Most recent entries from csaf_siemens

SSA-039007 — SSA-039007: Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)

Tue, 10 Sep 2024 00:00:00 +0000

Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.

SSA-054046 — SSA-054046: Unauthenticated Information Disclosure in Web Server of SIMATIC S7-1500 CPUs

Tue, 08 Oct 2024 00:00:00 +0000

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.

SSA-062309 — SSA-062309: Information Disclosure Vulnerability in TeleControl Server Basic V3.1

Tue, 14 Oct 2025 00:00:00 +0000

The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service.

SSA-083019 — SSA-083019: Multiple Vulnerabilities in RUGGEDCOM ROS Devices

Tue, 08 Jul 2025 00:00:00 +0000

The affected products support insecure cryptographic algorithms. An attacker could leverage these legacy algorithms to achieve a man-in-the-middle attack or impersonate communicating parties. Affected devices do not properly handle malformed TLS handshake messages. This could allow an attacker with network access to the webserver to cause a denial of service resulting in the web server and the device to crash. The affected devices support the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 cipher suite, which uses CBC (Cipher Block Chaining) mode that is known to be vulnerable to timing attacks. This could allow an attacker to compromise the integrity and confidentiality of encrypted communications. The affected products do not properly enforce interface access restrictions when changing from management to non-management interface configurations until a system reboot occurs, despite configuration being saved. This could allow an attacker with network access and credentials to gain access to device through non-management and maintain SSH access to the device until reboot.

SSA-240718 — SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V2

Thu, 13 Sep 2012 00:00:00 +0000

Affected devices do not properly protect the private key of the integrated Certification Authority (CA) certificate. Possession of this key could allow remote attackers to spoof the device's web server by creating a forged web server certificate.

SSA-279823 — SSA-279823: Cross-Site Scripting Vulnerability in SIMATIC S7-1200 CPU V2/V3 Before V3.0.2

Mon, 08 Oct 2012 00:00:00 +0000

The web server on affected devices contains a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary web script or HTML via a crafted URI.

SSA-318832 — SSA-318832: SQL Injection Vulnerability in SINEC NMS

Tue, 14 Oct 2025 00:00:00 +0000

Affected applications are vulnerable to SQL injection through getTotalAndFilterCounts endpoint. An authenticated low privileged attacker could exploit to insert data and achieve privilege escalation. (ZDI-CAN-26570)

SSA-367714 — SSA-367714: Improper Integrity Check of Firmware Updates in SiPass integrated AC5102 / ACC-G2 and ACC-AP

Fri, 23 May 2025 00:00:00 +0000

Affected devices do not properly check the integrity of firmware updates. This could allow a local attacker to upload a maliciously modified firmware onto the device. In a second scenario, a remote attacker who is able to intercept the transfer of a valid firmware from the server to the device could modify the firmware "on the fly".

SSA-373591 — SSA-373591: Buffer Overflow Vulnerability in RUGGEDCOM ROS Devices

Tue, 13 Jul 2021 00:00:00 +0000

The DHCP client in affected devices fails to properly sanitize incoming DHCP packets. This could allow an unauthenticated remote attacker to cause memory to be overwritten, potentially allowing remote code execution.

SSA-486936 — SSA-486936: Authentication Vulnerability in SIMATIC ET 200SP Communication Processors

Tue, 14 Oct 2025 00:00:00 +0000

Affected devices do not properly authenticate configuration connections. This could allow an unauthenticated remote attacker to access the configuration data.