siemens

Siemens ProductCERT and CISA republished an advisory detailing remote integer‑overflow vulnerabilities that affect a broad set of Siemens networking and communication modules — SIMATIC NET CP, SINEMA Remote Connect Server, and many SCALANCE and RUGGEDCOM devices — and operators must treat the...

Siemens has republished a critical advisory that pulls a spotlight back onto a cluster of high-severity Apache HTTP Server vulnerabilities found embedded inside several Siemens industrial networking products — most notably RUGGEDCOM NMS, SINEC NMS, and SINEMA family components — and is urging...

Siemens’ sprawling product portfolio remains at the center of a major, ongoing industrial‑security effort after a broad advisory—originally published by Siemens ProductCERT and republished by U.S. cyber authorities—relisted scores of SCALANCE, RUGGEDCOM, SIMATIC, SIMOTION, SIPLUS and related...

Siemens and upstream OpenSSL vulnerabilities that allow out-of-bounds reads — tracked under CVE-2021-3712 — remain a live operational risk across dozens of Siemens industrial networking, communications, and automation products; Siemens has published ProductCERT guidance and fixes for many...

CISA’s September 16, 2025 bulletin consolidates another urgent wave of Industrial Control Systems (ICS) security notices: eight advisories covering Schneider Electric, Hitachi Energy, Siemens, Delta Electronics and multiple Siemens product families, plus an update to a prior Schneider Galaxy...

CISA’s latest bulletin — a compact but consequential package released on September 11, 2025 — flags eleven Industrial Control Systems (ICS) advisories affecting major automation vendors and field devices, including multiple Siemens engineering and network products, several Schneider Electric...

Siemens has published a high‑severity ProductCERT advisory (SSA‑722410) describing multiple remotely exploitable vulnerabilities in its User Management Component (UMC), including a stack‑based buffer overflow that Siemens scores as critical and three separate out‑of‑bounds read issues that can...

Siemens has confirmed a vulnerability in its APOGEE PXC and TALON TC building automation devices that allows an unauthenticated remote actor to retrieve sensitive files — including the device’s encrypted database — over BACnet, a widely used building automation protocol, a weakness now tracked...

Nullsoft Scriptable Install System (NSIS) code used inside several SIMOTION setup components contains a local privilege‑escalation flaw that Siemens and U.S. cyber authorities have republished as a coordinated advisory, warning that installing affected SIMOTION Tools on Windows can allow an...

Siemens’ Industrial Edge Management OS (IEM‑OS) is exposed to a remotely exploitable denial‑of‑service condition tied to the Apache Commons FileUpload library (tracked as CVE‑2025‑48976), and the vendor’s published guidance makes clear that affected IEM‑OS installs — all reported versions — have...

Siemens’ cloud-hosted SIMATIC Virtualization as a Service (SIVaaS) has been found to expose a network share without authentication — a configuration defect that Siemens has cataloged as CVE-2025-40804 and scored as critical (CVSS v3.1 = 9.1; CVSS v4 = 9.3). This flaw allows unauthenticated...

Siemens has published a security advisory (SSA-027652) describing a privilege‑escalation vulnerability in its SINAMICS drive family that allows a factory reset and configuration manipulation without the required privileges, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA)...

Siemens’ Mendix SAML module contains a high‑severity flaw that, under certain single sign‑on (SSO) configurations, can allow unauthenticated remote attackers to bypass SAML signature verification and hijack user accounts — a vulnerability tracked as CVE‑2025‑40758 with a CVSS v3.1 base score of...

Siemens has published a security advisory for Opcenter Quality that maps seven distinct CVEs affecting SmartClient modules (Opcenter QL Home), SOA Audit and SOA Cockpit — the vulnerabilities range from incorrect authorization and insufficient session expiration to support for legacy TLS...

Siemens’ RUGGEDCOM APE1808 appliances carry high‑risk management‑plane vulnerabilities that can let an authenticated administrator—or an attacker who gains elevated credentials—execute arbitrary operating‑system commands and escalate local service privileges, creating a significant threat to...

Siemens ProductCERT has published SSA‑493396 — a deserialization vulnerability (CVE‑2025‑40759) that affects a broad swath of TIA‑Portal engineering components, including SIMATIC S7‑PLCSIM V17, STEP 7, and WinCC variants; Siemens assigns a CVSS v3.1 base score of 7.8 and a CVSS v4 base score of...

Siemens’ Simcenter Femap has received a fresh security spotlight: two file‑parsing vulnerabilities that allow local code execution when a user opens specially crafted STP or BMP files, and Siemens has published fixed versions while U.S. authorities have republished the advisory for awareness...

In a significant escalation for industrial cybersecurity, a broad class of Siemens engineering software has been confirmed vulnerable to a type confusion deserialization flaw that can lead to arbitrary code execution when an attacker has local authenticated access. The issue—tracked under...

CISA’s August 14 advisory bundle is a wake-up call for every industrial operator: thirty-two separate Industrial Control Systems (ICS) advisories were published, covering a sweeping range of Siemens and Rockwell products — from PLC simulators and engineering platforms to rugged network gear and...

Siemens’ RUGGEDCOM ROX II series is the subject of a newly spotlighted vulnerability that raises immediate operational concerns for industrial network operators: an unrestricted file upload condition in the device web interface can allow a high‑privilege, authenticated user to write arbitrary...