NLIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Kwetsbaarheden verholpen in Siemens-producten
Advisory ansehen veröffentlicht 2026-10-13
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS.
01
beschreibt (41)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-89208DE | medium5.3 | — | ||
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions… | ||||
| CVE-2026-89206DE | medium6.3 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify th… | ||||
| CVE-2026-89205DE | medium6.3 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule… | ||||
| CVE-2026-89204DE | medium5.4 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. Th… | ||||
| CVE-2026-89203DE | medium4.3 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to ret… | ||||
| CVE-2026-89202DE | medium6.5 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. Th… | ||||
| CVE-2026-89201DE | high7.5 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names proce… | ||||
| CVE-2026-89200DE | medium6.7 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom… | ||||
| CVE-2026-89199DE | high8.8 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific data… | ||||
| CVE-2026-89198DE | high8.8 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to th… | ||||
| CVE-2026-89197DE | high8.8 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification cond… | ||||
| CVE-2026-89196DE | high8.8 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the… | ||||
| CVE-2026-85115DE | medium5.5 | — | ||
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords… | ||||
| CVE-2026-85114DE | high7.5 | — | ||
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received… | ||||
| CVE-2026-78557DE | high8.3 | — | ||
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend b… | ||||
| CVE-2026-78556DE | high7.4 | — | ||
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiati… | ||||
| CVE-2026-72895DE | high7.7 | — | ||
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G… | ||||
| CVE-2026-63357DE | medium6.1 | — | ||
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page.
This could allow an attacke… | ||||
| CVE-2026-63356DE | medium6.1 | — | ||
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.
This could all… | ||||
| CVE-2026-63355DE | medium6.1 | — | ||
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.
This could allow an atta… | ||||
20 von 41 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan