Siemens S7-1500 Out-of-bounds Read (CVE-2025-11840)

A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This pat...

Siemens S7-1500 Inefficient Algorithmic Complexity (CVE-2025-66382)

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens S7-1500 Use of Uninitialized Variable (CVE-2025-39931)

In the Linux kernel, the following vulnerability has been resolved: crypto: afalg - Set merge to zero early in afalgsendmsg If an error causes afalgsendmsg to abort, ctx-merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into afalgsendmsg whe...

Siemens SIMATIC and SIPLUS products Uncontrolled Resource Consumption (CVE-2025-40944)

Affected devices do not properly handle S7 protocol session disconnect requests. When receiving a valid S7 protocol Disconnect Request COTP DR TPDU on TCP port 102, the devices enter an improper session state. This could allow an attacker to cause the device to become unresponsive, leading to a...

Siemens S7-1500 Missing Release of Memory after Effective Lifetime (CVE-2025-39929)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdirectrecvio leak in smbdnegotiate error path During tests of another unrelated patch I was able to trigger this error: Objects remaining on kmemcacheshutdown This plugin only works with Tenable.ot. Please vis...

Siemens S7-1500 and SCALANCE Allocation of Resources Without Limits or Throttling (CVE-2025-59375)

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens S7-1500 Use After Free (CVE-2025-7425)

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may acce...

Siemens S7-1500 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2025-11083)

A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elfswapshdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public an...

Siemens S7-1500 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2025-11414)

A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function getlinkhashentry of the file bfd/elflink.c of the component Linker. This manipulation causes out- of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed an...

CVE-2026-21903

A Stack-based Buffer Overflow vulnerability in the Packet Forwarding Engine pfe of Juniper Networks Junos OS allows a network-based attacker, authenticated with low privileges to cause a Denial-of-Service DoS. Subscribing to telemetry sensors at scale causes all FPC connections to drop, resulting...

CVE-2025-40944: Uncontrolled Resource Consumption

A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN 6ES7157-1AB00-0AB0 All versions, SIMATIC ET 200MP IM 155-5 PN HF 6ES7155-5AA00-0AC0 All versions = V4.2.0, SIMATIC ET 200SP IM 155-6 MF HF 6ES7155-6MU00-0CN0 All versions, SIMATIC ET 200SP IM 155-6 PN HA incl. SIPLUS variants All...

CVE-2019-18336

A vulnerability has been identified in SIMATIC S7-300 CPU family incl. related ET200 CPUs and SIPLUS variants All versions V3.X.17, SIMATIC TDC CP51M1 All versions V1.1.8, SIMATIC TDC CPU555 All versions V1.1.1, SINUMERIK 840D sl All versions V4.8.6, SINUMERIK 840D sl All versions V4.94. Speciall...

CVE-2020-7584

A vulnerability has been identified in SIMATIC S7-200 SMART CPU family All versions = V2.2 V2.5.1. Affected devices do not properly handle large numbers of new incomming connections and could crash under certain circumstances. An attacker may leverage this to cause a Denial-of-Service situation...

The vulnerability of microprogrammed software in programmable logic controllers SIMATIC S7-1200, related to improper release of resources, allows a intruder to trigger a service failure.

The vulnerability of microprogrammed software in programmable logic controllers SIMATIC S7-1200 is related to the improper release of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to cause malfunctions in the system...

CVE-2025-14673 gmg137 snap7-rs client.rs as_ct_write heap-based overflow

A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7rs::client::S7Client::asctwrite of the file /tests/snap7-rs/src/client.rs. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to t...

Siemens SIMATIC S7-1500 Use After Free (CVE-2023-31248)

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nftchainlookupbyid failed to check whether a chain was active and CAPNETADMIN is in any user or network namespace This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

Siemens SIMATIC S7-1500 Out-of-bounds Write (CVE-2019-5094)

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. This plugin only...

Siemens SIMATIC S7-1500 URL Redirection to Untrusted Site (CVE-2021-28861)

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states Warnin...

Siemens SIMATIC S7-1500 Use After Free (CVE-2021-3518)

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. This plugin only works...

Siemens SIMATIC S7-1500 Uncontrolled Resource Consumption (CVE-2021-3737)

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability...