March 2021
09.03.2021
SIEMENS CERT
SSB-439005 V3.2 (Last Update: 2021-03-09): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 151...
Title
SSB-439005 V3.2 (Last Update: 2021-03-09): Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssb-439005.pdf
Summary
09.03.2021
SIEMENS CERT
SSA-436177 V1.1 (Last Update: 2021-03-09): Multiple Vulnerabilities in SINEMA Remote Connect
Title
SSA-436177 V1.1 (Last Update: 2021-03-09): Multiple Vulnerabilities in SINEMA Remote Connect
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf
Summary
The latest updates for SINEMA Remote Connect Client and Server fix multiple vulnerabilities. One of these vulnerabilities could allow an attacker to circumvent the authorization of the system for certain functionalities and to execute privileged functions. Siemens has released firmware updates for SINEMA Remote Connect Client and Server.
09.03.2021
SIEMENS CERT
SSA-398519 V1.6 (Last Update: 2021-03-09): Vulnerabilities in Intel CPUs (November 2019)
Title
SSA-398519 V1.6 (Last Update: 2021-03-09): Vulnerabilities in Intel CPUs (November 2019)
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-398519.pdf
Summary
Intel has published information on vulnerabilities in Intel products in November 2019. In this advisory Siemens only explicitly mentions the vulnerabilities from the “Intel® CPU Security Advisory” and one vulnerability from “Intel® CSME, Intel® SPS, Intel® TXE, Intel® AMT, Intel® PTT and Intel® DAL Advisory” and lists the Siemens IPC ...
09.03.2021
SIEMENS CERT
SSA-346262 V2.9 (Last Update: 2021-03-09): Denial-of-Service in Industrial Products
Title
SSA-346262 V2.9 (Last Update: 2021-03-09): Denial-of-Service in Industrial Products
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-346262.pdf
Summary
Several industrial products are affected by a vulnerability that could allow remote attackers to conduct a Denial-of-Service (DoS) attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates ...
09.03.2021
SIEMENS CERT
SSA-312271 V1.6 (Last Update: 2021-03-09): Unquoted Search Path Vulnerabilities in Windows-based Industrial Software Applications
Title
SSA-312271 V1.6 (Last Update: 2021-03-09): Unquoted Search Path Vulnerabilities in Windows-based Industrial Software Applications
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-312271.pdf
Summary
The latest update for affected products fix local privilege escalation vulnerabilities that could allow authorized local users with administrative privileges to execute custom code with SYSTEM level privileges. Siemens has released updates for some of the affected products, and is working on further updates. For the remaining affected products, Siemens ...
09.03.2021
SIEMENS CERT
SSA-293562 V3.1 (Last Update: 2021-03-09): Vulnerabilities in Industrial Products
Title
SSA-293562 V3.1 (Last Update: 2021-03-09): Vulnerabilities in Industrial Products
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-293562.pdf
Summary
Several industrial devices are affected by two vulnerabilities that could allow an attacker to cause a Denial-of-Service condition via PROFINET DCP network packets under certain circumstances. The precondition for this scenario is a direct layer 2 access to the affected products. PROFIBUS interfaces are not affected. Siemens has released updates ...
09.03.2021
SIEMENS CERT
SSA-979775 V1.0: Stack Overflow Vulnerability in SCALANCE and RUGGEDCOM Devices
Title
SSA-979775 V1.0: Stack Overflow Vulnerability in SCALANCE and RUGGEDCOM Devices
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-979775.pdf
Summary
Several firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the passive listening feature that could allow an attacker to cause a reboot or, under specific circumstances, attain remote code execution of the affected devices. Siemens has released updates for several affected products ...
09.03.2021
SIEMENS CERT
SSA-936080 V1.0: Multiple Vulnerabilities in Third-Party Component libcurl
Title
SSA-936080 V1.0: Multiple Vulnerabilities in Third-Party Component libcurl
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf
Summary
SIMATIC NET CM 1542-1 and SCALANCE SC600 family devices are vulnerable to a vulnerability in the third party component libcurl that could allow an attacker to cause a Denial-of-Service condition on the affected devices. Siemens has released an update for SCALANCE SC600. For the remaining affected product, Siemens is preparing ...
09.03.2021
SIEMENS CERT
SSA-917115 V1.0: Mendix Forgot Password Appstore module
Title
SSA-917115 V1.0: Mendix Forgot Password Appstore module
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-917115.pdf
Summary
Mendix Forgot Password Appstore module contains a vulnerability that could allow authorized users to take over accounts. Mendix has released an update for the Mendix Forgot Password Appstore module and recommends to update to the latest version.
09.03.2021
SIEMENS CERT
SSA-783481 V1.0: Denial-of-Service Vulnerability in LOGO! 8 BM
Title
SSA-783481 V1.0: Denial-of-Service Vulnerability in LOGO! 8 BM
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-783481.pdf
Summary
A Denial-of-Service vulnerability has been identified in LOGO! 8 BM. This vulnerability could allow an attacker to crash a device, if a user is tricked into loading a malicious project file onto an affected device. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or ...
09.03.2021
SIEMENS CERT
SSA-731317 V1.0: Multiple vulnerabilities in SINEMA Remote Connect Web Based Management
Title
SSA-731317 V1.0: Multiple vulnerabilities in SINEMA Remote Connect Web Based Management
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-731317.pdf
Summary
The latest update for SINEMA Remote Connect Server fixes vulnerabilities in the web interface that could allow authenticated unpriviledged user accounts to access functionality unauthorized. Siemens has released updates for SINEMA Remote Connect Server and recommends specific countermeasures.
09.03.2021
SIEMENS CERT
SSA-715184 V1.0: Multiple File Parsing Vulnerabilities in Solid Edge
Title
SSA-715184 V1.0: Multiple File Parsing Vulnerabilities in Solid Edge
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf
Summary
Siemens has released new versions for Solid Edge to fix multiple vulnerabilities that could be triggered when the application reads files in different file formats (PAR, DFT, XML extensions). If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and ...
09.03.2021
SIEMENS CERT
SSA-599268 V1.0: Several Vulnerabilities in TCP Stack of SIMATIC MV400 family
Title
SSA-599268 V1.0: Several Vulnerabilities in TCP Stack of SIMATIC MV400 family
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-599268.pdf
Summary
Several vulnerabilities in the TCP stack of the SIMATIC MV400 family could allow an attacker to cause Denial-of-Service condition, or affect integrity of TCP connections. Siemens has released an update for the SIMATIC MV400 family and recommends to update to the latest version
09.03.2021
SIEMENS CERT
SSA-541018 V1.0: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SENTRON PAC / 3VA Devices (Part 2)
Title
SSA-541018 V1.0: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SENTRON PAC / 3VA Devices (Part 2)
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf
Summary
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as “AMNESIA:33” vulnerabilities. This advisory describes the impact of two of these vulnerabilities (CVE-2020-13987, CVE-2020-17437) to Siemens products. Siemens has released updates for several affected products and recommends to update to the latest ...
09.03.2021
SIEMENS CERT
SSA-296266 V1.0: Denial-of-Service Vulnerability in SCALANCE and RUGGEDCOM Devices
Title
SSA-296266 V1.0: Denial-of-Service Vulnerability in SCALANCE and RUGGEDCOM Devices
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdf
Summary
Some firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the SSH authentication that could allow an attacker to cause a Denial-of-Service under certain conditions. Siemens has released an update for the SCALANCE SC-600 family and recommends to update to the latest version. ...
09.03.2021
SIEMENS CERT
SSA-256092 V1.0: Multiple local Denial-of-Service Vulnerabilities in SIMATIC S7-PLCSIM V5.4
Title
SSA-256092 V1.0: Multiple local Denial-of-Service Vulnerabilities in SIMATIC S7-PLCSIM V5.4
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-256092.pdf
Summary
Multiple vulnerabilities affecting SIMATIC S7-PLCSIM V5.4 could allow an attacker with local access to the system to craft special project files that may lead to denial-of-service attacks. Siemens recommends specific workarounds and mitigations.
09.03.2021
SIEMENS CERT
SSA-231216 V1.0: Luxion KeyShot Vulnerabilities in Solid Edge
Title
SSA-231216 V1.0: Luxion KeyShot Vulnerabilities in Solid Edge
Published
March 9, 2021, 1 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdf
Summary
The Solid Edge installation package includes a specific version of the third-party product KeyShot from Luxion, which may not contain the latest security fixes provided by Luxion. Siemens recommends to update KeyShot according to the information in the Luxion Security Advisory LSA-192169.
03.03.2021
US CERT
AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities
Title
AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities
Published
March 3, 2021, 7:12 p.m.
URL
https://us-cert.cisa.gov/ncas/alerts/aa21-062a
Summary
Original release date: March 3, 2021 | Last revised: March 14, 2021SummaryNote: This Alert was updated March 13, 2021 to provide further guidance. Cybersecurity and Infrastructure Security (CISA) partners have observed active exploitation of vulnerabilities in Microsoft Exchange Server products. Successful exploitation of these vulnerabilities allows an unauthenticated attacker to ...
02.03.2021
US CERT (ICS)
Hitachi ABB Power Grids Ellipse EAM
Title
Hitachi ABB Power Grids Ellipse EAM
Published
March 2, 2021, 4:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-21-061-01
Summary
This advisory contains mitigations for Cross-site Scripting, and User Interface Misrepresentation of Critical Information vulnerabilities in Hitachi ABB Power Grids Ellipse EAM software products.
02.03.2021
US CERT (ICS)
Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers
Title
Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers
Published
March 2, 2021, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-21-061-02
Summary
This advisory contains mitigations for an Improper Input Validation vulnerability in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 controllers.
02.03.2021
US CERT (ICS)
MB connect line mbCONNECT24, mymbCONNECT24
Title
MB connect line mbCONNECT24, mymbCONNECT24
Published
March 2, 2021, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-21-061-03
Summary
This advisory contains mitigations for several vulnerabilities in the MB connect line mbCONNECT24, mymbCONNECT24 remote service portal products.
02.03.2021
BOSCH PSIRT
Side Channel Key Extraction Vulnerability in Bosch IP Cameras and Encoders
Title
Side Channel Key Extraction Vulnerability in Bosch IP Cameras and Encoders
Published
March 2, 2021, 1 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-762869-bt.html
Summary

BOSCH-SA-762869-BT: A recently discovered side channel attack for the NXP P5x security microcontrollers was made public. It allows attackers to extract an ECDSA private key after extensive physical access to the chip. The P5x is used as secure certificate storage on Bosch cameras and encoders built on platforms CPP-ENC CPP3 ...

February 2021
25.02.2021
US CERT (ICS)
PerFact OpenVPN-Client
Title
PerFact OpenVPN-Client
Published
Feb. 25, 2021, 4:15 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-21-056-01
Summary
This advisory contains mitigations for an External Control of System or Configuration Setting vulnerability in the PerFact OpenVPN-Client.
25.02.2021
US CERT (ICS)
Fatek FvDesigner
Title
Fatek FvDesigner
Published
Feb. 25, 2021, 4:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02
Summary
This advisory contains mitigations for Use After Free, Access of Uninitialized Pointer, Stack-based Buffer Overflow, Out-of-Bounds Write, and Out-of-Bounds Read vulnerabilities in Fatek FvDesigner software.
25.02.2021
US CERT (ICS)
Rockwell Automation Logix Controllers
Title
Rockwell Automation Logix Controllers
Published
Feb. 25, 2021, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03
Summary
This advisory contains mitigations for a n Insufficiently Protected Credentials vulnerability in Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, and Logix Controllers.

Last Updates

BOSCH PSIRT
20.03.2024
CODESYS
28.06.2023
SIEMENS CERT
19.04.2024
US CERT
17.04.2024
US CERT (ICS)
07.05.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds