CVE-2022-25622

CVE-2022-25622 affects Siemens PROFINET PNIO stack integrated with Interniche stack. The root cause is improper handling of internal resources for TCP segments when the minimum TCP header length is below the defined value, enabling an attacker to cause a DoS on TCP services by sending crafted TCP...

Siemens SIMATIC 资源管理错误漏洞

The SIMATIC S7-400 CPU series is designed for process control in industrial environments.The SIMATIC S7-300 CPU series is designed for discrete and continuous control in industrial environments.The SIMATIC S7-1500 CPU series is designed for discrete and continuous control in industrial...

Siemens SIMATIC S7-400

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

Siemens PROFINET Stack Integrated on Interniche Stack

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Siemens SIMATIC Energy Manager

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC Energy Manager Vulnerabilities: Incorrect Permission Assignment for Critical Resource, Uncontrolled Search Path Element, Deserialization of Untrusted Data 2. RISK EVALUATION...

Siemens SIMATIC STEP 7 (TIA Portal)

1. EXECUTIVE SUMMARY CVSS v3 6.4 Vendor: Siemens Equipment: STEP 7 TIA Portal Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve privilege escalation on the web server of certain devices configured by SIMATIC...

The vulnerability of the Simatic programmable logic controller’s software lies in the improper release of memory before deleting the last reference, allowing a intruder to trigger a service failure.

The vulnerability of the Simatic programmable logic controller’s software is related to the improper release of memory before deleting the last references. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

The vulnerability of the Simatic programmable logic controller’s software relates to operations involving resources after their expiration time. This allows a intruder to cause a service failure.

The vulnerability of the Simatic programmable logic controller’s software relates to operations involving resources after their expiration date. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted packets...

PT-2022-3193

Name of the Vulnerable Software and Affected Versions SIMATIC CP 442-1 RNA versions prior to V1.5.18 SIMATIC CP 443-1 RNA versions prior to V1.5.18 Description The issue is related to the improper handling of excessive ARP broadcast requests, which could allow an attacker to create a denial of...

Siemens SIMATIC Industrial Products Operation On a Resource After Expiration or Release (CVE-2021-37204)

A vulnerability has been identified in SIMATIC Drive Controller family All versions = V2.9.2 = V21.9 = V4.5.0 = V2.9.2 = V21.9 = V4.0 V4.0 SP1, SIPLUS TIM 1531 IRC All versions V2.3.6, TIM 1531 IRC All versions V2.3.6. An unauthenticated attacker could cause a denial-of-service condition in a PLC...

Siemens SIMATIC Industrial Products Operation On a Resource After Expiration or Release (CVE-2021-37185)

A vulnerability has been identified in SIMATIC Drive Controller family All versions = V2.9.2 = V21.9 = V4.5.0 = V2.9.2 = V21.9 = V4.0 V4.0 SP1, SIPLUS TIM 1531 IRC All versions V2.3.6, TIM 1531 IRC All versions V2.3.6. An unauthenticated attacker could cause a denial- of-service condition in a PL...

Siemens SIMATIC Industrial Products Missing Release of Memory After Effective Lifetime (CVE-2021-37205)

A vulnerability has been identified in SIMATIC Drive Controller family All versions = V2.9.2 = V21.9 = V4.5.0 = V2.9.2 = V21.9 = V4.0 V4.0 SP1, SIPLUS TIM 1531 IRC All versions V2.3.6, TIM 1531 IRC All versions V2.3.6. An unauthenticated attacker could cause a denial- of-service condition in a PL...

Siemens SIMATIC CP 1543-1 Improper Input Validation (CVE-2016-8562)

A vulnerability has been identified in SIMATIC CP 1543-1 All versions V2.0.28, SIPLUS NET CP 1543-1 All versions V2.0.28. Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these...

The vulnerability of the microprogrammed software of the SIMATIC S7-1200 programmable logic controller lies in the possibility for unauthorized users to execute commands, allowing intruders to initiate and terminate the controller’s operations.

The vulnerability of the microprogrammed control system of the SIMATIC S7-1200 programmable logic controller is related to the possibility for unauthorized users to execute commands. Exploiting this vulnerability could allow an intruder, operating remotely, to execute commands to start and stop t...

PT-2022-37654

Уязвимость микропрограммного обеспечения программируемого логического контроллера SIMATIC S7-1200 связана с возможностью неаутентифицированного пользователя выполнять команды. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить команды запуска и остановки контролл...

CISA Adds Another 95 Flaws to its Actively Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA this week added 95 more security flaws to its Known Exploited Vulnerabilities Catalog, taking the total number of actively exploited vulnerabilities to 478. "These types of vulnerabilities are a frequent attack vector for malicious...

VulnCheck KEV: CVE-2016-8562

An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor CP that allows a privileged attacker to remotely cause a denial of service...

Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability

An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor CP that allows a privileged attacker to remotely cause a denial of service...

CVE-2021-40363

A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions, SIMATIC PCS 7 V9.1 All versions V9.1 SP1, SIMATIC WinCC V15 and earlier All versions V15 SP1 Update 7, SIMATIC WinCC V16 All versions V16 Update 5, SIMATIC WinCC V17 All versions V17 Update 2,...

CVE-2021-37204

A vulnerability has been identified in SIMATIC Drive Controller family All versions = V2.9.2 = V21.9 = V4.5.0 = V2.9.2 = V21.9 = V4.0 V4.0 SP1, SIPLUS TIM 1531 IRC All versions V2.3.6, TIM 1531 IRC All versions V2.3.6. An unauthenticated attacker could cause a denial-of-service condition in a PLC...