Siemens

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Siemens product.

RSS Feeds for Siemens security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Siemens products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Siemens Sorted by Most Security Vulnerabilities since 2018

Siemens Teamcenter Visualization178 vulnerabilities

Siemens Jt2go140 vulnerabilities

Siemens Telecontrol Server Basic77 vulnerabilities

Siemens Tecnomatix Plant Simulation76 vulnerabilities

Siemens Solid Edge75 vulnerabilities

Siemens Simcenter Femap69 vulnerabilities

Siemens Sinema Remote Connect Server68 vulnerabilities

Siemens Parasolid48 vulnerabilities

Siemens Solid Edge Se202336 vulnerabilities

Siemens Sinec Ins35 vulnerabilities

Siemens Sinec Nms35 vulnerabilities

Siemens Jt Utilities32 vulnerabilities

Siemens Comos29 vulnerabilities

Siemens Jt Open Toolkit29 vulnerabilities

Siemens Simatic Pcs Neo29 vulnerabilities

Siemens Simatic Wincc27 vulnerabilities

Siemens Simatic Pcs 725 vulnerabilities

Siemens Solid Edge Se202419 vulnerabilities

Siemens Tecnomatix19 vulnerabilities

Siemens Ruggedcom Crossbow16 vulnerabilities

Siemens Simatic Rtls Locating Manager16 vulnerabilities

Siemens Simatic S7 1500 Software Controller16 vulnerabilities

Siemens Sinec Traffic Analyzer15 vulnerabilities

Siemens Simatic Step 714 vulnerabilities

Siemens Simatic Wincc Runtime Advanced13 vulnerabilities

Siemens Spectrum Power 413 vulnerabilities

Siemens Sicam Paspqs12 vulnerabilities

Siemens Scalance Lpe9403 Firmware12 vulnerabilities

Siemens Qms Automotive11 vulnerabilities

Siemens Sinema Server11 vulnerabilities

Siemens Sipass Integrated10 vulnerabilities

Siemens Totally Integrated Automation Portal10 vulnerabilities

Siemens Opcenter Quality10 vulnerabilities

Siemens Simatic S7 Plcsim Advanced9 vulnerabilities

Siemens Simatic Wincc Runtime Professional9 vulnerabilities

Siemens Sinec Network Management System8 vulnerabilities

Siemens Simatic Cn 41007 vulnerabilities

Siemens Spectrum Power 77 vulnerabilities

Siemens Sinema Remote Connect Client7 vulnerabilities

Siemens Opcenter Execution Foundation7 vulnerabilities

Siemens Automation License Manager6 vulnerabilities

Siemens Simatic Route Control5 vulnerabilities

Siemens Sinumerik Integrate Runmyhmi Automotive5 vulnerabilities

Siemens Polarion Alm5 vulnerabilities

Siemens Simatic Batch5 vulnerabilities

Siemens Solid Edge Se20225 vulnerabilities

Siemens Questa4 vulnerabilities

Siemens Desigo Cc4 vulnerabilities

Siemens Sinec Security Monitor4 vulnerabilities

Siemens Location Intelligence4 vulnerabilities

Siemens Mendix4 vulnerabilities

Siemens Modelsim4 vulnerabilities

Siemens Omnivise T3000 Application Server4 vulnerabilities

Siemens Tia Administrator4 vulnerabilities

Siemens Openpcs 74 vulnerabilities

Siemens Logo3 vulnerabilities

Known Exploited Siemens Vulnerabilities

The following Siemens vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability	An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. CVE-2016-8562 Exploit Probability: 14.6%	March 3, 2022

By the Year

In 2025 there have been 142 vulnerabilities in Siemens with an average score of 7.9 out of ten. Last year, in 2024 Siemens had 212 security vulnerabilities published. Right now, Siemens is on track to have less security vulnerabilities in 2025 than it did last year. However, the average CVE base score of the vulnerabilities in 2025 is greater by 0.51.

Year	Vulnerabilities	Average Score
2025	142	7.93
2024	212	7.42
2023	189	7.58
2022	214	7.40
2021	306	7.17
2020	66	6.81
2019	116	7.73
2018	24	7.28

It may take a day or so for new Siemens vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Siemens Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-40827	Nov 11, 2025	DLL Hijack in Siemens Software Center < v3.5 & Solid Edge SE2025 < v225.0 A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). The affected application is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code via placing a crafted DLL file on the system.	Solid Edge
CVE-2025-40817	Nov 11, 2025	SIPLUS LOGO! Time Sync Manipulation (Unauth Remote) A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to change time of the device, which means the device could behave differently.	Logo
CVE-2025-40816	Nov 11, 2025	LOGO! Unauth Remote IP Config Manipulation (DoS) A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable.	Logo
CVE-2025-40815	Nov 11, 2025	LOGO! Routers Buffer Overflow via Malformed TCP Packets A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not properly validate the structure of TCP packets in several methods. This could allow an attacker to cause buffer overflows, get control over the instruction counter and run custom code.	Logo
CVE-2025-40763	Nov 11, 2025	Altair Grid Engine <2026.0.0: Path Hijack via ENV Var in Shared Lib Loading A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution. This could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.	Altair Grid Engine
CVE-2025-40760	Nov 11, 2025	Altair Grid Engine V2025: Password Hash Disclosure via Error Message A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests. This could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.	Altair Grid Engine
CVE-2025-40744	Nov 11, 2025	Solid Edge SE2025 <V225.0 U11: Unauth MITM via License Service Cert Validation A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.	Solid Edge
CVE-2024-32014	Nov 11, 2025	Spectrum Power 4 < V4.70 SP12 Update2: DB alter admin privilege escalation A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to alter the local database which contains the application credentials. This allows an attacker to gain administrative application privileges.	Spectrum Power 4
CVE-2024-32011	Nov 11, 2025	Spectrum Power 4 UI cmd exec <v4.70 SP12 U2 A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user.	Spectrum Power 4
CVE-2024-32010	Nov 11, 2025	World-readable cred file in Spectrum Power 4 <4.70 SP12U2 allows DB creds exfil A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run system commands via the database.	Spectrum Power 4
CVE-2024-32009	Nov 11, 2025	Spectrum Power 4 V4.70 SP12 Update 2 LPriv Esc via Binary Permissions A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to wrongly set permissions to a binary which allows any local attacker to gain administrative privileges.	Spectrum Power 4
CVE-2024-32008	Nov 11, 2025	Spectrum Power 4 Local Priv Esc via Debug Interf ( V4.70 SP12U2) A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to an exposed debug interface on the localhost. This allows any local user to gain code execution as administrative application user.	Spectrum Power 4
CVE-2025-40812	Oct 14, 2025	Solid Edge SE2024/2025 OOB Read in PRT parser (224.0U14/225.0U6) A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.	Solid Edge Se2024 Solid Edge
CVE-2025-40811	Oct 14, 2025	OOB Read in Solid Edge PRT Parser (SE2024/SE2025 < V224/V225) A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.	Solid Edge Se2024 Solid Edge
CVE-2025-40810	Oct 14, 2025	Solid Edge SE2024/2025 OOB Write in PRT Parser (V224.0 < u14, V225.0 < u6) A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.	Solid Edge Se2024 Solid Edge
CVE-2025-40809	Oct 14, 2025	Solid Edge SE2024/25 OOB Write in PRT File Parsing (All V < 224.0U14, 225.0U6) A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.	Solid Edge Se2024 Solid Edge
CVE-2025-40774	Oct 14, 2025	SiPass Integrated < V3.0 Admin Priv Esc Allows Password Retrieval A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. Decryption keys are accessible to users with administrative privileges, allowing them to recover passwords. Successful exploitation of this vulnerability allows an attacker to obtain and use valid user passwords. This can lead to unauthorized access to user accounts, data breaches, and potential system compromise.	Sipass Integrated
CVE-2025-40773	Oct 14, 2025	SiPass Integrated < V3.0 Broken Access Control in API A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request. Successful exploitation allows an attacker to potentially manipulate data belonging to other users.	Sipass Integrated
CVE-2025-40772	Oct 14, 2025	SiPass Integrated XSS Vulnerability (All < V3.0) allows Session Theft A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-Site Scripting (XSS), allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation allows an attacker to impersonate other users within the application and steal their session data. This could enable unauthorized access to accounts and potentially lead to privilege escalation.	Sipass Integrated Sipass
CVE-2025-40771	Oct 14, 2025	SIMATIC CP-1542SP-1 firmware <v2.4.24 remote config auth bypass A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.4.24). Affected devices do not properly authenticate configuration connections. This could allow an unauthenticated remote attacker to access the configuration data.	Simatic Siplus
CVE-2025-40765	Oct 14, 2025	Info Disclosure in TeleControl Server Basic V3.1.1: Hash Leak (CVE-2025-40765) A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service.	Telecontrol Server Basic
CVE-2025-40755	Oct 14, 2025	SINEC NMS <4.0 SP1 SQLi in getTotalAndFilterCounts Endpoint A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP1). Affected applications are vulnerable to SQL injection through getTotalAndFilterCounts endpoint. An authenticated low privileged attacker could exploit to insert data and achieve privilege escalation. (ZDI-CAN-26570)	Sinec Nms
CVE-2011-20002	Oct 14, 2025	SIMATIC S7-1200 CPU V1/V2 <V2.0.2 CaptureReplay Vulnerability A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. SIPLUS variants) (All versions < V2.0.2), SIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants) (All versions < V2.0.2). Affected controllers are vulnerable to capture-replay in the communication with the engineering software. This could allow an on-path attacker between the engineering software and the controller to execute any previously recorded commands at a later time (e.g. set the controller to STOP), regardless whether or not the controller had a password configured.	Simatic Siplus
CVE-2011-20001	Oct 14, 2025	SIMATIC S7-1200 CPU Web Interface DoS before V2.0.3 A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. SIPLUS variants) (All versions < V2.0.3), SIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants) (All versions < V2.0.3). The web server interface of affected devices improperly processes incoming malformed HTTP traffic at high rate. This could allow an unauthenticated remote attacker to force the device entering the stop/defect state, thus creating a denial of service condition.	Simatic Siplus
CVE-2025-40798	Sep 09, 2025	SIMATIC PCS neo OOB Read in UMC Leads to DoS (All Versions) A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.	Simatic Pcs Neo
CVE-2025-40797	Sep 09, 2025	SIMATIC PCS neo OOB Read in UMC before v2.15.1.3 leads to DoS A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.	Simatic Pcs Neo
CVE-2025-40796	Sep 09, 2025	SIMATIC PCS neo AOB Read in UMC Causing DoS (All versions < V2.15.1.3) A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.	Simatic Pcs Neo
CVE-2025-40795	Sep 09, 2025	Stack Buffer Overflow in SIMATIC PCS neo UMC (preV2.15.1.3) A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a stack-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition.	Simatic Pcs Neo
CVE-2025-40762	Aug 12, 2025	Simcenter Femap V2406/V2412 OOB Write via STP Parse A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All versions < V2412.0002). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted STP file. This could allow an attacker to execute code in the context of the current process.(ZDI-CAN-26692)	Simcenter Femap
CVE-2025-40751	Aug 12, 2025	SIMATIC RTLS v<3.3 Credential Leak Escalates to SystemAdmin A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.	Simatic Rtls Locating Manager
CVE-2025-40746	Aug 12, 2025	SIMATIC RTLS Locating Manager RCE in backup script (pre-3.2) A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup script. This could allow an authenticated remote attacker with high privileges in the application to execute arbitrary code with 'NT Authority/SYSTEM' privileges.	Simatic Rtls Locating Manager
CVE-2025-30034	Aug 12, 2025	SIMATIC RTLS Locating Manager <3.3 Local Loopback DoS A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input sent to its listening port on the local loopback interface. This could allow an unauthenticated local attacker to cause a denial of service condition.	Simatic Rtls Locating Manager
CVE-2025-40764	Aug 12, 2025	OOB Read RCE in Simcenter Femap < V2406.0003 / < V2412.0002 A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All versions < V2412.0002). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2025-40766	Aug 12, 2025	SINEC Traffic Analyzer (<V3.0): DoS via Missing Container Limits A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers without adequate resource and security limitations. This could allow an attacker to perform a denial-of-service (DoS) attack.	Sinec Traffic Analyzer
CVE-2025-40768	Aug 12, 2025	Unauthorized Access via Exposed Service Port (SINEC Traffic Analyzer <V3.0) A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application.	Sinec Traffic Analyzer
CVE-2025-40767	Aug 12, 2025	Docker Container Breakout RCE in SINEC Traffic Analyzer <V3.0 A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers without adequate security controls to enforce isolation. This could allow an attacker to gain elevated access, potentially accessing sensitive host system resources.	Sinec Traffic Analyzer
CVE-2025-40759	Aug 12, 2025	SIMATIC RCE via Type Confusion (CVE-2025-40759) A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions < V20 Update 4), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMATIC WinCC V20 (All versions < V20 Update 4), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1), TIA Portal Cloud V20 (All versions < V5.2.2.2). Affected products do not properly sanitize stored security properties when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.	Simatic Step 7 Simatic Wincc
CVE-2025-40584	Aug 12, 2025	SIMOTION SCOUT & SINAMICS STARTER XXE v5.x A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions < V5.7 HF2). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.
CVE-2025-30033	Aug 12, 2025	DLL Hijacking in Windows Setup Component Enables RCE The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.	Simatic Easie Core Package Simatic Pcs 7 Simatic Pcs Neo And others...
CVE-2024-54678	Aug 12, 2025	Local RCE via Named Pipe in Siemens SIMATIC Control Software A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions < V20 Update 4), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMATIC WinCC V20 (All versions < V20 Update 4), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1), TIA Portal Cloud V20 (All versions < V5.2.2.2), TIA Portal Test Suite V20 (All versions < V20 Update 4). Affected products do not properly sanitize Interprocess Communication input received through a Windows Named Pipe accessible to all local users. This could allow an authenticated local attacker to cause a type confusion and execute arbitrary code within the affected application.	Simatic Pcs Neo Simatic Step 7 Simatic Wincc And others...
CVE-2023-52236	Jul 08, 2025	RUGGEDCOM Legacy Cryptography MITM (All Versions) A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCOM i803 (All versions), RUGGEDCOM M2100 (All versions), RUGGEDCOM M2200 (All versions), RUGGEDCOM M969 (All versions), RUGGEDCOM RMC30 (All versions), RUGGEDCOM RMC8388 V4.X (All versions), RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RP110 (All versions), RUGGEDCOM RS1600 (All versions), RUGGEDCOM RS1600F (All versions), RUGGEDCOM RS1600T (All versions), RUGGEDCOM RS400 (All versions), RUGGEDCOM RS401 (All versions), RUGGEDCOM RS416 (All versions), RUGGEDCOM RS416P (All versions), RUGGEDCOM RS416Pv2 V4.X (All versions), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.0), RUGGEDCOM RS416v2 V4.X (All versions), RUGGEDCOM RS416v2 V5.X (All versions < V5.10.0), RUGGEDCOM RS8000 (All versions), RUGGEDCOM RS8000A (All versions), RUGGEDCOM RS8000H (All versions), RUGGEDCOM RS8000T (All versions), RUGGEDCOM RS900 (All versions), RUGGEDCOM RS900 (32M) V4.X (All versions), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RS900G (All versions), RUGGEDCOM RS900G (32M) V4.X (All versions), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RS900GP (All versions), RUGGEDCOM RS900L (All versions), RUGGEDCOM RS900M-GETS-C01 (All versions), RUGGEDCOM RS900M-GETS-XX (All versions), RUGGEDCOM RS900M-STND-C01 (All versions), RUGGEDCOM RS900M-STND-XX (All versions), RUGGEDCOM RS900W (All versions), RUGGEDCOM RS910 (All versions), RUGGEDCOM RS910L (All versions), RUGGEDCOM RS910W (All versions), RUGGEDCOM RS920L (All versions), RUGGEDCOM RS920W (All versions), RUGGEDCOM RS930L (All versions), RUGGEDCOM RS930W (All versions), RUGGEDCOM RS940G (All versions), RUGGEDCOM RS969 (All versions), RUGGEDCOM RSG2100 (All versions), RUGGEDCOM RSG2100 (32M) V4.X (All versions), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RSG2100P (All versions), RUGGEDCOM RSG2100P (32M) V4.X (All versions), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RSG2200 (All versions), RUGGEDCOM RSG2288 V4.X (All versions), RUGGEDCOM RSG2288 V5.X (All versions < V5.10.0), RUGGEDCOM RSG2300 V4.X (All versions), RUGGEDCOM RSG2300 V5.X (All versions < V5.10.0), RUGGEDCOM RSG2300P V4.X (All versions), RUGGEDCOM RSG2300P V5.X (All versions < V5.10.0), RUGGEDCOM RSG2488 V4.X (All versions), RUGGEDCOM RSG2488 V5.X (All versions < V5.10.0), RUGGEDCOM RSG907R (All versions < V5.10.0), RUGGEDCOM RSG908C (All versions < V5.10.0), RUGGEDCOM RSG909R (All versions < V5.10.0), RUGGEDCOM RSG910C (All versions < V5.10.0), RUGGEDCOM RSG920P V4.X (All versions), RUGGEDCOM RSG920P V5.X (All versions < V5.10.0), RUGGEDCOM RSL910 (All versions < V5.10.0), RUGGEDCOM RST2228 (All versions < V5.10.0), RUGGEDCOM RST2228P (All versions < V5.10.0), RUGGEDCOM RST916C (All versions < V5.10.0), RUGGEDCOM RST916P (All versions < V5.10.0). The affected products support insecure cryptographic algorithms. An attacker could leverage these legacy algorithms to achieve a man-in-the-middle attack or impersonate communicating parties.
CVE-2025-40739	Jul 08, 2025	Out-of-Bounds Read in Solid Edge SE2025 < V225.0 Update 5 Enables Code Exec A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2025-40571	May 13, 2025	Mendix OIDC SSO <4.1 Privilege Escalation via Admin Token Access A vulnerability has been identified in Mendix OIDC SSO (Mendix 10 compatible) (All versions < V4.1.0), Mendix OIDC SSO (Mendix 10.12 compatible) (All versions < V4.0.1), Mendix OIDC SSO (Mendix 9 compatible) (All versions < V3.3.0). The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development.
CVE-2025-40575	May 13, 2025	SCALANCE LPE9403 <V4.0 HF0 Profinet Crash (RCE) A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process.	Scalance Lpe9403 Firmware
CVE-2025-40583	May 13, 2025	SCALANCE LPE9403 SINEMA RC Edge Client Cleartext Data Leak A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices do transmit sensitive information in cleartext. This could allow a privileged local attacker to retrieve this sensitive information.	Scalance Lpe9403 Firmware
CVE-2025-40572	May 13, 2025	SCALANCE LPE9403 (<V4.0) Local Priv Escalation via Improper Permissions A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permissions to critical ressources. This could allow a non-privileged local attacker to access sensitive information stored on the device.	Scalance Lpe9403 Firmware
CVE-2025-40581	May 13, 2025	SCALANCE LPE9403 SINEMA Remote Connect Edge Client Auth Bypass A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices are vulnerable to an authentication bypass. This could allow a non-privileged local attacker to bypass the authentication of the SINEMA Remote Connect Edge Client, and to read and modify the configuration parameters.	Scalance Lpe9403 Firmware
CVE-2025-40579	May 13, 2025	SCALANCE LPE9403 < V4.0 HF0 Stack Buffer Overflow A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to a stack-based buffer overflow. This could allow a non-privileged local attacker to execute arbitrary code on the device or to cause a denial of service condition.	Scalance Lpe9403 Firmware
CVE-2025-40580	May 13, 2025	SCALANCE LPE9403 V<4.0 HF0: Stack-Based Buffer Overflow Exploit A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to a stack-based buffer overflow. This could allow a non-privileged local attacker to execute arbitrary code on the device or to cause a denial of service condition.	Scalance Lpe9403 Firmware
CVE-2025-40578	May 13, 2025	SCALANCE LPE9403 DCPD Crash via Rapid Profinet Packets A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions). Affected devices do not properly handle multiple incoming Profinet packets received in rapid succession. An unauthenticated remote attacker can exploit this flaw by sending multiple packets in a very short time frame, which leads to a crash of the dcpd process.	Scalance Lpe9403 Firmware