Remote code execution

A vulnerability has been identified in Desigo CC V4.x, Desigo CC V3.x, Desigo CC Compact V4.x, Desigo CC Compact V3.x. Affected applications are delivered with a 3rd party component BIRT that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The...

CVE-2020-10055

A vulnerability has been identified in Desigo CC V4.x, Desigo CC V3.x, Desigo CC Compact V4.x, Desigo CC Compact V3.x. Affected applications are delivered with a 3rd party component BIRT that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The...

CVE-2020-10055

CVE-2020-10055 affects Siemens Desigo CC and Desigo CC Compact (versions 3.x and 4.x) via a vulnerable third‑party BIRT component used by the Advanced Reporting Engine, enabling remote code execution with SYSTEM privileges. Mitigation: Siemens released patches for affected versions (and advises d...

Siemens Desigo CC and Desigo CC Compact Code Injection Vulnerability

Desigo CC is a comprehensive building management platform for managing high-performance buildings.Desigo CC Compact offers tailored solutions for small and medium-sized buildings. A code injection vulnerability exists in Siemens Desigo CC and Desigo CC Compact. Allows an unauthenticated, remote...

Siemens Desigo CC

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment : Desigo CC Vulnerability: Code Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain remote code execution on the server with...

Siemens SIMOTICS, Desigo, APOGEE, and TALON

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable from an adjacent network/low skill level to exploit Vendor: Siemens Equipment: SIMOTICS, Desigo, APOGEE, and TALON Vulnerability: Business Logic Errors 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled...

CVE-2019-13939

CVE-2019-13939 affects Siemens Mentor Nucleus Networking Module family (including APOGEE MEC/MBC/PXC, Desigo PXC, PXM, Nucleus NET/RTOS/ReadyStart, SIMOTICS/TALON, VSTAR) across numerous versions. The root cause is improper handling of DHCP packets: when the DHCP client is enabled, an attacker se...

The vulnerability of the microprogramming software for Desigo PX arises from incorrect verification of input data by the PX Web service (port TCP/80). This allows a perpetrator to trigger a service failure.

The vulnerability of the microprogramming software for Desigo PX is related to incorrect verification of input data by the PX Web service port TCP/80. Exploiting this vulnerability can allow an attacker to cause service failures...

Siemens Desigo PX Remote Denial of Service

A directory traversal vulnerability exists in Siemens Desigo. The vulnerability is caused due to improper validation of certain requests. A remote attacker can exploit this issue by sending a specially crafted request to the target. Successful exploitation could result in a denial of service...

CVE-2019-13927

A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 All firmware versions V6.00.320, Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules...

CVE-2019-13927

A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 All firmware versions V6.00.320, Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules...

Design/Logic Flaw

A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 All firmware versions V6.00.320, Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules...

CVE-2019-13927

A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 All firmware versions V6.00.320, Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules...

CVE-2019-13927

CVE-2019-13927 affects Siemens Desigo PX devices with web interfaces (web server on tcp/80). A specially crafted HTTP message can cause the web server to respond with 404 to subsequent requests, degrading availability; recovery requires a reboot. Affected families include PXC00-E/D, PXC50-E/D, PX...

Siemens Desigo PX Web Remote Denial of Service Vulnerability

Desigo-PX automation stations and operator units control and monitor building automation systems. They allow alarm signals, time-based programs and trend logging. A remote denial of service vulnerability exists in Siemens Desigo PX Web. An attacker could cause a denial of service condition on the...

Siemens Desigo PX V6.00 Web Remote Denial of Service Exploit

Summary Desigo PX is a modern building automation and control system for the entire field of building service plants. Scalable from small to large projects with highest degree of energy efficiency, openness and user-friendly operation. Description The device contains a vulnerability that could...

Siemens Desigo PX Devices

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Siemens Equipment : Desigo PX Devices Vulnerability : External Control of Assumed-Immutable Web Parameter 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker...

Siemens Desigo PX CVE-2019-13927 Denial of Service Vulnerability

Description Siemens Desigo PX is prone to denial of service vulnerability Remote attackers may exploit this issue to cause denial-of-service conditions. Technologies Affected Siemens Desigo PX PXA40-W0 Siemens Desigo PX PXA40-W1 Siemens Desigo PX PXA40-W2 Siemens Desigo PX PXC00-E.D Siemens Desig...

Siemens Desigo PX Web Modules Insufficient Entropy

Binary data 720093.prm...

ICSA-18-093-01 Siemens Building Technologies Products (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit. Vendor : Siemens Equipment : Building Technologies Products Vulnerabilities : Stack-based Buffer Overflows, Security Features, Improper Restriction of Operations within the Bounds of a Memory Buffer, NUL...