CVE-2023-4807

highpriority · track · 32EPSS 0.016 · 75 %ileDEEUNLRUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.58% (75th) EPSS
CVSS 7.8 · high
Is it mine?
216 products
Check your exposure
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-22

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSIMATIC RTLS Locating Manager (6GT2780-0DA00)siemens_psirt

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-0DA10)siemens_psirt

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-0DA20)siemens_psirt

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-0DA30)siemens_psirt

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-1EA10)siemens_psirt

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-1EA20)siemens_psirt

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-1EA30)siemens_psirt

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIDIS Primesiemens_psirt

    Update to V4.0.700 or later version

  • FixedSINEC NMSsiemens_psirt

    Update to V3.0 SP1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109974917/
  • FixedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedTeleControl Server Basic V3siemens_psirt

    Update to V3.1.2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109955177/
  • FixedSINEC INSsiemens_psirt

    Update to V1.0 SP2 Update 3 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109975745/
  • Fixedphoenix_contact_psirt

    Update to the latest 2024.0.6 LTS Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.

  • FixedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC RTLS Locating Manager (6GT2780-0DA00)cisa_csaf_ot

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-0DA10)cisa_csaf_ot

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-0DA20)cisa_csaf_ot

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-0DA30)cisa_csaf_ot

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-1EA10)cisa_csaf_ot

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-1EA20)cisa_csaf_ot

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedSIMATIC RTLS Locating Manager (6GT2780-1EA30)cisa_csaf_ot

    Update to V3.0.1.1 or later version The update is available from Siemens Online Software Delivery (OSD).

  • FixedAnalytiXcisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedAnalytiXcisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedGENESIS64cisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedGENESIS64cisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedHyper Historiancisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedHyper Historiancisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedICONICS Suitecisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedICONICS Suitecisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedMobileHMIcisa_csaf_ot

    Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information, refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities. The latest white papers can be found at "https://iconics.com/About/Security/CERT".

    https://iconics.com/About/Security/CERT
  • FixedMobileHMIcisa_csaf_ot

    Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link "https://iconicsinc.my.site.com/community/s/iconics-software/ICONICS_Software__c/00BQQ000008P51V2AS?ICONICS_Software__c-filterId=Product_Version_10_97_3". For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf".

    https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-004_en.pdf
  • FixedSINEC NMScisa_csaf_ot

    Update to V3.0 SP1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109974917/
  • FixedSINEC INScisa_csaf_ot

    Update to V1.0 SP2 Update 3 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109975745/
  • FixedSIDIS Primecisa_csaf_ot

    Update to V4.0.700 or later version

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA00)siemens_psirt

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA10)siemens_psirt

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA20)siemens_psirt

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA30)siemens_psirt

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-1EA10)siemens_psirt

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-1EA20)siemens_psirt

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-1EA30)siemens_psirt

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA00)cisa_csaf_ot

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA10)cisa_csaf_ot

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA20)cisa_csaf_ot

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA30)cisa_csaf_ot

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-1EA10)cisa_csaf_ot

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-1EA20)cisa_csaf_ot

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationSIMATIC RTLS Locating Manager (6GT2780-1EA30)cisa_csaf_ot

    Apply security hardening of the Windows Server, where the RTLS Locating Manager is installed on, in accordance with your corporate security policies or up-to-date hardening guidelines

  • MitigationAnalytiXcisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolating them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.

  • MitigationGENESIS64cisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolating them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.

  • MitigationHyper Historiancisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolating them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.

  • MitigationICONICS Suitecisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolating them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.

  • MitigationMobileHMIcisa_csaf_ot

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend locating control system networks and devices behind firewalls and isolating them from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.

  • MitigationMELSOFT MaiLab SW1DND-MAILAB-Mcisa_csaf_ot

    Do not click on web links in emails or other messages from untrusted sources. Also, do not open attachments from untrusted emails.

  • MitigationMELSOFT MaiLab SW1DND-MAILABPR-Mcisa_csaf_ot

    Do not click on web links in emails or other messages from untrusted sources. Also, do not open attachments from untrusted emails.

  • MitigationMELSOFT VIXIO SW1DND-AIVIIN-Mcisa_csaf_ot

    Do not click on web links in emails or other messages from untrusted sources. Also, do not open attachments from untrusted emails.

  • MitigationMELSOFT VIXIO SW1DND-AIVILE-Mcisa_csaf_ot

    Do not click on web links in emails or other messages from untrusted sources. Also, do not open attachments from untrusted emails.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–7.8

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US
v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.8 · impact 5.9
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE
v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20USCWE-20USCWE-347USCWE-440USCWE-440USCWE-440USCWE-440US
05

affected products (216)

Products and version ranges known to be affected.

showing 20 of 216
06

advisories (20)

Vendor and ecosystem advisories describing this.

  • NCSC-2024-0433Kwetsbaarheden verholpen in Siemens productenNL2024-11-12csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDCOM, SCALANCE, SIMATIC en SINEC.

  • NCSC-2025-0106Kwetsbaarheden verholpen in Siemens productenNL2025-04-08csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als Industrial Edge Devices, Mendix, SENTRON, SIDIS, SIMATIC, SIPLUS,Insights Hub Private Cloud, Siemens License Server en Solid Edge.

  • SSA-093430SSA-093430: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager before V3.02024-05-14csaf · siemens_psirtDE

    Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version.

  • SSA-277137SSA-277137: Multiple Vulnerabilities in SIDIS Prime Before V4.0.7002025-04-08csaf · siemens_psirtDE

    SIDIS Prime before V4.0.700 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, Boost C++ Libraries and several Microsoft components as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.

  • SSA-331112SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP12024-11-12csaf · siemens_psirtDE

    SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.

  • SSA-398330SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.52023-12-12csaf · siemens_psirtDE

    Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update to the latest versions. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 are no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 (https://cert-portal.siemens.com/productcert/html/ssb-439005.html).

  • SSA-556635SSA-556635: Multiple Vulnerabilities in Telecontrol Server Basic before V3.1.2.02024-04-09csaf · siemens_psirtDE

    Siemens has released a new version for Telecontrol Server Basic that fixes multiple vulnerabilities.

  • SSA-915275SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 32024-11-12csaf · siemens_psirtDE

    SINEC INS before V1.0 SP2 Update 3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC INS and recommends to update to the latest version.

  • VDE-2024-073Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware2024-12-09csaf · phoenix_contact_psirtDE

    Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2024.0.6 LTS

  • WID-SEC-W-2023-2298OpenSSL: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-09-10csaf · cert_bundDE

    Ein Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.

  • WID-SEC-W-2024-0053Dell BIOS: Mehrere SchwachstellenDeutsch2024-01-09csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen im Dell BIOS ausnutzen, um vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.

  • WID-SEC-W-2024-0893Oracle PeopleSoft: Mehrere SchwachstellenDeutsch2024-04-16csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Oracle PeopleSoft ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2024-1591Juniper JUNOS: Mehrere SchwachstellenDeutsch2024-07-10csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.

  • ICSA-23-348-10Siemens SIMATIC S7-15002023-12-12icsa · cisa_csaf_otUS

    Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update to the latest versions. Note: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 ( https://cert-portal.siemens.com/productcert/html/ssb-439005.html).

  • ICSA-24-137-07Siemens SIMATIC RTLS Locating Manager2024-05-14icsa · cisa_csaf_otUS

    Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version.

  • ICSA-24-184-03Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update E)2024-06-27icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could result in denial-of-service, improper privilege management, or potentially arbitrary code execution.

  • ICSA-24-200-01Mitsubishi Electric MELSOFT MaiLab and MELSOFT VIXIO (Update A)2024-07-18icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition in the target product.

  • ICSA-24-319-04Siemens SINEC NMS2024-11-12icsa · cisa_csaf_otUS

    SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.

  • ICSA-24-319-08Siemens SINEC INS2024-11-12icsa · cisa_csaf_otUS

    SINEC INS before V1.0 SP2 Update 3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC INS and recommends to update to the latest version.

  • ICSA-25-100-02Siemens SIDIS Prime2025-04-08icsa · cisa_csaf_otUS

    SIDIS Prime before V4.0.700 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, Boost C++ Libraries and several Microsoft components as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundncsc_nlsiemens_psirtphoenix_contact_psirtcisa_csaf_otNVDCVE.orgMITRE
published 2023-09-08modified 2026-10-14
09

references (29)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan