Siemens COMOS
COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for the affected products and recommends to update to the latest versions.
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-40801US | — | — | ||
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (A… | ||||
| CVE-2025-40800US | — | — | ||
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2… | ||||
| CVE-2025-10148US | — | — | ||
curl's WebSocket code did not update the 32-bit mask pattern for each new
outgoing frame as the specification says. Instead it used a fixed mask that
persisted and was used through… | ||||
| CVE-2025-2783US | —OT critical | KEV | ||
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malic… | ||||
| CVE-2024-11053US | — | — | ||
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circ… | ||||
| CVE-2024-47875US | medium6.1 | Exploit | ||
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and… | ||||
references
External citations — patches, advisories, analysis.
- SSA-212953: Multiple Vulnerabilities in COMOS - CSAF Versionself
- SSA-212953: Multiple Vulnerabilities in COMOS - HTML Versionself
- ICS Advisory ICSA-26-043-03 JSONself
- ICS Advisory ICSA-26-043-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (10)
- FixedCOMOS V10.4
Update to V10.4.5 or later version
https://support.sw.siemens.com/product/222981661/ - FixedCOMOS V10.4
Update to V10.4.5 or later version
https://support.sw.siemens.com/product/222981661/ - FixedCOMOS V10.4.5
Contact customer support to receive patch and update information
- FixedCOMOS V10.4.5
Contact customer support to receive patch and update information
- FixedCOMOS V10.5
Update to V10.5.2 or later version
https://support.sw.siemens.com/product/222981661/ - FixedCOMOS V10.5
Update to V10.5.2 or later version
https://support.sw.siemens.com/product/222981661/ - FixedCOMOS V10.6
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/ - FixedCOMOS V10.6
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/ - FixedCOMOS V10.6
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/ - FixedCOMOS V10.6
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan