Siemens ProductCERT (CSAF)
advisoryDEsiemens_psirt
Siemens ProductCERT machine-readable CSAF 2.0 security advisories (SSA-*) for Siemens OT/ICS products.
01
Advisories (858)
Hersteller- und Ökosystem-Meldungen dazu.
02
Produkt-Aussagen (3,935)
Betroffene Produkte und Versionsbereiche.
- Siemens SIMATIC S7-400 CPU 412-1 DP V7 (6ES7412-1XJ07-0AB0)
- Siemens SIMATIC S7-400 CPU 412-2 DP V7 (6ES7412-2XK07-0AB0)
- Siemens SIMATIC S7-400 CPU 412-2 PN/DP V7 (6ES7412-2EK07-0AB0)
- Siemens SIMATIC S7-400 CPU 414-2 DP V7 (6ES7414-2XL07-0AB0)
- Siemens SIMATIC S7-400 CPU 414-3 DP V7 (6ES7414-3XM07-0AB0)
- Siemens SIMATIC S7-400 CPU 414-3 PN/DP V7 (6ES7414-3EM07-0AB0)
- Siemens SIMATIC S7-400 CPU 414F-3 PN/DP V7 (6ES7414-3FM07-0AB0)
- Siemens SIMATIC S7-400 CPU 416-2 DP V7 (6ES7416-2XP07-0AB0)
- Siemens SIMATIC S7-400 CPU 416-3 DP V7 (6ES7416-3XS07-0AB0)
- Siemens SIMATIC S7-400 CPU 416-3 PN/DP V7 (6ES7416-3ES07-0AB0)
- Siemens SIMATIC S7-400 CPU 416F-2 DP V7 (6ES7416-2FP07-0AB0)
- Siemens SIMATIC S7-400 CPU 416F-3 PN/DP V7 (6ES7416-3FS07-0AB0)
- Siemens SIMATIC S7-400 CPU 417-4 DP V7 (6ES7417-4XT07-0AB0)
- Siemens .NET Client Library for SIMATIC S7 Webserver API
- Siemens .NET Client Library for SIMATIC S7 Webserver API < V3.3.61
- Siemens .NET Client Library for SIMATIC S7 Webserver API < V3.3.62
- Siemens AI Lightweight Inference Server
- Siemens AI Model Deployer
- Siemens APOGEE MBC (PPC) (BACnet)
- Siemens APOGEE MBC (PPC) (P2 Ethernet)
20 von 3,935 angezeigt
03
CVE-Verknüpfungen (5,671)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-110936DE | medium | — | ||
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search p… | ||||
| CVE-2026-89208DE | medium | — | ||
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions… | ||||
| CVE-2026-89206DE | medium | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify th… | ||||
| CVE-2026-89205DE | medium | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule… | ||||
| CVE-2026-89204DE | medium | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. Th… | ||||
| CVE-2026-89203DE | medium | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to ret… | ||||
| CVE-2026-89202DE | medium | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. Th… | ||||
| CVE-2026-89201DE | high | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names proce… | ||||
| CVE-2026-89200DE | medium | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom… | ||||
| CVE-2026-89199DE | high | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific data… | ||||
| CVE-2026-89198DE | high | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to th… | ||||
| CVE-2026-89197DE | high | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification cond… | ||||
| CVE-2026-89196DE | high | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the… | ||||
| CVE-2026-85115DE | medium | — | ||
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords… | ||||
| CVE-2026-85114DE | high | — | ||
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received… | ||||
| CVE-2026-78557DE | high | — | ||
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend b… | ||||
| CVE-2026-78556DE | high | — | ||
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiati… | ||||
| CVE-2026-72895DE | high | — | ||
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G… | ||||
| CVE-2026-63357DE | medium | — | ||
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page.
This could allow an attacke… | ||||
| CVE-2026-63356DE | medium | — | ||
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.
This could all… | ||||
20 von 5,671 angezeigt