Siemens SCALANCE and RUGGEDCOM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2025-4138)

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives using TarFile.extractallor...

Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2025-38498)

In the Linux kernel, the following vulnerability has been resolved: dochangetype: refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount2...

Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2025-38345)

In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi operand cache leak in dswstate.c ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 I found an ACPI cache leak in ACPI early termination and boot continuing case. When early termination occurs due to maliciou...

Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2025-38086)

"In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during miinwayrestart In miinwayrestart the code attempts to call mii-mdioread which is ch9200mdioread. ch9200mdioread utilises a local buffer called buff, which is initialised with...

Siemens SCALANCE and RUGGEDCOM Out-of-bounds Write (CVE-2022-48174)

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot f...

Siemens SCALANCE and RUGGEDCOM Use After Free (CVE-2025-4516)

There is an issue in CPython when using bytes.decodeunicodeescape, error=ignore|replace. If you are not using the unicodeescape encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode call in a try-...

Siemens SCALANCE and RUGGEDCOM Incorrect Authorization (CVE-2025-40568)

An internal session termination functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with guest role to terminate legitimate users' sessions. This plugin only works with Tenable.ot. Pleas...

Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2025-39865)

"In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in teeshmput teeshmput have NULL pointer dereference: opteedisableshmcache -- shm = regpairtoptr... %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505112;...

Siemens SCALANCE and RUGGEDCOM Concurrent Execution Using Shared Resource with Improper Synchronization (CVE-2025-40569)

The Load Configuration from Local PC functionality in the web interface of affected products contains a race condition vulnerability. This could allow an authenticated remote attacker to make the affected product load an attacker controlled configuration instead of the legitimate one. Successful...

Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2025-39839)

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadvncskbdecodepacket trusts codedlen and checks only against skb-len. XOR starts at sizeofstruct batadvunicastpacket, reducing payload headroom, and the source skb length...

Siemens SCALANCE and RUGGEDCOM Use After Free (CVE-2023-42364)

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

Siemens SCALANCE and RUGGEDCOM Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2023-42366)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Siemens SCALANCE and RUGGEDCOM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2025-4330)

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives using TarFile.extractallor...

Siemens SCALANCE and RUGGEDCOM NULL Pointer Dereference (CVE-2024-8006)

Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcapfindalldevsex. One of the function arguments can be a filesystem path, which normally means a directory with...

Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2023-39810)

An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2025-38084)

"In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, splitvma triggers hugetlb page table unsharing through vmops-maysplit. This happens before the VMA lock and rmap locks are taken - which is too early, it...

Siemens SCALANCE and RUGGEDCOM Out-of-bounds Read (CVE-2025-9086)

A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target same hostname, but using clear text HTTP using the same cookie set 3. The same cookie name is set - but with just a slash as path path='/'. Since this site is not...

Siemens SCALANCE and RUGGEDCOM Generation of Predictable Numbers or Identifiers (CVE-2025-10148)

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001372)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001372 advisory. A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass...

Siemens RUGGEDCOM APE1808 Devices

SUMMARY Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not...