CVE Intelligence

Siemens vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Siemens products: 316 record(s), with severity, exploitation and fixes.

Sinec Infrastructure Network Services 38Sinema Remote Connect Server 22Solid Edge Se2025 16Simcenter Femap 15SIMATIC S7-PLCSIM Advanced 14SIMATIC S7-1500 CPU 1515-2 PN 14SIMATIC ET 200SP CPU 1512SP F-1 PN 14SIMATIC S7-1500 CPU 1516-3 PN/DP 14SIMATIC ET 200SP CPU 1510SP-1 PN 14SIMATIC S7-1500 CPU 1513-1 PN 14SIMATIC S7-1500 CPU 1511F-1 PN 14SIMATIC S7-1500 CPU 1515F-2 PN 14SIMATIC ET 200SP CPU 1512SP-1 PN 14SIMATIC S7-1500 CPU 1511-1 PN 14SIMATIC ET 200SP CPU 1510SP F-1 PN 14SIMATIC S7-1500 CPU 1516F-3 PN/DP 14Ruggedcom Ape1808 Firmware 13SIPLUS S7-1500 CPU 1516F-3 PN/DP 13SIPLUS S7-1500 CPU 1516-3 PN/DP 13SIPLUS S7-1500 CPU 1513F-1 PN 13SIPLUS ET 200SP CPU 1512SP F-1 PN 13SIPLUS S7-1500 CPU 1513-1 PN 13SIPLUS S7-1500 CPU 1511-1 PN 13SIPLUS S7-1500 CPU 1511F-1 PN 13SIMATIC S7-1500 CPU 1513F-1 PN 13SIMATIC S7-1500 Software Controller CPU 1508S V2 12SIMATIC S7-1500 Software Controller CPU 1508S F V4 12SIPLUS ET 200SP CPU 1512SP-1 PN 12SIMATIC ET 200SP CPU 1514SP-2 PN 12SIMATIC S7-1500 Software Controller CPU 1507S F V3 12SIMATIC S7-1500 Software Controller CPU 1508S V3 12Sinec Ins 12SIMATIC S7-1500 CPU 1518F-4 PN/DP 12SIMATIC S7-1500 CPU 1518-4 PN/DP 12SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 12SIMATIC S7-1500 Software Controller CPU 1508S TF V3 12SIMATIC S7-1500 CPU 1518TF-4 PN/DP 12SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN 12SIMATIC ET 200SP CPU 1514SPT-2 PN 12SIMATIC S7-1500 CPU 1512C-1 PN 12

Exploited only (KEV) →

CVE-2025-59718 Critical · 9.8 KEV High · 69 Public exploit CWE-347 Dec 9, 2025
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
CVE-2025-40941 Medium · 4.3 CWE-200 Dec 9, 2025
Exposure of Sensitive Information in Siemens Simatic Cn 4100 Firmware
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its responses. This could allow an attacker with network access to gain useful information, increasing the likelihood of targeted attacks.
CVE-2025-40940 Medium · 4.9 CWE-200 Dec 9, 2025
Exposure of Sensitive Information in Siemens Simatic Cn 4100 Firmware
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior, such as unexpected service availability and unreliable configuration handling across protocol versions. This could allow an attacker to access sensitive data, potentially leading to a breach of confidentiality.
CVE-2025-40939 Medium · 4.6 CWE-284 Dec 9, 2025
Improper Access Control in Siemens Simatic Cn 4100 Firmware
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device contains a USB port which allows unauthenticated connections. This could allow an attacker with physical access to the device to trigger reboot that could cause denial of service condition.
CVE-2025-40938 Critical · 9.8 CWE-798 Dec 9, 2025
Use of Hard-coded Credentials in Siemens Simatic Cn 4100 Firmware
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability.
CVE-2025-40937 High · 8.8 CWE-77 Dec 9, 2025
Command Injection in Siemens Simatic Cn 4100 Firmware
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments. This could allow an authenticated attacker to execute arbitrary code with limited privileges.
CVE-2025-40935 Medium · 4.3 CWE-20 Dec 9, 2025
Improper Input Validation in Siemens RUGGEDCOM RMC8388 V5.X
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.1), RUGGEDCOM RS416v2 V5.X (All versions < V5.10.1), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2288 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300P V5.X (All versions < V5.10.1), RUGGEDCOM RSG2488 V5.X (All versions < V5.10.1), RUGGEDCOM RSG907R (All versions < V5.10.1), RUGGEDCOM RSG908C (All versions < V5.10.1), RUGGEDCOM RSG909R (All versions < V5.10.1), RUGGEDCOM RSG910C (All versions < V5.10.1), RUGGEDCOM RSG920P V5.X (All versions < V5.10.1), RUGGEDCOM RSL910 (All versions < V5.10.1), RUGGEDCOM RST2228 (All versions < V5.10.1), RUGGEDCOM RST2228P (All versions < V5.10.1), RUGGEDCOM RST916C (All versions < V5.10.1), RUGGEDCOM RST916P (All versions < V5.10.1). Affected devices do not properly validate input during the TLS certificate upload process of the web service. This could allow an authenticated remote attacker to trigger a device crash and reboot, leading to a temporary Denial of Service on the device.
CVE-2025-40831 Medium · 6.5 CWE-20 Dec 9, 2025
Improper Input Validation in Siemens Sinec Security Monitor
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause denial of service condition of the report functionality.
CVE-2025-40830 Medium · 6.7 CWE-285 Dec 9, 2025
Improper Authorization in Siemens Sinec Security Monitor
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.
CVE-2025-40820 High · 7.5 CWE-940 Dec 9, 2025
Affected products do not properly enforce TCP sequence number validation in specific…
Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.
CVE-2025-40819 Medium · 4.3 CWE-863 Dec 9, 2025
Incorrect Authorization in Siemens Sinema Remote Connect Server
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do not properly validate license restrictions against the database, allowing direct modification of the system_ticketinfo table to bypass license limitations without proper enforcement checks. This could allow with database access to circumvent licensing restrictions by directly modifying database values and potentially enabling unauthorized use beyond the permitted scope.
CVE-2025-40818 Low · 3.3 CWE-732 Dec 9, 2025
Incorrect Permission Assignment for Critical Resource in Siemens Sinema Remote Connect Server
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.
CVE-2025-40807 Medium · 5.4 CWE-294 Dec 9, 2025
Authentication Bypass by Capture-replay in Siemens Gridscale X Prepay
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions.
CVE-2025-40806 Medium · 5.3 CWE-204 Dec 9, 2025
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The…
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.
CVE-2025-40801 High · 8.1 CWE-295 Dec 9, 2025
Improper Certificate Validation in Siemens COMOS V10.6
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (All versions < V2412.8900 with Cloud Entitlement (bundled as NX X)), NX V2506 (All versions < V2506.6000 with Cloud Entitlement (bundled as NX X)), Simcenter 3D (All versions < V2506.6000 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Femap (All versions < V2506.0002 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Studio (All versions < V2506.0001), Simcenter System Architect (All versions < V2506.0001), Tecnomatix Plant Simulation (All versions < V2504.0007). The SALT SDK is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
CVE-2025-40800 High · 7.4 CWE-295 Dec 9, 2025
Improper Certificate Validation in Siemens COMOS V10.6
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
CVE-2024-56840 High · 7.2 CWE-74 Dec 9, 2025
Injection in Siemens Ruggedcom Rox Ii Firmware
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). Under certain conditions, IPsec may allow code injection in the affected device. An attacker could leverage this scenario to execute arbitrary code as root user.
CVE-2024-56839 High · 7.2 CWE-74 Dec 9, 2025
Injection in Siemens Ruggedcom Rox Ii Firmware
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). Code injection can be achieved when the affected device is using VRF (Virtual Routing and Forwarding). An attacker could leverage this scenario to execute arbitrary code as root user.
CVE-2024-56838 High · 7.2 CWE-74 Dec 9, 2025
Injection in Siemens Ruggedcom Rox Ii Firmware
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). The SCEP client available in the affected device for secure certificate enrollment lacks validation of multiple fields. An attacker could leverage this scenario to execute arbitrary code as root user.
CVE-2024-56837 High · 7.2 CWE-77 Dec 9, 2025
Command Injection in Siemens Ruggedcom Rox Ii Firmware
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). Due to the insufficient validation during the installation and load of certain configuration files of the affected device, an attacker could spawn a reverse shell and gain root access on the affected system.
CVE-2024-56836 High · 8.8 CWE-77 Dec 9, 2025
Command Injection in Siemens Ruggedcom Rox Ii Firmware
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). During the Dynamic DNS configuration of the affected product it is possible to inject additional configuration parameters. Under certain circumstances, an attacker could leverage this vulnerability to spawn a reverse shell and gain root access on the affected system.
CVE-2024-56835 High · 8.8 CWE-74 Dec 9, 2025
Injection in Siemens Ruggedcom Rox Ii Firmware
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). The DHCP Server configuration file of the affected products is subject to code injection. An attacker could leverage this vulnerability to spawn a reverse shell and gain root access on the affected system.
CVE-2025-13223 High · 8.8 KEV High · 55 CWE-843 Nov 17, 2025
Google Chromium V8 Type Confusion Vulnerability
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2025-40936 High · 7.8 CWE-125 Nov 17, 2025
A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29...
A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29.0.258), Simcenter Femap (All versions < V2512.0003), Solid Edge (All versions < V226.00 Update 03). The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS files. This could allow an attacker to crash the application or execute code in the context of the current process. (ZDI-CAN-26755)
CVE-2025-40834 Medium · 5.7 CWE-79 Nov 17, 2025
Cross-site Scripting (XSS) in Siemens Mendix RichText
A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could allow an attacker to execute cross-site scripting attacks.