CVE-2025-40937: Improper Neutralization of Special Elements used in a Command

A vulnerability has been identified in SIMATIC CN 4100 All versions V4.0.1. The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments. This could allow an authenticated attacker to execute arbitrary code with limited...

The vulnerability of the SIMATIC Virtualization as a Service platform, related to the improper assignment of permissions for critical resources, allows an attacker to gain unauthorized access to read and modify data.

The vulnerability of SIMATIC Virtualization as a Service SiVaaS platform is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized read and write access to data...

Siemens SIMATIC and SCALANCE Devices Use After Free (CVE-2023-3390)

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nftablesapi.c. Mishandled error handling with NFTMSGNEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local...

Siemens SIMATIC S7-1500 Use After Free (CVE-2023-31248)

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nftchainlookupbyid failed to check whether a chain was active and CAPNETADMIN is in any user or network namespace This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

Siemens SIMATIC and SCALANCE Use After Free (CVE-2023-4128)

A use-after-free vulnerability in net/sched/clsfw.c in classifiers clsfw, clsu32, and clsroute in the Linux Kernel allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak. This plugin only works with...

Siemens SIMATIC and SCALANCE Use After Free (CVE-2023-3776)

A use-after-free vulnerability in the Linux kernel's net/sched: clsfw component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, fwsetparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter. If an attacker ca...

Siemens SIMATIC S7-1500 Use After Free (CVE-2021-20231)

A flaw was found in gnutls. A use after free issue in client sending keyshare extension may lead to memory corruption and other consequences. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens SIMATIC S7-1500 Improper Validation of Certificate with Host Mismatch (CVE-2024-2466)

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate...

Siemens SIMATIC S7-1500 Reachable Assertion (CVE-2024-33601)

nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's nscd netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was...

Siemens SIMATIC S7-1500 Out-of-bounds Write (CVE-2020-19185)

Buffer Overflow vulnerability in oneonemapping function in progs/dumpentry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SIMATIC S7-1500 Use After Free (CVE-2019-5018)

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this...

Siemens SIMATIC S7-1500 Uncontrolled Resource Consumption (CVE-2023-32636)

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect gli...

Siemens SIMATIC S7-1500 Use After Free (CVE-2023-4813)

A flaw was found in glibc. In an uncommon situation, the gaihinet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue...

Siemens SIMATIC S7-1500 Incorrect Type Conversion or Cast (CVE-2020-10735)

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using inttext, a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits float, decimal, int.frombytes, and int for binary bases 2, 4, 8, 16, and 32 are not...

Siemens SIMATIC S7-1500 URL Redirection to Untrusted Site (CVE-2021-28861)

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states Warnin...

Siemens SIMATIC S7-1500 Use After Free (CVE-2022-43552)

curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can and often do deny such tunnel operations using an appropriate HTTP error response code. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struc...

Siemens SIMATIC S7-1500 Race Condition (CVE-2025-21701)

net: vulnerability arises because unregisternetdevicemanynotify might run before the rtnl lock section of ethnl operations, leading to potential use of destroyed locks, which is fixed by denying operations on devices being unregistered. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 Double Free (CVE-2023-27537)

A double free vulnerability exists in libcurl 8.0.0 when sharing HSTS data between separate handles. This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2024-56570)

In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovldentryweird function to prevent the processing of directory inodes that lack the lookup function.This is important because such inodes can cause errors...

Siemens SIMATIC S7-1500 Out-of-bounds Write (CVE-2019-3863)

A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error. This plugin only works wi...