas < 5.3) allows an attacker who controls a referenced external git repository to substitute arbitrary commit content by creating a branch whose name matches the commit SHA recorded in a kas configuration file. Because kas passed the raw SHA string to `git checkout` without forcing disambiguation to a commit object, git resolves a branch of that name instead of the pinned commit, defeating the integrity guarantee users rely on. The primary impact falls on SHA-256 commit IDs; SHA-1 commits face a related but distinct risk through hash-collision substitution. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
linux-entra-sso, Siemens' Chrome browser extension for Microsoft Entra ID SSO on Linux, leaks the Entra ID Primary Refresh Token (PRT) cookie to attacker-controlled hosts due to missing URL origin validation in its Chrome adapter. Versions prior to 1.8.1 are affected; the Chrome adapter's declarativeNetRequest rule uses an unanchored urlFilter that performs substring matching, causing the PRT injection to fire on any request URL containing 'https://login.microsoftonline.com/' anywhere in the path - not just requests actually destined for Microsoft's login endpoint. A proof-of-concept exists per SSVC data, though exploitation is not confirmed in CISA KEV and EPSS is very low (0.03%), reflecting the niche product footprint and required user interaction.