CVE-2021-27384

CVE-2021-27384 is a concrete SmartVNC vulnerability: an out-of-bounds memory access in the device layout handler could allow code execution. Affected Siemens products include SmartVNC-enabled HMI/WinCC components (e.g., SIMATIC HMI Comfort Outdoor Panels, KTP Mobile Panels, WinCC Runtime Advanced...

CVE-2021-27383

CVE-2021-27383 describes a heap allocation leak vulnerability in the SmartVNC server Tight encoder, causing a Denial-of-Service condition. Affected are Siemens SmartVNC deployments on various HMI/WinCC panels (e.g., SIMATIC HMI Comfort Outdoor Panels, Comfort Panels, KTP Mobile Panels, WinCC Runt...

PT-2021-17429 · Siemens · Sinamics Sm150I +8

Name of the Vulnerable Software and Affected Versions: SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" incl. SIPLUS variants versions prior to V15.1 Update 6 SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" incl. SIPLUS variants versions prior to V16 Update 4 SIMATIC HMI Comfort Panels V15 4" - 22...

Siemens SINAMICS SL150 访问控制错误漏洞

Siemens SINAMICS SL150 is an application program of Siemens, Germany. Cyclic frequency converter for high-torque slow-speed synchronous and induction motors. An access control error vulnerability exists in multiple Siemens devices. The vulnerability stems from a system component's Telnet service...

Siemens SINAMICS Medium Voltage Products Remote Access (Update B)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SINAMICS Medium Voltage Products, Remote Access Vulnerabilities: Improper Restriction of Operations Within the Bounds of a Memory Buffer, Access of Memory Location After End of Buffer, Uncontrolled Resourc...

Siemens SINAMICS Medium Voltage Products Telnet (Update A)

1. EXECUTIVE SUMMARY --------- Begin Update A Part 1 of 3 --------- CVSS v3 8.1 --------- End Update A Part 1 of 3 --------- ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SINAMICS Medium Voltage Products Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION...

CVE-2020-15798

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

Authentication flaw

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

CVE-2020-15798

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

CVE-2020-15798

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

CVE-2020-15798

CVE-2020-15798 affects Siemens SIMATIC HMI Comfort Panels (incl. SIPLUS) and SIMATIC HMI KTP Mobile Panels, plus several SINAMICS models (GH150, GL150 X30, GM150 X30, SH150, SL150, SM120, SM150, SM150i). The vulnerability arises from the Telnet service not requiring authentication, allowing a rem...

CVE-2020-7586

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3, SIMATIC PDM All versions V9.2, SIMATIC STEP 7 V5.X All versions V5.6 SP2 HF3, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 HF2. A buffer overflow...

Code injection

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3, SIMATIC PDM All versions V9.2, SIMATIC STEP 7 V5.X All versions V5.6 SP2 HF3, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 HF2. A DLL Hijacking...

Buffer overflow

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3, SIMATIC PDM All versions V9.2, SIMATIC STEP 7 V5.X All versions V5.6 SP2 HF3, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 HF2. A buffer overflow...

CVE-2020-7586

CVE-2020-7586 is a local, heap-based buffer overflow vulnerability affecting Siemens products (SIMATIC PCS 7, PDM, STEP 7, SINAMICS STARTER). The issue allows a local attacker with existing access to cause a DoS and potentially access confidential information due to memory corruption. Root cause ...

CVE-2020-7585

The connected advisory (ICSA-20-161-05) provides concrete details for CVE-2020-7585. A DLL hijacking flaw (Uncontrolled Search Path Element, CWE-427) in Siemens software could allow a local attacker with access to execute code with elevated privileges, affecting: SIMATIC PCS 7 v8.2 and earlier; S...

CVE-2020-7580

A vulnerability has been identified in SIMATIC Automation Tool All versions V4 SP2, SIMATIC NET PC Software V14 All versions V14 SP1 Update 14, SIMATIC NET PC Software V15 All versions, SIMATIC NET PC Software V16 All versions V16 Upd3, SIMATIC PCS neo All versions V3.0 SP1, SIMATIC ProSave All...

CVE-2020-7580

CVE-2020-7580 affects Siemens products (e.g., SIMATIC Automation Tool, STEP 7/TIA Portal, WinCC OA, ProSave, S7-1500 controllers, etc.). Root cause: a common component calls a helper binary with SYSTEM privileges while the call path is not quoted (unquoted search path/element CWE-428). This could...

Siemens SIMATIC, SINAMICS (Update C)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Siemens Equipment: SIMATIC, SINAMICS Vulnerabilities: Uncontrolled Search Path Element, Heap-based Buffer Overflow 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled ICSA-20-161-05...

Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update J)

1. EXECUTIVE SUMMARY --------- Begin Update K Part 1 of 2 --------- CVSS v3 8.8 --------- End Update K Part 1 of 2 --------- ATTENTION: Low attack complexity Vendor: Siemens Equipment: SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK Vulnerability: Unquoted Search Path or Element 2. UPDATE...