Siemens

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Siemens product.

RSS Feeds for Siemens security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Siemens products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Siemens Sorted by Most Security Vulnerabilities since 2018

Siemens Teamcenter Visualization178 vulnerabilities

Siemens Jt2go140 vulnerabilities

Siemens Solid Edge94 vulnerabilities

Siemens Tecnomatix Plant Simulation93 vulnerabilities

Siemens Telecontrol Server Basic78 vulnerabilities

Siemens Simcenter Femap78 vulnerabilities

Siemens Sinema Remote Connect Server70 vulnerabilities

Siemens Parasolid49 vulnerabilities

Siemens Sinec Nms39 vulnerabilities

Siemens Solid Edge Se202336 vulnerabilities

Siemens Sinec Ins35 vulnerabilities

Siemens Comos31 vulnerabilities

Siemens Simatic Wincc30 vulnerabilities

Siemens Simatic Pcs Neo30 vulnerabilities

Siemens Simatic Pcs 725 vulnerabilities

Siemens Nucleus Readystart V321 vulnerabilities

Siemens Simatic S7 1500 Software Controller19 vulnerabilities

Siemens Solid Edge Se202419 vulnerabilities

Siemens Ruggedcom Crossbow16 vulnerabilities

Siemens Simatic Step 716 vulnerabilities

Siemens Simatic Rtls Locating Manager16 vulnerabilities

Siemens Sinec Traffic Analyzer15 vulnerabilities

Siemens Spectrum Power 413 vulnerabilities

Siemens Simatic Wincc Runtime Advanced13 vulnerabilities

Siemens Simatic Cn 410012 vulnerabilities

Siemens Scalance Lpe9403 Firmware12 vulnerabilities

Siemens Totally Integrated Automation Portal12 vulnerabilities

Siemens Opcenter Quality11 vulnerabilities

Siemens Sipass Integrated10 vulnerabilities

Siemens Simatic S7 Plcsim Advanced9 vulnerabilities

Siemens Simatic Wincc Runtime Professional9 vulnerabilities

Siemens Simatic Net Pc8 vulnerabilities

Siemens Teamcenter8 vulnerabilities

Siemens Spectrum Power 77 vulnerabilities

Siemens Sinema Remote Connect Client7 vulnerabilities

Siemens Sinvrsivms Video Server7 vulnerabilities

Siemens Opcenter Execution Foundation7 vulnerabilities

Siemens Sinec Security Monitor6 vulnerabilities

Siemens Opcenter Intelligence6 vulnerabilities

Siemens Solid Edge Se20225 vulnerabilities

Siemens Polarion Alm5 vulnerabilities

Siemens Simatic Winac Rtx F 20105 vulnerabilities

Siemens Simatic Route Control5 vulnerabilities

Siemens Sinumerik 840d Sl5 vulnerabilities

Siemens Simatic Batch5 vulnerabilities

Siemens Desigo Cc4 vulnerabilities

Siemens Questa4 vulnerabilities

Siemens Location Intelligence4 vulnerabilities

Siemens Modelsim4 vulnerabilities

Siemens Openpcs 74 vulnerabilities

Siemens Omnivise T3000 Application Server4 vulnerabilities

Siemens Tia Administrator4 vulnerabilities

Siemens Cerberus Pro Ul X300 Cloud3 vulnerabilities

Siemens Sinteso Fs20 En Fire Panel Fc203 vulnerabilities

Siemens Desigo Fire Safety Ul Compact Panel3 vulnerabilities

Siemens Desigo Fire Safety Ul Engineering Tool3 vulnerabilities

Siemens Logo3 vulnerabilities

Known Exploited Siemens Vulnerabilities

The following Siemens vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability	An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. CVE-2016-8562 Exploit Probability: 14.6%	March 3, 2022

By the Year

In 2026 there have been 14 vulnerabilities in Siemens with an average score of 7.8 out of ten. Last year, in 2025 Siemens had 170 security vulnerabilities published. Right now, Siemens is on track to have less security vulnerabilities in 2026 than it did last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.14.

Year	Vulnerabilities	Average Score
2026	14	7.81
2025	170	7.67
2024	216	7.43
2023	189	7.57
2022	227	7.42
2021	307	7.16
2020	77	6.56
2019	119	7.52
2018	29	7.47

It may take a day or so for new Siemens vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Siemens Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-25656	Feb 10, 2026	SINEC NMS UMC <V2.15.2.1 Config Mod Allow DLL Exec (SYSTEM) A vulnerability has been identified in SINEC NMS (All versions), User Management Component (UMC) (All versions < V2.15.2.1). The affected application permits improper modification of a configuration file by a low-privileged user. This could allow an attacker to load malicious DLLs, potentially leading to arbitrary code execution with SYSTEM privileges.(ZDI-CAN-28108)	Sinec Nms
CVE-2026-25655	Feb 10, 2026	SINEC NMS < V4.0 SP2: Config File Alteration Allows DLL-Aided Code Exec A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper modification of a configuration file by a low-privileged user. This could allow an attacker to load malicious DLLs, potentially leading to arbitrary code execution with administrative privilege.(ZDI-CAN-28107)	Sinec Nms
CVE-2026-23720	Feb 10, 2026	OOB Read in Simcenter Femap/Nastran NDB Parser Enables Code Exec A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-23719	Feb 10, 2026	Heap Bf Overflow in Simcenter Femap/Nastran NDB Parser (CVE-2026-23719) A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-23718	Feb 10, 2026	Simcenter Femap/Nastran OOB Read in NDB Parsing Enables Code Execution A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-23717	Feb 10, 2026	Simcenter Femap/Nastran OOB Read via XDB Parsing Enables Code Exec A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-23716	Feb 10, 2026	Simcenter Femap/Nastran OOB Read in XDB Parsing Enables Code Exec A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-23715	Feb 10, 2026	Simcenter Femap/Nastran OOB write in XDB parsing A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds write vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-22923	Feb 10, 2026	Local Data Validation Flaw in NX PDF Export Arbitrary Code Exec A vulnerability has been identified in NX (All versions < V2512). The affected application contains a data validation vulnerability that could allow an attacker with local access to interfere with internal data during the PDF export process that could potentially lead to arbitrary code execution.	Nx
CVE-2025-40587	Feb 10, 2026	Polarion XSS via Document Titles v2404/v2410 (before V2404.5/V2410.2) A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2). The affected application allows arbitrary JavaScript code be included in document titles. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by creating specially crafted document titles that are later viewed by other users of the application.
CVE-2024-52334	Feb 10, 2026	Password Storage: syngo.plaza VB30E Bypass via Unencrypted Passwords A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwords properly. This could allow an attacker to recover the original passwords and might gain unauthorized access.
CVE-2025-40944	Jan 13, 2026	DoS via S7 Disconnect on Siemens SIMATIC ET 200 series <v6.0 A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (All versions >= V4.2.0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) (All versions), SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) (All versions < V1.3), SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0) (All versions < V6.0.1), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) (All versions >= V4.2.0), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) (All versions < V4.2.2), SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) (All versions), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) (All versions < V6.0.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) (All versions >= V4.2.0), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) (All versions < V6.0.0). Affected devices do not properly handle S7 protocol session disconnect requests. When receiving a valid S7 protocol Disconnect Request (COTP DR TPDU) on TCP port 102, the devices enter an improper session state. This could allow an attacker to cause the device to become unresponsive, leading to a denial-of-service condition that requires a power cycle to restore normal operation.
CVE-2025-40942	Jan 13, 2026	CVE-2025-40942: Local Priv. Escalation in TeleControl Server Basic < 3.1.2.4 A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege escalation vulnerability that could allow an attacker to run arbitrary code with elevated privileges.	Telecontrol Server Basic
CVE-2025-40805	Jan 13, 2026	Siemens Device Bypass Auth on API Endpoints (CVE-2025-40805) Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a legitimate user.
CVE-2025-40829	Dec 12, 2025	Simcenter Femap Uninitialized Memory via SLDPRT (CVE-2025-40829) A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vulnerability while parsing specially crafted SLDPRT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27146)	Simcenter Femap
CVE-2025-40941	Dec 09, 2025	SIMATIC CN 4100 v<4.0.1 Info Disclosure A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its responses. This could allow an attacker with network access to gain useful information, increasing the likelihood of targeted attacks.	Simatic Cn 4100
CVE-2025-40940	Dec 09, 2025	SNMP Disclosure in SIMATIC CN4100 <V4.0.1 A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior, such as unexpected service availability and unreliable configuration handling across protocol versions. This could allow an attacker to access sensitive data, potentially leading to a breach of confidentiality.	Simatic Cn 4100
CVE-2025-40939	Dec 09, 2025	Unauth USB Access Enables Reboot DoS in SIMATIC CN4100 (v<4.0.1) A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device contains a USB port which allows unauthenticated connections. This could allow an attacker with physical access to the device to trigger reboot that could cause denial of service condition.	Simatic Cn 4100
CVE-2025-40938	Dec 09, 2025	Firmware info leak on SIMATIC CN 4100 (<4.0.1) A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the devices confidentiality, integrity, and availability.	Simatic Cn 4100
CVE-2025-40937	Dec 09, 2025	SIMATIC CN 4100 < V4.0.1 Improper REST API Input Allows Authenticated Code Exec A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments. This could allow an authenticated attacker to execute arbitrary code with limited privileges.	Simatic Cn 4100
CVE-2025-40935	Dec 09, 2025	RuggedCOM web TLS cert upload CVE-2025-40935: auth remote crash <v5.10.1 A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.1), RUGGEDCOM RS416v2 V5.X (All versions < V5.10.1), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2288 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300P V5.X (All versions < V5.10.1), RUGGEDCOM RSG2488 V5.X (All versions < V5.10.1), RUGGEDCOM RSG907R (All versions < V5.10.1), RUGGEDCOM RSG908C (All versions < V5.10.1), RUGGEDCOM RSG909R (All versions < V5.10.1), RUGGEDCOM RSG910C (All versions < V5.10.1), RUGGEDCOM RSG920P V5.X (All versions < V5.10.1), RUGGEDCOM RSL910 (All versions < V5.10.1), RUGGEDCOM RST2228 (All versions < V5.10.1), RUGGEDCOM RST2228P (All versions < V5.10.1), RUGGEDCOM RST916C (All versions < V5.10.1), RUGGEDCOM RST916P (All versions < V5.10.1). Affected devices do not properly validate input during the TLS certificate upload process of the web service. This could allow an authenticated remote attacker to trigger a device crash and reboot, leading to a temporary Denial of Service on the device.
CVE-2025-40831	Dec 09, 2025	SINEC Security Monitor < V4.10.0 Denial of Service via Date Input A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause denial of service condition of the report functionality.	Sinec Security Monitor
CVE-2025-40830	Dec 09, 2025	Auth Bypass in SINEC Security Monitor <4.10.0 ssmctl-client File Transfer A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.	Sinec Security Monitor
CVE-2025-40820	Dec 09, 2025	TCP SeQ Validation Flaw Enables Remote DoS in TCP Services Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.	Sinumerik 840d Sl
CVE-2025-40819	Dec 09, 2025	SINEMA Remote Connect Server < V3.2 SP4: DB License Bypass A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do not properly validate license restrictions against the database, allowing direct modification of the system_ticketinfo table to bypass license limitations without proper enforcement checks. This could allow with database access to circumvent licensing restrictions by directly modifying database values and potentially enabling unauthorized use beyond the permitted scope.	Sinema Remote Connect Server
CVE-2025-40818	Dec 09, 2025	SSL/TLS Key Exposure in SINEMA Remote Connect Server < 3.2 SP4 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.	Sinema Remote Connect Server
CVE-2025-40807	Dec 09, 2025	Gridscale X Prepay <4.2.1 - Auth Token CaptureReplay Vulnerability A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions.
CVE-2025-40806	Dec 09, 2025	Gridscale X Prepay <v4.2.1 User Enumeration Vulnerability A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.
CVE-2025-40801	Dec 09, 2025	SALT SDK TLS Cert Validation Bypass in COMOS, NX, Simcenter, Tecnomatix A vulnerability has been identified in COMOS V10.6 (All versions), COMOS V10.6 (All versions), JT Bi-Directional Translator for STEP (All versions), NX V2412 (All versions < V2412.8900 with Cloud Entitlement (bundled as NX X)), NX V2506 (All versions < V2506.6000 with Cloud Entitlement (bundled as NX X)), Simcenter 3D (All versions < V2506.6000 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Femap (All versions < V2506.0002 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Studio (All versions), Simcenter System Architect (All versions), Tecnomatix Plant Simulation (All versions < V2504.0007). The SALT SDK is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.	Comos Simcenter Femap Tecnomatix Plant Simulation And others...
CVE-2025-40800	Dec 09, 2025	TLS cert validation flaw in Siemens IAM client COMOS V10.6, NX V2412 A vulnerability has been identified in COMOS V10.6 (All versions), COMOS V10.6 (All versions), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.	Comos Simcenter Femap Solid Edge And others...
CVE-2024-56840	Dec 09, 2025	RUGGEDCOM ROX II IPsec code injection < V2.17.0 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). Under certain conditions, IPsec may allow code injection in the affected device. An attacker could leverage this scenario to execute arbitrary code as root user.
CVE-2024-56839	Dec 09, 2025	RUGGEDCOM ROX II <v2.17.0 VRF: Code Injection Root Execution A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). Code injection can be achieved when the affected device is using VRF (Virtual Routing and Forwarding). An attacker could leverage this scenario to execute arbitrary code as root user.
CVE-2024-56838	Dec 09, 2025	RUGGEDCOM ROX II <V2.17.0 SCEP Client Root Code Exec A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). The SCEP client available in the affected device for secure certificate enrollment lacks validation of multiple fields. An attacker could leverage this scenario to execute arbitrary code as root user.
CVE-2024-56837	Dec 09, 2025	Root Shell via Config Validation Flaw before V2.17.0 (RUGGEDCOM ROX II) A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). Due to the insufficient validation during the installation and load of certain configuration files of the affected device, an attacker could spawn a reverse shell and gain root access on the affected system.
CVE-2024-56836	Dec 09, 2025	RuggedCOM ROX II < V2.17.0: DNS Injection Enables Root Shell A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). During the Dynamic DNS configuration of the affected product it is possible to inject additional configuration parameters. Under certain circumstances, an attacker could leverage this vulnerability to spawn a reverse shell and gain root access on the affected system.
CVE-2024-56835	Dec 09, 2025	RUGGEDCOM ROX II <V2.17.0 DHCP Config Code Injection Root Access A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). The DHCP Server configuration file of the affected products is subject to code injection. An attacker could leverage this vulnerability to spawn a reverse shell and gain root access on the affected system.
CVE-2025-40936	Nov 17, 2025	out-of-bounds read in Parasolid IGES Translator < 29.0.258 A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29.0.258), Solid Edge (All versions < V226.00 Update 03). The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS files. This could allow an attacker to crash the application or execute code in the context of the current process. (ZDI-CAN-26755)	Parasolid Solid Edge
CVE-2025-40834	Nov 17, 2025	CVE-2025-40834: XSS in Mendix RichText widget (v4.0.0-4.6.1) A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could allow an attacker to execute cross-site scripting attacks.
CVE-2025-40827	Nov 11, 2025	DLL Hijack in Siemens Software Center < v3.5 & Solid Edge SE2025 < v225.0 A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). The affected application is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code via placing a crafted DLL file on the system.	Solid Edge
CVE-2025-40817	Nov 11, 2025	SIPLUS LOGO! Time Sync Manipulation (Unauth Remote) A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to change time of the device, which means the device could behave differently.	Logo
CVE-2025-40816	Nov 11, 2025	LOGO! Unauth Remote IP Config Manipulation (DoS) A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable.	Logo
CVE-2025-40815	Nov 11, 2025	LOGO! Routers Buffer Overflow via Malformed TCP Packets A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not properly validate the structure of TCP packets in several methods. This could allow an attacker to cause buffer overflows, get control over the instruction counter and run custom code.	Logo
CVE-2025-40763	Nov 11, 2025	Altair Grid Engine <2026.0.0: Path Hijack via ENV Var in Shared Lib Loading A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution. This could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.	Altair Grid Engine
CVE-2025-40760	Nov 11, 2025	Altair Grid Engine V2025: Password Hash Disclosure via Error Message A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests. This could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.	Altair Grid Engine
CVE-2025-40744	Nov 11, 2025	Solid Edge SE2025 <V225.0 U11: Unauth MITM via License Service Cert Validation A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.	Solid Edge
CVE-2024-32014	Nov 11, 2025	Spectrum Power 4 < V4.70 SP12 Update2: DB alter admin privilege escalation A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to alter the local database which contains the application credentials. This allows an attacker to gain administrative application privileges.	Spectrum Power 4
CVE-2024-32011	Nov 11, 2025	Spectrum Power 4 UI cmd exec <v4.70 SP12 U2 A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user.	Spectrum Power 4
CVE-2024-32010	Nov 11, 2025	World-readable cred file in Spectrum Power 4 <4.70 SP12U2 allows DB creds exfil A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run system commands via the database.	Spectrum Power 4
CVE-2024-32009	Nov 11, 2025	Spectrum Power 4 V4.70 SP12 Update 2 LPriv Esc via Binary Permissions A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to wrongly set permissions to a binary which allows any local attacker to gain administrative privileges.	Spectrum Power 4
CVE-2024-32008	Nov 11, 2025	Spectrum Power 4 Local Priv Esc via Debug Interf ( V4.70 SP12U2) A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to an exposed debug interface on the localhost. This allows any local user to gain code execution as administrative application user.	Spectrum Power 4