Most recent entries from all

bdu:2022-03215

certfr-2022-avi-435 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un atta…

certfr-2022-avi-435

EUVD-2026-33211

fkie_cve-2021-45117

The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference.

GHSA-v4v7-f2qj-8939

The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference.

gsd-2021-45117

ICSA-22-132-08 — Siemens Industrial Products with OPC UA

The OPC UA ANSIC Stack (also called Legacy C-Stack) was reported to crash when an unexpected OPC UA Response message status code was accessed via the synchronous Client API. The vulnerability was found in generated code of the OPC Foundation C-Stack. An unexpected status code in response message will dereference Null pointer leading to crash, ping of death (PoD). This affects a client, but it might also affect a server when it uses OpcUa_ClientApi_RegisterServer (e.g. register at LDS). A specially crafted UA server, or Man in the Middle attacker, can cause the OPC UA application to crash by sending uncertain status code in response message.

VDE-2022-003 — BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology

By tricking clients of the mentioned products into contacting malicious OPC UA servers and thereby acting as OPC UA clients, a crash of the component can be provoked.

VDE-2022-010 — PHOENIX CONTACT: Multiple Linux component vulnerabilities fixed in latest AXC F x152 LTS release

PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.

Firmware components in version 2021.06 had already been updated. For the 2022.0 LTS version more firmware components have been updated implicitly fixing the vulnerabilities listed. The vulnerabilities listed above have not been individually verified in terms of actual impact and/or limitations in combination with the affected products listed. The current LTS release 2022.0 LTS contains updates of integrated third-party libraries, SDKs and other third-party software to address these issues nevertheless.

UPDATE A (April 4th, 2022): Added RFC 4072 (Art. No. 1051328) and fixed affected version of AXC F 3152

WID-SEC-W-2023-2603 — Siemens SICAM: Mehrere Schwachstellen

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Siemens SICAM ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, seine Privilegien zu erweitern und Daten zu manipulieren.