Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42386)

A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens SIMATIC Devices Linux Kernel Out-of-bounds Read (CVE-2023-26607)

In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfsattrfind in fs/ntfs/attrib.c. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Siemens SIMATIC Devices Linux Kernel Missing Release of Memory after Effective Lifetime (CVE-2022-4139)

An incorrect TLB flush issue was found in the Linux kernel's GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system. This plugin only works with Tenable.ot. Please vis...

Siemens SIMATIC Devices Linux Kernel Stack-based Buffer Overflow (CVE-2022-2078)

A vulnerability was found in the Linux kernel's nftsetdescconcatparse function .This flaw allows an attacker to trigger a buffer overflow via nftsetdescconcatparse , causing a denial of service and possibly to run code. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Linux Kernel Improper Resource Shutdown or Release (CVE-2022-1473)

The used OpenSSL version improperly reuses memory when decoding certificates or keys. This can lead to a process termination and Denial of Service for long lived processes. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-1882)

A use-after-free flaw was found in the Linux kernel's pipes functionality in how a user performs manipulations with the pipe postonenotification after freepipeinfo that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system. This plugin on...

Siemens SIMATIC Devices Linux Kernel Double Free (CVE-2022-2327)

iouring use workflags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORINGOP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We...

Siemens SIMATIC Devices Linux Kernel NULL Pointer Dereference (CVE-2023-1095)

In nftablesupdtable, if nftablestableenable returns an error, nfttransdestroy is called to free the transaction object. nfttransdestroy calls listdel, but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference. This plugin only works...

Siemens SIMATIC Devices Linux Kernel NULL Pointer Dereference (CVE-2022-3621)

A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfsbmaplookupatlevel of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is...

Siemens SIMATIC S7-1500 TM MFP BIOS Missing Encryption of Sensitive Data (CVE-2022-21233)

Improper isolation of shared resources in some IntelR Processors may allow a privileged user to potentially enable information disclosure via local access. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

Siemens SIMATIC S7-1500 TM MFP BIOS Loop with Unreachable Exit Condition ('Infinite Loop') (CVE-2020-27618)

The iconv function in the GNU C Library aka glibc or libc6 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a deni...

Siemens SIMATIC Devices Linux Kernel Use of a Broken or Risky Cryptographic Algorithm (CVE-2022-1434)

When using the RC4-MD5 ciphersuite, which is disabled by default, an attacker is able to modify data in transit due to an incorrect use of the AAD data as the MAC key in OpenSSL 3.0. An attacker is not able to decrypt any communication. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC and SCALANCE Devices Linux Kernel Integer Overflow or Wraparound (CVE-2023-23559)

In rndisqueryoid in drivers/net/wireless/rndiswlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. C Tenable, Inc. include'compat.inc'; if...

Siemens SIMATIC S7-1200 CPU Family Improper Validation of Syntactic Correctness of Input (CVE-2025-24812)

Affected devices do not process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SIMATIC S7-1200 CPU Family Improper Resource Shutdown or Release (CVE-2025-24811)

Affected devices do not process correctly certain special crafted packets sent to port 80/tcp, which could allow an unauthenticated attacker to cause a denial of service in the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in several products such as APOGEE, Opcenter, RUGGEDCOM, SCALANCE, SIMATIC, SIPROTEC and Teamcenter. The vulnerabilities potentially enable a malicious person to carry out attacks that could lead to the following categories of damage: - Denial-of-Service DoS -...

The vulnerability of the web interface of microprogramming software for programmable logic controllers SIMATIC S7-1200 allows a attacker to perform a CSRF attack.

The vulnerability of the web interface of microprogramming software for programmable logic controllers SIMATIC S7-1200 is related to the of cross-site requests. Exploiting this vulnerability can allow a malicious actor to execute a CSRF attack remotely...

CVE-2025-24812

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly 6ES7211-1BE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1211C DC/DC/DC 6ES7211-1AE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1211C DC/DC/Rly 6ES7211-1HE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1212C AC/DC/Rly...

CVE-2025-24811

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly 6ES7211-1BE40-0XB0, SIMATIC S7-1200 CPU 1211C DC/DC/DC 6ES7211-1AE40-0XB0, SIMATIC S7-1200 CPU 1211C DC/DC/Rly 6ES7211-1HE40-0XB0, SIMATIC S7-1200 CPU 1212C AC/DC/Rly 6ES7212-1BE40-0XB0, SIMATIC S7-1200 CPU 1212C DC/DC/DC...

CVE-2024-45386

A vulnerability has been identified in SIMATIC PCS neo V4.0 All versions, SIMATIC PCS neo V4.1 All versions V4.1 Update 2, SIMATIC PCS neo V5.0 All versions V5.0 Update 1, SIMOCODE ES V19 All versions V19 Update 1, SIRIUS Safety ES V19 TIA Portal All versions V19 Update 1, SIRIUS Soft Starter ES...