CVE-2026-41080
lowPriorität · verfolgen · 0EPSS 0.004 · 34. PerzentilDEEUFRUSEPSS · bewertet 2026-10-27
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)siemens_psirt
Update to V3.1.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)siemens_psirt
Update to V3.1.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)siemens_psirt
Update to V3.1.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)siemens_psirt
Update to V3.1.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)siemens_psirt
Update to V3.1.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)siemens_psirt
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
- MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)siemens_psirt
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
- MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)siemens_psirt
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
- MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)siemens_psirt
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
- MitigationSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)siemens_psirt
Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2.9–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (24)
Betroffene Produkte und Versionsbereiche.
- IBM Business Automation Workflow 24.0.0-24.0.1alle Versionencert_bundDEcpe:/a:ibm:business_automation_workflow:24.0.0_-_24.0.1
- IBM Business Automation Workflow 25.0.0-25.0.1alle Versionencert_bundDEcpe:/a:ibm:business_automation_workflow:25.0.0_-_25.0.1
- IBM DevOps Code ClearCase 11.0.0-11.0.0.05alle Versionencert_bundDEcpe:/a:ibm:devops_code_clearcase:11.0.0_-_11.0.0.05
- IBM Rational ClearCase 10.0.0-10.0.1.05alle Versionencert_bundDEcpe:/a:ibm:rational_clearcase:10.0.0_-_10.0.1.05
- IBM Rational ClearCase 9.1.0-9.1.0.10alle Versionencert_bundDEcpe:/a:ibm:rational_clearcase:9.1.0_-_9.1.0.10
- IBM Rational ClearQuest 10.0-10.0.10alle Versionencert_bundDEcpe:/a:ibm:rational_clearquest:10.0_-_10.0.10
- IBM Rational ClearQuest 9.1-9.1.0.11alle Versionencert_bundDEcpe:/a:ibm:rational_clearquest:9.1_-_9.1.0.11
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)≤ vers:intdot/>=3.1.5|<3.1.6siemens_psirtDE
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-082556SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.52025-06-10csaf · siemens_psirtDE
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113.
- WID-SEC-W-2026-1159expat: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-04-16csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
auch bekannt als (2)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2026-41080cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-41080cnnvd
- https://blog.hartwork.org/posts/expat-2-8-0-released/enisa_euvd
- https://github.com/libexpat/libexpat/issues/47enisa_euvd
- https://github.com/libexpat/libexpat/pull/1183enisa_euvd
- https://www.openwall.com/lists/oss-security/2026/04/26/1enisa_euvd
- http://www.openwall.com/lists/oss-security/2026/04/26/1Mailing Listnvd
- https://blog.hartwork.org/posts/expat-2-8-0-released/Release Notesnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan