Code injection

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU All versions = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 V3.0, SCALANCE SC646-2C All versions V2.3, SCALANCE SC646-2C...

Authentication flaw

A vulnerability has been identified in SIMATIC CP 1242-7 V2 All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 V2.2.28, SIPLUS NET CP 1242-7 V2 All versions V3.3.46, SIPLUS NET CP 1543-1 All versions V3.0.22, SIPLUS S7-1200 CP 1243-1 All versions V3.3.46, SIPLUS S7-1200 CP 1243-1 RAIL All versions...

Default configuration

A vulnerability has been identified in SIMATIC eaSie Core Package All versions V22.00. The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and...

Heap overflow

A vulnerability has been identified in SIMATIC CP 1242-7 V2 All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 V2.2.28, SIPLUS NET CP 1242-7 V2 All versions V3.3.46, SIPLUS NET CP 1543-1 All versions V3.0.22, SIPLUS S7-1200 CP 1243-1 All versions V3.3.46, SIPLUS S7-1200 CP 1243-1 RAIL All versions...

Input validation

A vulnerability has been identified in SIMATIC eaSie Core Package All versions V22.00. The affected systems do not properly validate input that is sent to the underlying message passing framework. This could allow an remote attacker to trigger a denial of service of the affected system...

CVE-2022-34820

A vulnerability has been identified in SIMATIC CP 1242-7 V2 All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 V2.2.28, SIPLUS NET CP 1242-7 V2 All versions V3.3.46, SIPLUS NET CP 1543-1 All versions V3.0.22, SIPLUS S7-1200 CP 1243-1 All versions V3.3.46, SIPLUS S7-1200 CP 1243-1 RAIL All versions...

CVE-2022-34820

CVE-2022-34820 is an authentication input handling vulnerability in Siemens SIMATIC CP devices (e.g., CP 1242-7/1243-1/1243-7 LTE EU/US/8 IRC, CP 1542SP-1/1543-1/1543SP-1, SIPLUS variants) where certain user-provided fields are not correctly escaped during authentication, allowing an attacker to ...

CVE-2022-34820

A vulnerability has been identified in SIMATIC CP 1242-7 V2 All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 V2.2.28, SIPLUS NET CP 1242-7 V2 All versions V3.3.46, SIPLUS NET CP 1543-1 All versions V3.0.22, SIPLUS S7-1200 CP 1243-1 All versions V3.3.46, SIPLUS S7-1200 CP 1243-1 RAIL All versions...

CVE-2022-34819

Summary of CVE-2022-34819 : A heap-based buffer overflow vulnerability exists in Siemens SIMATIC CP devices via the SINEMA Remote Connect Server (SRCS) VPN feature. The issue stems from insufficient validation of user-supplied data when parsing specific SRCS messages, potentially allowing an atta...

CVE-2022-34819

A vulnerability has been identified in SIMATIC CP 1242-7 V2 All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 V2.2.28, SIPLUS NET CP 1242-7 V2 All versions V3.3.46, SIPLUS NET CP 1543-1 All versions V3.0.22, SIPLUS S7-1200 CP 1243-1 All versions V3.3.46, SIPLUS S7-1200 CP 1243-1 RAIL All versions...

CVE-2022-34819

A vulnerability has been identified in SIMATIC CP 1242-7 V2 All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 V2.2.28, SIPLUS NET CP 1242-7 V2 All versions V3.3.46, SIPLUS NET CP 1543-1 All versions V3.0.22, SIPLUS S7-1200 CP 1243-1 All versions V3.3.46, SIPLUS S7-1200 CP 1243-1 RAIL All versions...

CVE-2022-33138

A vulnerability has been identified in SIMATIC MV540 H All versions V3.3, SIMATIC MV540 S All versions V3.3, SIMATIC MV550 H All versions V3.3, SIMATIC MV550 S All versions V3.3, SIMATIC MV560 U All versions V3.3, SIMATIC MV560 X All versions V3.3. Affected devices do not perform authentication f...

CVE-2022-33138

CVE-2022-33138 affects Siemens SIMATIC MV500 family (MV540 H/S, MV550 H/S, MV560 U/X): all versions before v3.3. The root cause is missing authentication for several web API endpoints, enabling an unauthenticated remote attacker to read and download data from the device. Siemens-Mitigation: updat...

CVE-2022-33137

The CVE-2022-33137 issue affects Siemens SIMATIC MV500 devices (MV540 H/S, MV550 H/S, MV560 U/X) with all versions before v3.3. The root cause is insufficient session expiration: the web session management does not invalidate session IDs in certain logout scenarios, allowing an authenticated remo...

CVE-2022-33137

A vulnerability has been identified in SIMATIC MV540 H All versions V3.3, SIMATIC MV540 S All versions V3.3, SIMATIC MV550 H All versions V3.3, SIMATIC MV550 S All versions V3.3, SIMATIC MV560 U All versions V3.3, SIMATIC MV560 X All versions V3.3. The web session management of affected devices...

CVE-2021-44222

A vulnerability has been identified in SIMATIC eaSie Core Package All versions V22.00. The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and...

CVE-2021-44222

CVE-2021-44222 affects Siemens SIMATIC eaSie Core Package: all versions before v22.00 with the MQTT service that does not perform authentication by default, allowing an unauthenticated remote attacker to send arbitrary messages and issue arbitrary requests within the affected system. MITRE CVSSv3...

CVE-2021-44221

CVE-2021-44221 affects Siemens SIMATIC eaSie Core Package (all versions before v22.00). The underlying issue is improper input validation in the message passing framework, allowing a remote attacker to trigger a denial of service. ICSA/Siemens advisories cite a CVSSv3 base score of 7.5 (AV:N/AC:L...

CVE-2021-44221

A vulnerability has been identified in SIMATIC eaSie Core Package All versions V22.00. The affected systems do not properly validate input that is sent to the underlying message passing framework. This could allow an remote attacker to trigger a denial of service of the affected system...

CVE-2021-44222: Missing Authentication for Critical Function

A vulnerability has been identified in SIMATIC eaSie Core Package All versions V22.00. The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and...