PT-2022-12022

Name of the Vulnerable Software and Affected Versions SIMATIC eaSie Core Package versions prior to V22.00 Description A vulnerability has been identified where the underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an...

Siemens SIMATIC 访问控制错误漏洞

The SIMATIC MV500 is a fixed optical reader used to reliably capture printed, laser, drilled, punched, and dot-marked codes on a variety of different surfaces.The Siemens SIMATIC MV500 is vulnerable to an authentication error that could be exploited by an unauthenticated, remote attacker to read...

Siemens SIMATIC eaSie Core Package 输入验证错误漏洞

SIMATIC eaSie, the digital assistant for automation and process control technology in the Siemens Automation Concept "Total Integrated Automation", is vulnerable to an input validation error that could be exploited by remote attackers to trigger a denial of service on the affected system...

Siemens SIMATIC 安全漏洞

Siemens SIMATIC is a Siemens configuration software. A security vulnerability exists in Siemens SIMATIC that stems from multiple vulnerabilities that allow an attacker to use Independent BIOS Developers via UEFI...

PT-2022-22373

Name of the Vulnerable Software and Affected Versions SIMATIC CP 1242-7 V2 All versions SIMATIC CP 1243-1 All versions SIMATIC CP 1243-7 LTE EU All versions SIMATIC CP 1243-7 LTE US All versions SIMATIC CP 1243-8 IRC All versions SIMATIC CP 1542SP-1 IRC All versions = V2.0 SIMATIC CP 1543-1 All...

多款Siemens产品缓冲区错误漏洞

The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as firewalls, virtual private networks VPNs, and support for other protocols with data encryption.The SIMATIC CP 1243-8 I...

CVE-2022-33137: Insufficient Session Expiration

A vulnerability has been identified in SIMATIC MV540 H All versions V3.3, SIMATIC MV540 S All versions V3.3, SIMATIC MV550 H All versions V3.3, SIMATIC MV550 S All versions V3.3, SIMATIC MV560 U All versions V3.3, SIMATIC MV560 X All versions V3.3. The web session management of affected devices...

CVE-2021-44221: Improper Input Validation

A vulnerability has been identified in SIMATIC eaSie Core Package All versions V22.00. The affected systems do not properly validate input that is sent to the underlying message passing framework. This could allow an remote attacker to trigger a denial of service of the affected system...

CVE-2022-33138: Missing Authentication for Critical Function

A vulnerability has been identified in SIMATIC MV540 H All versions V3.3, SIMATIC MV540 S All versions V3.3, SIMATIC MV550 H All versions V3.3, SIMATIC MV550 S All versions V3.3, SIMATIC MV560 U All versions V3.3, SIMATIC MV560 X All versions V3.3. Affected devices do not perform authentication f...

CVE-2022-34821

The CVE-2022-34821 vulnerability affects Siemens RUGGEDCOM RM1224 LTE and various SCALANCE devices. The root cause is code injection by injecting code into specific OpenVPN configuration options, allowing arbitrary code execution with elevated privileges on affected devices. Relevant impacts incl...

Siemens SIMATIC MV500 Devices

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC MV500 Devices Vulnerabilities: Insufficient Session Expiration, Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of these...

Siemens SRCS VPN Feature in SIMATIC CP Devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

Siemens SIMATIC eaSie Core Package

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC eaSie Vulnerabilities: Improper Input Validation, Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow...

CVE-2022-34819: Heap-based Buffer Overflow

A vulnerability has been identified in SIMATIC CP 1242-7 V2 All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 V2.2.28, SIPLUS NET CP 1242-7 V2 All versions V3.3.46, SIPLUS NET CP 1543-1 All versions V3.0.22, SIPLUS S7-1200 CP 1243-1 All versions V3.3.46, SIPLUS S7-1200 CP 1243-1 RAIL All versions...

PT-2022-21705

Name of the Vulnerable Software and Affected Versions SIMATIC MV540 H versions prior to V3.3 SIMATIC MV540 S versions prior to V3.3 SIMATIC MV550 H versions prior to V3.3 SIMATIC MV550 S versions prior to V3.3 SIMATIC MV560 U versions prior to V3.3 SIMATIC MV560 X versions prior to V3.3 Descripti...

Siemens多款产品 代码注入漏洞

The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as firewalls, virtual private networks VPNs, and support for other protocols with data encryption.The SIMATIC CP 1243-8 I...

Siemens SIMATIC 安全漏洞

Siemens SIMATIC is a configuration software from Siemens. A security vulnerability exists in Siemens SIMATIC that stems from multiple vulnerabilities that allow an attacker to use Independent BIOS Developers via UEFI...

Siemens SIMATIC 代码问题漏洞

The SIMATIC MV500 is a fixed optical reader used to reliably capture printed, laser, drilled, punched and dot-marked codes on a variety of different surfaces.A security vulnerability exists in the Siemens SIMATIC MV500 that could be exploited by an authenticated, remote attacker to hijack another...

Siemens SIMATIC 安全漏洞

Siemens SIMATIC is a Siemens configuration software. A security vulnerability exists in Siemens SIMATIC that stems from multiple vulnerabilities that allow an attacker to use Independent BIOS Developers via UEFI...

PT-2022-12021

Name of the Vulnerable Software and Affected Versions SIMATIC eaSie Core Package versions prior to V22.00 Description A vulnerability has been identified where the affected systems do not properly validate input sent to the underlying message passing framework. This could allow a remote attacker ...