{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-109990", "aliases": [], "title": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance：ブラウザー上での不正な処理", "summary": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance プラグイン（WordPress 用）は、'comment' パラメータの入力を十分にサニタイズ・エスケープしないため、すべてのバージョン（1.2.4 以下）で保存型クロスサイトスクリプティング（Stored XSS）の脆弱性があります。認証されていない攻撃者が任意のウェブスクリプトをコメントに埋め込むことができ、ページが表示されたときにそのスクリプトがユーザーのブラウザーで実行されます。ペイロードは kses が許可する 属性と テキストだけを使用し、プラグインの出力バッファ書き換えが予測可能な ___noise___ プレースホルダーキーを介して 内容を 属性に置換することで、WordPress コアの保存時 kses サニタイズを回避します。", "risk": "ユーザーが該当ページを閲覧した際に、攻撃者が埋め込んだ不正なスクリプトが実行される可能性があります。", "product": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance", "range": "<= 1.2.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109990", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddc518c-02a0-46a5-93e9-0d92a045b35b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/html-rewrite.php#L36", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/html-rewrite.php#L64", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2207", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2112", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2226", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L497", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3737597%40flying-scripts&new=3737597%40flying-scripts", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109990", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:40.465Z", "modifiedAt": "2026-10-16T15:17:08.450Z", "fetchedAt": "2026-10-23T02:43:43.893Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted ___noise___ placeholder keys.", "sourceTitle": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "gijo", "product": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.2.4", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109990", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "fetchedAt": "2026-10-23T02:43:43.893Z", "publishedAt": "2026-10-16T03:38:40.465Z", "modifiedAt": "2026-10-16T14:39:06.625Z", "state": "published", "provider": "Wordfence", "title": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content", "descriptions": [ { "lang": "en", "value": "The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted ___noise___ placeholder keys.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "gijo", "product": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.2.4", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddc518c-02a0-46a5-93e9-0d92a045b35b?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/html-rewrite.php#L36", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/html-rewrite.php#L64", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2207", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2112", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2226", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L497", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3737597%40flying-scripts&new=3737597%40flying-scripts", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"gijo\",\"product\":\"Flying Scripts: Delay JavaScript to Improve Site Speed & Performance\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.2.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted ___noise___ placeholder keys.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:06.625Z", "fetchedAt": "2026-10-23T02:43:43.893Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:08.450Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performanceにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:08.417Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "12c813906dab4e82da77ae1be8bdc2c73b5c5908e3ced2eafbc5537654c4e86b", "sourceModifiedAt": "2026-10-16T15:17:08.450Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance プラグイン（WordPress 用）は、'comment' パラメータの入力を十分にサニタイズ・エスケープしないため、すべてのバージョン（1.2.4 以下）で保存型クロスサイトスクリプティング（Stored XSS）の脆弱性があります。認証されていない攻撃者が任意のウェブスクリプトをコメントに埋め込むことができ、ページが表示されたときにそのスクリプトがユーザーのブラウザーで実行されます。ペイロードは kses が許可する 属性と テキストだけを使用し、プラグインの出力バッファ書き換えが予測可能な ___noise___ プレースホルダーキーを介して 内容を 属性に置換することで、WordPress コアの保存時 kses サニタイズを回避します。", "risk": "ユーザーが該当ページを閲覧した際に、攻撃者が埋め込んだ不正なスクリプトが実行される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインは WordPress 用の \"Flying Scripts: Delay JavaScript to Improve Site Speed & Performance\" です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 1.2.4 以下のすべてのリリースが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者は認証されていない状態でも攻撃を実行できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "脆弱性は 'comment' パラメータを通じて入力されるデータに起因します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "プラグインは入力のサニタイズと出力のエスケープが不十分です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ペイロードは kses が許可する要素のみ（ 属性と テキスト）を使用します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "プラグインの出力バッファ書き換え機能が、予測可能な ___noise___ プレースホルダーキーを介して 本文を 属性に置換し、XSS を実現します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：gijo / Flying Scripts: Delay JavaScript to Improve Site Speed & Performance。影響ありとして記載：1.2.4以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Flying Scripts: Delay JavaScript to Improve Site Speed & Performance」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109990", "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddc518c-02a0-46a5-93e9-0d92a045b35b?source=cve", "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/html-rewrite.php#L36", "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/html-rewrite.php#L64", "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2207", "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2112", "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2226", "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L497", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3737597%40flying-scripts&new=3737597%40flying-scripts", "https://nvd.nist.gov/vuln/detail/CVE-2026-109990" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109990", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddc518c-02a0-46a5-93e9-0d92a045b35b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/html-rewrite.php#L36", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/html-rewrite.php#L64", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2207", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2112", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L2226", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/flying-scripts/tags/1.2.4/lib/dom-parser.php#L497", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3737597%40flying-scripts&new=3737597%40flying-scripts", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109990", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted ___noise___ placeholder keys.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "sourceField": "/containers/cna/title", "excerpt": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109990.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"gijo\",\"product\":\"Flying Scripts: Delay JavaScript to Improve Site Speed & Performance\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.2.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109990（Flying Scripts: Delay JavaScript to Improve Site Speed & Performance）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは WordPress 用の \"Flying Scripts: Delay JavaScript to Improve Site Speed & Performance\" です。\n・バージョン 1.2.4 以下のすべてのリリースが影響を受けます。\n・攻撃者は認証されていない状態でも攻撃を実行できます。\n・脆弱性は 'comment' パラメータを通じて入力されるデータに起因します。\n・プラグインは入力のサニタイズと出力のエスケープが不十分です。\n・ペイロードは kses が許可する要素のみ（ 属性と テキスト）を使用します。\n・プラグインの出力バッファ書き換え機能が、予測可能な ___noise___ プレースホルダーキーを介して 本文を 属性に置換し、XSS を実現します。\n・公式の対象表：gijo / Flying Scripts: Delay JavaScript to Improve Site Speed & Performance。影響ありとして記載：1.2.4以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109990", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:08.417Z", "lastSuccess": "2026-10-23T03:21:08.417Z", "sourceCheckedAt": "2026-10-23T02:43:43.893Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109207", "aliases": [], "title": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator：ブラウザー上での不正な処理", "summary": "RSS Aggregator by Feedzy のバージョン 5.2.11 以下において、認証されていない攻撃者が RSS の media:thumbnail@url パラメータを通じて保存型クロスサイトスクリプティングを実行できる。", "risk": "攻撃者が任意のウェブスクリプトを注入でき、ページを閲覧したユーザーのブラウザーでそのスクリプトが実行される可能性がある。", "product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator", "range": "<= 5.2.11" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109207", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134", "label": "security@wordfence.com" }, { "url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109207", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:42.150Z", "modifiedAt": "2026-10-16T15:17:06.697Z", "fetchedAt": "2026-10-23T02:43:43.094Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.", "sourceTitle": "RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "themeisle", "product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "5.2.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109207", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "fetchedAt": "2026-10-23T02:43:43.094Z", "publishedAt": "2026-10-16T03:38:42.150Z", "modifiedAt": "2026-10-16T14:39:06.482Z", "state": "published", "provider": "Wordfence", "title": "RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL", "descriptions": [ { "lang": "en", "value": "The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "themeisle", "product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "5.2.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"themeisle\",\"product\":\"RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.2.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:06.482Z", "fetchedAt": "2026-10-23T02:43:43.094Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:06.697Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregatorにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:08.815Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4066dbbca90a171c2e19d28695c7af0924addef1341f5fc32bca1a01aeb18023", "sourceModifiedAt": "2026-10-16T15:17:06.697Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "RSS Aggregator by Feedzy のバージョン 5.2.11 以下において、認証されていない攻撃者が RSS の media:thumbnail@url パラメータを通じて保存型クロスサイトスクリプティングを実行できる。", "risk": "攻撃者が任意のウェブスクリプトを注入でき、ページを閲覧したユーザーのブラウザーでそのスクリプトが実行される可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "影響を受けるバージョンは 5.2.11 までのすべてのバージョンである。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "認証されていない攻撃者でもこの脆弱性を利用できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃には、対象サイトがインポート用に設定している外部 RSS フィードを攻撃者が制御している必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "WordPress のアカウントや特別なプラグイン設定は不要である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：themeisle / RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator。影響ありとして記載：5.2.11以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109207", "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve", "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241", "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989", "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951", "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413", "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134", "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip", "https://nvd.nist.gov/vuln/detail/CVE-2026-109207" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109207", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1241", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L989", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2951", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L3413", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L2134", "label": "security@wordfence.com" }, { "url": "https://downloads.wordpress.org/plugin/feedzy-rss-feeds.5.2.12.zip", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109207", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "sourceField": "/containers/cna/title", "excerpt": "RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109207.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"themeisle\",\"product\":\"RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.2.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109207（RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるバージョンは 5.2.11 までのすべてのバージョンである。\n・認証されていない攻撃者でもこの脆弱性を利用できる。\n・攻撃には、対象サイトがインポート用に設定している外部 RSS フィードを攻撃者が制御している必要がある。\n・WordPress のアカウントや特別なプラグイン設定は不要である。\n・公式の対象表：themeisle / RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator。影響ありとして記載：5.2.11以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109207", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:08.815Z", "lastSuccess": "2026-10-23T03:21:08.815Z", "sourceCheckedAt": "2026-10-23T02:43:43.094Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-107758", "aliases": [], "title": "Colibri Page Builder：ブラウザー上での不正な処理", "summary": "Colibri Page Builder プラグインは、バージョン 1.0.390 以下すべてで、コメントパラメータの入力検証と出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトを保存できる Stored Cross‑Site Scripting の脆弱性があります。コメントの許可リストが SVG 要素と任意の data-* 属性を許容しているためペイロードが保存され、フロントエンドで常に読み込まれる colibri.js が保存された data‑target 値を jQuery.data() で取得し HTML エンティティをデコードした上で jQuery() に渡すことで、ページを閲覧したユーザーのブラウザーでスクリプトが実行されます。", "risk": "攻撃者が保存したスクリプトが、ページを表示した人のブラウザーで不正に実行されます。", "product": "Colibri Page Builder", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Colibri Page Builder", "range": "<= 1.0.390" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107758", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L68", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L82", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L57", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L205", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L4", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107758", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:42.502Z", "modifiedAt": "2026-10-16T15:17:05.540Z", "fetchedAt": "2026-10-23T02:43:42.733Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.", "sourceTitle": "Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "extendthemes", "product": "Colibri Page Builder", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.0.390", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-107758", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "fetchedAt": "2026-10-23T02:43:42.733Z", "publishedAt": "2026-10-16T03:38:42.502Z", "modifiedAt": "2026-10-16T14:39:06.338Z", "state": "published", "provider": "Wordfence", "title": "Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments", "descriptions": [ { "lang": "en", "value": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "extendthemes", "product": "Colibri Page Builder", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.0.390", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L68", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L82", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L57", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L205", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L4", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"extendthemes\",\"product\":\"Colibri Page Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.0.390\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:06.338Z", "fetchedAt": "2026-10-23T02:43:42.733Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:05.540Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Colibri Page Builderにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:09.088Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "fabb22dabc1645ae2957ccb75e7d7f170d91502093841aa3a4dc0450e9155b9d", "sourceModifiedAt": "2026-10-16T15:17:05.540Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Colibri Page Builder プラグインは、バージョン 1.0.390 以下すべてで、コメントパラメータの入力検証と出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトを保存できる Stored Cross‑Site Scripting の脆弱性があります。コメントの許可リストが SVG 要素と任意の data-* 属性を許容しているためペイロードが保存され、フロントエンドで常に読み込まれる colibri.js が保存された data‑target 値を jQuery.data() で取得し HTML エンティティをデコードした上で jQuery() に渡すことで、ページを閲覧したユーザーのブラウザーでスクリプトが実行されます。", "risk": "攻撃者が保存したスクリプトが、ページを表示した人のブラウザーで不正に実行されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Colibri Page Builder プラグインのバージョン 1.0.390 以下はすべて影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認証されていない攻撃者がコメントパラメータを通じてスクリプトを注入できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "コメントの許可リストが SVG 要素と任意の data-* 属性を許容しているため、ペイロードが保存されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "colibri.js がフロントエンドの全ページで読み込まれ、保存された data-target 値を jQuery.data() で取得します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "取得した値は HTML エンティティがデコードされ、jQuery() に渡されることで HTML と解釈され、埋め込まれたイベントハンドラが発火します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：extendthemes / Colibri Page Builder。影響ありとして記載：1.0.390以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Colibri Page Builder」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-107758", "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=cve", "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L68", "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L82", "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L57", "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L205", "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L4", "https://nvd.nist.gov/vuln/detail/CVE-2026-107758" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107758", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L68", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L82", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L57", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/assets/static/colibri.js#L205", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/filters/svg-kses.php#L4", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107758", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "sourceField": "/containers/cna/title", "excerpt": "Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107758.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"extendthemes\",\"product\":\"Colibri Page Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.0.390\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-107758（Colibri Page Builder）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Colibri Page Builder プラグインのバージョン 1.0.390 以下はすべて影響を受けます。\n・認証されていない攻撃者がコメントパラメータを通じてスクリプトを注入できます。\n・コメントの許可リストが SVG 要素と任意の data-* 属性を許容しているため、ペイロードが保存されます。\n・colibri.js がフロントエンドの全ページで読み込まれ、保存された data-target 値を jQuery.data() で取得します。\n・取得した値は HTML エンティティがデコードされ、jQuery() に渡されることで HTML と解釈され、埋め込まれたイベントハンドラが発火します。\n・公式の対象表：extendthemes / Colibri Page Builder。影響ありとして記載：1.0.390以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-107758", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:09.088Z", "lastSuccess": "2026-10-23T03:21:09.088Z", "sourceCheckedAt": "2026-10-23T02:43:42.733Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-104769", "aliases": [], "title": "Debloat – Remove Unused CSS, Optimize JS：情報の漏えい", "summary": "Debloat – Remove Unused CSS, Optimize JS プラグインは、's' パラメータを介したディレクトリトラバーサルの脆弱性があります。サイト管理者が Optimize CSS 機能（デフォルトで Inline Google Fonts が有効）を有効にしていると、認証済みの管理者権限以上の攻撃者がサーバー上の任意のファイルを読み取ることが可能になります。この条件が整うと、認証されていない訪問者でも、特別に作成した GET リクエストを公開検索 URL に送るだけで攻撃を実行できます。", "risk": "任意のファイルを読み取られることで、機密情報が漏洩する可能性があります。", "product": "Debloat – Remove Unused CSS, Optimize JS", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.9, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "Debloat – Remove Unused CSS, Optimize JS", "range": "<= 1.3.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104769", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104769", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:41.824Z", "modifiedAt": "2026-10-16T17:17:21.457Z", "fetchedAt": "2026-10-23T02:43:41.742Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.", "sourceTitle": "Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed ", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "asadkn", "product": "Debloat – Remove Unused CSS, Optimize JS", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.3.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-104769", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "fetchedAt": "2026-10-23T02:43:41.742Z", "publishedAt": "2026-10-16T03:38:41.824Z", "modifiedAt": "2026-10-16T16:18:46.835Z", "state": "published", "provider": "Wordfence", "title": "Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed ", "descriptions": [ { "lang": "en", "value": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "asadkn", "product": "Debloat – Remove Unused CSS, Optimize JS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/8" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/9" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"asadkn\",\"product\":\"Debloat – Remove Unused CSS, Optimize JS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"cweId\":\"CWE-22\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T16:18:46.835Z", "fetchedAt": "2026-10-23T02:43:41.742Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T17:17:21.457Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Debloat – Remove Unused CSS, Optimize JSに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:09.386Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "396a4a6afe0daaee75f36ebd5764123816ec1694b266075c02fffa5631503438", "sourceModifiedAt": "2026-10-16T17:17:21.457Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Debloat – Remove Unused CSS, Optimize JS プラグインは、's' パラメータを介したディレクトリトラバーサルの脆弱性があります。サイト管理者が Optimize CSS 機能（デフォルトで Inline Google Fonts が有効）を有効にしていると、認証済みの管理者権限以上の攻撃者がサーバー上の任意のファイルを読み取ることが可能になります。この条件が整うと、認証されていない訪問者でも、特別に作成した GET リクエストを公開検索 URL に送るだけで攻撃を実行できます。", "risk": "任意のファイルを読み取られることで、機密情報が漏洩する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "プラグインのバージョンが 1.3.0 以下（1.3.0 を含む）である場合に影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "サイト管理者が Optimize CSS 機能を有効にし、デフォルトの Inline Google Fonts オプションが有効になっている必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "認証済みで管理者レベル以上の権限を持つ攻撃者が、任意のファイルを読み取ることが可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "上記条件が満たされると、認証されていない訪問者でも単一の GET リクエストで攻撃を実行できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：asadkn / Debloat – Remove Unused CSS, Optimize JS。影響ありとして記載：1.3.0以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Debloat – Remove Unused CSS, Optimize JS」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-104769", "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve", "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207", "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218", "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161", "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82", "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221", "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80", "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92", "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat", "https://nvd.nist.gov/vuln/detail/CVE-2026-104769" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104769", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104769", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "sourceField": "/containers/cna/title", "excerpt": "Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed ", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104769.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"asadkn\",\"product\":\"Debloat – Remove Unused CSS, Optimize JS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-104769（Debloat – Remove Unused CSS, Optimize JS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・プラグインのバージョンが 1.3.0 以下（1.3.0 を含む）である場合に影響を受けます。\n・サイト管理者が Optimize CSS 機能を有効にし、デフォルトの Inline Google Fonts オプションが有効になっている必要があります。\n・認証済みで管理者レベル以上の権限を持つ攻撃者が、任意のファイルを読み取ることが可能です。\n・上記条件が満たされると、認証されていない訪問者でも単一の GET リクエストで攻撃を実行できます。\n・公式の対象表：asadkn / Debloat – Remove Unused CSS, Optimize JS。影響ありとして記載：1.3.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104769", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:09.386Z", "lastSuccess": "2026-10-23T03:21:09.386Z", "sourceCheckedAt": "2026-10-23T02:43:41.742Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-104745", "aliases": [], "title": "Customer Email Verification for WooCommerce：権限の奪取", "summary": "Customer Email Verification for WooCommerce プラグイン（バージョン 3.3.0 以下）において、`alg_wc_ev_verify_email` パラメータを介した特権昇格の脆弱性があります。プラグインの「Encoding method」設定がデフォルト以外の「hashids」に設定されていると、攻撃者は認証されていない状態で任意の未確認 WordPress アカウント（管理者アカウントを含む）に対して認証を取得できる可能性があります。", "risk": "認証されていない攻撃者が、未確認の WordPress アカウント（管理者レベルを含む）としてログインできるようになる可能性があります。", "product": "Customer Email Verification for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Customer Email Verification for WooCommerce", "range": "<= 3.3.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104745", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104745", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:41.491Z", "modifiedAt": "2026-10-16T15:17:03.563Z", "fetchedAt": "2026-10-23T02:43:41.722Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.", "sourceTitle": "Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpcodefactory", "product": "Customer Email Verification for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.3.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-104745", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "fetchedAt": "2026-10-23T02:43:41.722Z", "publishedAt": "2026-10-16T03:38:41.491Z", "modifiedAt": "2026-10-16T15:09:41.042Z", "state": "published", "provider": "Wordfence", "title": "Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter", "descriptions": [ { "lang": "en", "value": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpcodefactory", "product": "Customer Email Verification for WooCommerce", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.3.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpcodefactory\",\"product\":\"Customer Email Verification for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:41.042Z", "fetchedAt": "2026-10-23T02:43:41.722Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:03.563Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Customer Email Verification for WooCommerceに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:09.622Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8c7fa9f690933092deb708381554a63288d66f65f90b8010c4207e3082b93224", "sourceModifiedAt": "2026-10-16T15:17:03.563Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Customer Email Verification for WooCommerce プラグイン（バージョン 3.3.0 以下）において、`alg_wc_ev_verify_email` パラメータを介した特権昇格の脆弱性があります。プラグインの「Encoding method」設定がデフォルト以外の「hashids」に設定されていると、攻撃者は認証されていない状態で任意の未確認 WordPress アカウント（管理者アカウントを含む）に対して認証を取得できる可能性があります。", "risk": "認証されていない攻撃者が、未確認の WordPress アカウント（管理者レベルを含む）としてログインできるようになる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象プラグインは Customer Email Verification for WooCommerce である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "影響を受けるバージョンは 3.3.0 以下（3.3.0 を含む）である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "プラグインの設定項目「Encoding method」が「hashids」に設定されていることが必要条件である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "「hashids」設定はデフォルトではなく、管理者が手動で変更した場合にのみ適用される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "`alg_wc_ev_generate_user_code()` が `wp_rand(100)` を用いて 0〜100 の 101 通りしかないコードを生成する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "生成されたトークンは可逆的な Hashids エンコードであり、暗号的な MAC が付与されていない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "`verify()` ハンドラは `init` フックの PHP_INT_MAX で実行され、nonce チェックやレートリミットが設定されていない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃者は GET パラメータ `?alg_wc_ev_verify_email=` を任意に設定でき、ハンドラはこのパラメータを直接処理する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃者は非常に小さなコード空間（約 101 通り）を総当たりで試行できるため、認証コードを brute‑force できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "対象アカウントのメールアドレスが未確認（未検証）のままであることが必要である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "Hashids の salt がデフォルトで `md5(time())` として初回初期化時に設定されるため、攻撃者がこの salt を取得または推測できる必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：wpcodefactory / Customer Email Verification for WooCommerce。影響ありとして記載：3.3.0以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Customer Email Verification for WooCommerce」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-104745", "https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve", "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331", "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784", "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498", "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce", "https://nvd.nist.gov/vuln/detail/CVE-2026-104745" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104745", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104745", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "sourceField": "/containers/cna/title", "excerpt": "Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104745.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpcodefactory\",\"product\":\"Customer Email Verification for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-104745（Customer Email Verification for WooCommerce）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは Customer Email Verification for WooCommerce である。\n・影響を受けるバージョンは 3.3.0 以下（3.3.0 を含む）である。\n・プラグインの設定項目「Encoding method」が「hashids」に設定されていることが必要条件である。\n・「hashids」設定はデフォルトではなく、管理者が手動で変更した場合にのみ適用される。\n・`alg_wc_ev_generate_user_code()` が `wp_rand(100)` を用いて 0〜100 の 101 通りしかないコードを生成する。\n・生成されたトークンは可逆的な Hashids エンコードであり、暗号的な MAC が付与されていない。\n・`verify()` ハンドラは `init` フックの PHP_INT_MAX で実行され、nonce チェックやレートリミットが設定されていない。\n・攻撃者は GET パラメータ `?alg_wc_ev_verify_email=` を任意に設定でき、ハンドラはこのパラメータを直接処理する。\n・攻撃者は非常に小さなコード空間（約 101 通り）を総当たりで試行できるため、認証コードを brute‑force できる。\n・対象アカウントのメールアドレスが未確認（未検証）のままであることが必要である。\n・Hashids の salt がデフォルトで `md5(time())` として初回初期化時に設定されるため、攻撃者がこの salt を取得または推測できる必要がある。\n・公式の対象表：wpcodefactory / Customer Email Verification for WooCommerce。影響ありとして記載：3.3.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104745", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:09.622Z", "lastSuccess": "2026-10-23T03:21:09.622Z", "sourceCheckedAt": "2026-10-23T02:43:41.722Z", "errorCode": null }, "glossary": [ { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-103518", "aliases": [], "title": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler：データベースへの不正操作", "summary": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler プラグインは、'products[*].variants[*].<攻撃者が選択したキー>' パラメータに対するエスケープ処理が不十分で、既存の SQL クエリの準備も不十分なため、すべてのバージョン（1.7.0 まで）で汎用的な SQL インジェクションが可能です。この脆弱性により、認証済みで custom‑level 以上の権限を持つ攻撃者は、既存のクエリに追加の SQL 文を組み込んでデータベースから機密情報を取得できるようになります。FluentCart Pro のインストールでは、管理者権限でなくても Manager ショップロールが付与されたユーザーが products/edit 権限を持つため、同様にこの脆弱性を悪用できます。", "risk": "攻撃者はデータベースに対して任意の SQL クエリを実行できるため、機密情報が漏洩する恐れがあります。", "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.9, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "range": "<= 1.7.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103518", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php#L103", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php#L1818", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php#L413", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php#L304", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php#L14", "label": "security@wordfence.com" }, { "url": "https://wordpress.org/plugins/fluent-cart/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103518", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:40.123Z", "modifiedAt": "2026-10-16T15:17:02.147Z", "fetchedAt": "2026-10-23T02:43:41.141Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.", "sourceTitle": "FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpmanageninja", "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.7.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103518", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "fetchedAt": "2026-10-23T02:43:41.141Z", "publishedAt": "2026-10-16T03:38:40.123Z", "modifiedAt": "2026-10-16T15:09:41.350Z", "state": "published", "provider": "Wordfence", "title": "FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys", "descriptions": [ { "lang": "en", "value": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpmanageninja", "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.7.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php#L103", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php#L1818", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php#L413", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php#L304", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php#L14", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://wordpress.org/plugins/fluent-cart/", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpmanageninja\",\"product\":\"FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.7.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"cweId\":\"CWE-89\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:41.350Z", "fetchedAt": "2026-10-23T02:43:41.141Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.147Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simplerにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:09.640Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "134f21c484bb15d54948ccd3f8d746a1f6cf5d01bc3cb616ab7ecade177b9d22", "sourceModifiedAt": "2026-10-16T15:17:02.147Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler プラグインは、'products[*].variants[*].<攻撃者が選択したキー>' パラメータに対するエスケープ処理が不十分で、既存の SQL クエリの準備も不十分なため、すべてのバージョン（1.7.0 まで）で汎用的な SQL インジェクションが可能です。この脆弱性により、認証済みで custom‑level 以上の権限を持つ攻撃者は、既存のクエリに追加の SQL 文を組み込んでデータベースから機密情報を取得できるようになります。FluentCart Pro のインストールでは、管理者権限でなくても Manager ショップロールが付与されたユーザーが products/edit 権限を持つため、同様にこの脆弱性を悪用できます。", "risk": "攻撃者はデータベースに対して任意の SQL クエリを実行できるため、機密情報が漏洩する恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "バージョン 1.7.0 まで（それを含む）のすべてのリリースが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認証済みで custom‑level 以上の権限を持つ攻撃者がこの脆弱性を利用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "FluentCart Pro 環境では、Manager ショップロールが付与された非管理者ユーザーも products/edit 権限を持ち、同様に脆弱性を悪用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：wpmanageninja / FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler。影響ありとして記載：1.7.0以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103518", "https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=cve", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php#L103", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php#L1818", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php#L413", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php#L304", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php#L14", "https://wordpress.org/plugins/fluent-cart/", "https://plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-103518" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103518", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php#L103", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php#L1818", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php#L413", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php#L304", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php#L14", "label": "security@wordfence.com" }, { "url": "https://wordpress.org/plugins/fluent-cart/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103518", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "sourceField": "/containers/cna/title", "excerpt": "FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103518.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpmanageninja\",\"product\":\"FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.7.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103518（FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 1.7.0 まで（それを含む）のすべてのリリースが影響を受けます。\n・認証済みで custom‑level 以上の権限を持つ攻撃者がこの脆弱性を利用できます。\n・FluentCart Pro 環境では、Manager ショップロールが付与された非管理者ユーザーも products/edit 権限を持ち、同様に脆弱性を悪用できます。\n・公式の対象表：wpmanageninja / FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler。影響ありとして記載：1.7.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103518", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:09.640Z", "lastSuccess": "2026-10-23T03:21:09.640Z", "sourceCheckedAt": "2026-10-23T02:43:41.141Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-100159", "aliases": [], "title": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups：脆弱性情報", "summary": "Popup Box プラグイン（バージョン 6.4.1 から 6.4.2）では、未認証の攻撃者が Client-IP や X-Forwarded-For などのリクエストヘッダーを操作し、管理者がポップアップのカスタムコンテンツに %%user_ip_address%% トークンを入れていると、任意のショートコードをサーバー上で実行できる脆弱性があります。", "risk": "攻撃者が任意のショートコードを実行できるため、サーバー上の任意のデータを取得したり、サイトにインストールされている他のショートコードが提供する機能を悪用される可能性があります。", "product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups", "range": ">= 6.4.1 / <= 6.4.2" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-100159", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100159", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T02:26:09.256Z", "modifiedAt": "2026-10-16T15:16:58.060Z", "fetchedAt": "2026-10-23T02:43:40.743Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.", "sourceTitle": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "ays-pro", "product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups", "versions": [ { "version": "6.4.1", "status": "affected", "lessThanOrEqual": "6.4.2", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-100159", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "fetchedAt": "2026-10-23T02:43:40.743Z", "publishedAt": "2026-10-16T02:26:09.256Z", "modifiedAt": "2026-10-16T15:09:41.509Z", "state": "published", "provider": "Wordfence", "title": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers", "descriptions": [ { "lang": "en", "value": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "ays-pro", "product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "6.4.1", "lessThanOrEqual": "6.4.2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"ays-pro\",\"product\":\"Popup Box – Create Countdown, Coupon, Video, Contact Form Popups\",\"versions\":[{\"version\":\"6.4.1\",\"status\":\"affected\",\"lessThanOrEqual\":\"6.4.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-94 Improper Control of Generation of Code ('Code Injection')\",\"cweId\":\"CWE-94\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:41.509Z", "fetchedAt": "2026-10-23T02:43:40.743Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:16:58.060Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popupsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:10.662Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0858d8ab3263b9f8d97ac0f64fb9b19e17094fb92062d438b39e99ec02b336e0", "sourceModifiedAt": "2026-10-16T15:16:58.060Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Popup Box プラグイン（バージョン 6.4.1 から 6.4.2）では、未認証の攻撃者が Client-IP や X-Forwarded-For などのリクエストヘッダーを操作し、管理者がポップアップのカスタムコンテンツに %%user_ip_address%% トークンを入れていると、任意のショートコードをサーバー上で実行できる脆弱性があります。", "risk": "攻撃者が任意のショートコードを実行できるため、サーバー上の任意のデータを取得したり、サイトにインストールされている他のショートコードが提供する機能を悪用される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "未認証の攻撃者が Client-IP、X-Forwarded-For、Forwarded、X-Forwarded、Forwarded-For ヘッダーを操作できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "プラグインの ays_popup_get_user_ip() 関数がこれらヘッダーを sanitize_text_field() だけでサニタイズする。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ポップアップのカスタムコンテンツ本文に %%user_ip_address%% トークンが含まれている。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Ays_Pb_Data::replace_message_variables() がトークンを生の文字列置換で置き換え、エスケープせずに do_shortcode() に渡す。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象プラグインのバージョンが 6.4.1 以上 6.4.2 以下である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "管理者がポップアップに上記トークンを追加している。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：ays-pro / Popup Box – Create Countdown, Coupon, Video, Contact Form Popups。影響ありとして記載：6.4.1以上、6.4.2以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Popup Box – Create Countdown, Coupon, Video, Contact Form Popups」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-100159", "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve", "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389", "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560", "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299", "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79", "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69", "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-100159" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-100159", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100159", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "sourceField": "/containers/cna/title", "excerpt": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"ays-pro\",\"product\":\"Popup Box – Create Countdown, Coupon, Video, Contact Form Popups\",\"versions\":[{\"version\":\"6.4.1\",\"status\":\"affected\",\"lessThanOrEqual\":\"6.4.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-100159（Popup Box – Create Countdown, Coupon, Video, Contact Form Popups）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・未認証の攻撃者が Client-IP、X-Forwarded-For、Forwarded、X-Forwarded、Forwarded-For ヘッダーを操作できる。\n・プラグインの ays_popup_get_user_ip() 関数がこれらヘッダーを sanitize_text_field() だけでサニタイズする。\n・ポップアップのカスタムコンテンツ本文に %%user_ip_address%% トークンが含まれている。\n・Ays_Pb_Data::replace_message_variables() がトークンを生の文字列置換で置き換え、エスケープせずに do_shortcode() に渡す。\n・対象プラグインのバージョンが 6.4.1 以上 6.4.2 以下である。\n・管理者がポップアップに上記トークンを追加している。\n・公式の対象表：ays-pro / Popup Box – Create Countdown, Coupon, Video, Contact Form Popups。影響ありとして記載：6.4.1以上、6.4.2以下。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-100159", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:10.662Z", "lastSuccess": "2026-10-23T03:21:10.662Z", "sourceCheckedAt": "2026-10-23T02:43:40.743Z", "errorCode": null }, "glossary": [] } }, { "id": "JVNVU96928590", "aliases": [], "title": "産業・医療向け6製品の更新：Malcolm、Milo、EseeCloudなど", "summary": "対象はMalcolm、Red Lion N-Tron 700、Eclipse Milo、EseeCloud、Torrent Suite、dcm4chee-arc-lightです。製品と版を確認して該当項目だけを見てください。修正のある製品と、開発元への確認が必要な製品を区別しています。", "risk": "Malcolmには認証・アクセス制御などの問題、N-Tronには管理アクセスや再起動、Miloにはデータ・認証情報・サービス継続への問題、EseeCloudにはカメラ制御の問題があります。Torrent Suiteはログインした攻撃者によるファイル読み取り、dcm4cheeは医療画像や患者情報などへの影響です。", "product": "CISA ICS Advisory / ICS Medical Advisory（2026年10月15日）", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "Malcolmの最初の5件はv26.08.0で修正、CVE-2026-107333・107362はv26.09.0で修正されています。v26.08.0へ更新しただけで全件対応済みとはせず、後者を含む更新を確認します。", "N-Tron 700は3.11.1以降へ更新し、SNMP communitiesの設定または無効化、Web GUIへのアクセス無効化も開発元が勧めています。設備の管理経路への影響を担当者が確認して適用します。", "Eclipse Miloは1.1.5以降へ更新します。0.6.x系列には修正版がないと公表されているため、0.6.xを使う場合も1.1.5以降への移行が必要です。", "EseeCloudは開発元がCISAの調整に応答しなかったと公表されています。修正版番号を推測せず、Guangzhou Juanへ対象機器とアプリ・ファームウェアの版を伝え、対応状況を問い合わせてください。", "Torrent Suite Softwareは5.22以降へ、dcm4chee-arc-lightは5.35.2以降へ更新するよう、それぞれの開発元が勧めています。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU96928590/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-16T00:15:00.000Z", "modifiedAt": "2026-10-16T00:15:00.000Z", "fetchedAt": "2026-10-23T03:17:49.705Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。", "sourceTitle": "CISA ICS Advisory / ICS Medical Advisory（2026年10月15日）", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-16T00:15:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-16T00:15:00.000Z", "fetchedAt": "2026-10-23T03:17:49.705Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVNVU96928590", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "fetchedAt": "2026-10-23T02:43:54.025Z", "publishedAt": "2026-10-15T15:00:00.000Z", "modifiedAt": "2026-10-15T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVNVU#96928590\n\nCISA ICS Advisory / ICS Medical Advisory（2026年10月15日）", "descriptions": [ { "lang": "ja", "value": "米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "新規：5件\n\nICSA-26-280-01: CISA Malcolm\n\nICSA-26-288-01: Eclipse Foundation Eclipse Milo\n\nICSA-26-288-02: Guangzhou Juan IoT Technology EseeCloud\n\nICSMA-26-288-01: Thermo Fisher Torrent Suite Software\n\nICSMA-26-288-02: J4Care dcm4che\n\n更新：1件\n\nICSA-26-281-01: Red Lion Controls N-Tron 700 Series (Update A)", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "ICS Advisory / ICS Medical Advisoryを参照してください。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "ICS Advisory / ICS Medical Advisoryを参照してください。", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "ICS Advisory / ICS Medical Advisoryを参照してください。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "ICS Advisory / ICS Medical Advisoryを参照してください。", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "新規：5件\n\nICSA-26-280-01: CISA Malcolm\n\nICSA-26-288-01: Eclipse Foundation Eclipse Milo\n\nICSA-26-288-02: Guangzhou Juan IoT Technology EseeCloud\n\nICSMA-26-288-01: Thermo Fisher Torrent Suite Software\n\nICSMA-26-288-02: J4Care dcm4che\n\n更新：1件\n\nICSA-26-281-01: Red Lion Controls N-Tron 700 Series (Update A)", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "ICS Advisory / ICS Medical Advisoryを参照してください。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "ICS Advisory / ICS Medical Advisoryを参照してください。", "sourcePath": "section:対策方法" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourcePath": "section:概要", "text": "米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourcePath": "section:影響を受けるシステム", "text": "ICS Advisory / ICS Medical Advisoryを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourcePath": "section:詳細情報", "text": "新規：5件\n\nICSA-26-280-01: CISA Malcolm\n\nICSA-26-288-01: Eclipse Foundation Eclipse Milo\n\nICSA-26-288-02: Guangzhou Juan IoT Technology EseeCloud\n\nICSMA-26-288-01: Thermo Fisher Torrent Suite Software\n\nICSMA-26-288-02: J4Care dcm4che\n\n更新：1件\n\nICSA-26-281-01: Red Lion Controls N-Tron 700 Series (Update A)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourcePath": "section:想定される影響", "text": "ICS Advisory / ICS Medical Advisoryを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourcePath": "section:対策方法", "text": "ICS Advisory / ICS Medical Advisoryを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "CISA Malcolm | CISA\n\nSummary\n\nThe following versions of CISA Malcolm are affected:\n\nMalcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334)\n\nMalcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362)\n\nCVSS\nVendor\nEquipment\n\nv3 8.1\nCISA\nMalcolm\n\n6 Vulnerabilities\n\nAuthentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Data Amplification)\n\nBackground\n\nCritical Infrastructure Sectors: Energy, Information Technology, Water and Wastewater Systems\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: United States\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-107336\n\nMalcolm's front nginx reverse proxy defines a \"Dashboards → Arkime shortcut\" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.\n\nRead More\n\n1 Affected Product\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-290 Authentication Bypass by Spoofing\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n4.0\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107333\n\nMalcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.\n\nRead More\n\n2 Affected Products\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.09.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-863 Incorrect Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\n\n4.0\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107362\n\nMalcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the upload container's transfer directory and returns the transfer ID to the caller, enabling full readback of the fetched content.\n\nRead More\n\n3 Affected Products\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.09.0\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.09.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-918 Server-Side Request Forgery (SSRF)\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L\n\n4.0\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107361\n\nThe Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value \"Malcolm\". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.\n\nRead More\n\n4 Affected Products\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n4.2\nMEDIUM\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n4.0\n\nCVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107337\n\nThe Malcolm kiosk Flask application exposes a POST /script_call/ endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.\n\nRead More\n\n5 Affected Products\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-352 Cross-Site Request Forgery (CSRF)\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H\n\n4.0\n\nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:R/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107335\n\nMalcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.\n\nRead More\n\n6 Affected Products\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n4.0\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107334\n\nMalcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.\n\nRead More\n\n7 Affected Products\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-863 Incorrect Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n5.4\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\n\n4.0\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-107336", "CVE-2026-107361", "CVE-2026-107337", "CVE-2026-107335", "CVE-2026-107334", "CVE-2026-107333", "CVE-2026-107362" ] }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "Red Lion Controls N-Tron 700 Series (Update A) | CISA\n\nSummary\n\nSuccessful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to reboot by navigating to a specific URL on the device. This action can be scripted on the malicious user's local machine to cause continuous rebooting of the switch.\n\nThe following versions of Red Lion Controls N-Tron 700 Series are affected:\n\n700 Series <=Firmware_3.11.0 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272)\n\n700 Series <=Bootloader_2.0.6.1 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272)\n\nCVSS\nVendor\nEquipment\n\nv3 8.3\nRed Lion Controls\n700 Series\n\n7 Vulnerabilities\n\nUse of Hard-coded Credentials, Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format, Missing Authentication for Critical Function, Download of Code Without Integrity Check, Reachable Assertion, Authentication Bypass Using an Alternate Path or Channel\n\nBackground\n\nCritical Infrastructure Sectors: Commercial Facilities, Communications, Critical Manufacturing, Information Technology\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Sweden\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-32645\n\nDefault factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.\n\nRead More\n\n2 Affected Products\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nAdditional Metrics\n\nRelevant CWE: CWE-798 Use of Hard-coded Credentials\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n6\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\n\n4.0\n8.3\nHIGH\nCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-39460\n\nUsernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.\n\nRead More\n\n4 Affected Products\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nAdditional Metrics\n\nRelevant CWE: CWE-522 Insufficiently Protected Credentials\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\n\n4.0\n8.6\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-28745\n\nUsernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.\n\nRead More\n\n6 Affected Products\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nAdditional Metrics\n\nRelevant CWE: CWE-257 Storing Passwords in a Recoverable Format\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n4.0\n9.3\nCRITICAL\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-33367\n\nSNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades-all without any authentication.\n\nRead More\n\n8 Affected Products\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nAdditional Metrics\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\n\n4.0\n8.6\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-29797\n\nNo authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.\n\nRead More\n\n10 Affected Products\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nAdditional Metrics\n\nRelevant CWE: CWE-494 Download of Code Without Integrity Check\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N\n\n4.0\n7.1\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-39453\n\nNavigating to a certain URL on the switch's web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.\n\nRead More\n\n12 Affected Products\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-netwo", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-32645", "CVE-2026-39460", "CVE-2026-28745", "CVE-2026-33367", "CVE-2026-29797", "CVE-2026-39453", "CVE-2026-33272" ] }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "Eclipse Foundation Eclipse Milo | CISA\n\nSummary\n\nSuccessful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.\n\nThe following versions of Eclipse Foundation Eclipse Milo are affected:\n\nEclipse Milo >=0.6.0|<=1.1.4 (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007)\n\nEclipse Milo >=1.0.0|<=1.1.4 (CVE-2026-62927, CVE-2026-58080, CVE-2026-61387)\n\nCVSS\nVendor\nEquipment\n\nv3 8.2\nEclipse Foundation\nEclipse Milo\n\n5 Vulnerabilities\n\nIncorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization, Observable Response Discrepancy, Missing Release of Resource after Effective Lifetime\n\nBackground\n\nCritical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Belgium\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-62927\n\nIn Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.\n\nRead More\n\n1 Affected Product\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-863 Incorrect Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n4.0\n8.7\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-63252\n\nIn Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.\n\nRead More\n\n2 Affected Products\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n4.0\n8.7\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-58080\n\nIn Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy() fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy(), sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.\n\nRead More\n\n3 Affected Products\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-862 Missing Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n8.2\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N\n\n4.0\n8.8\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-63248\n\nIn Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.\n\nRead More\n\n4 Affected Products\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-862 Missing Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n4.0\n6.9\nMEDIUM\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-60007\n\nIn Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.\n\nRead More\n\n5 Affected Products\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-204 Observable Response Discrepancy\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.4\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\n\n4.0\n9.1\nCRITICAL\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-61387\n\nIn Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.\n\nRead More\n\n6 Affected Products\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n4.0\n6.9\nMEDIUM\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N\n\nView CVE Details", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-63252", "CVE-2026-63248", "CVE-2026-60007", "CVE-2026-62927", "CVE-2026-58080", "CVE-2026-61387" ] }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "Guangzhou Juan IoT Technology EseeCloud | CISA\n\nSummary\n\nSuccessful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras.\n\nThe following versions of Guangzhou Juan IoT Technology EseeCloud are affected:\n\nEseeCloud App <=4.9.6 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664)\n\nEseeCloud Firmware <=4.9.86.0 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664)\n\nCVSS\nVendor\nEquipment\n\nv3 9.8\nGuangzhou Juan IoT Technology Co., Ltd.\nEseeCloud App\n\n3 Vulnerabilities\n\nUse of Hard-coded Credentials, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Observable Response Discrepancy\n\nBackground\n\nCritical Infrastructure Sectors: Energy, Communications, Transportation Systems, Financial Services, Government Services and Facilities\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: China\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-107617\n\nAn attacker can use a hard-coded credential to log in to EseeCloud devices.\n\nRead More\n\n2 Affected Products\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: <=4.9.86.0\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nAdditional Metrics\n\nRelevant CWE: CWE-798 Use of Hard-coded Credentials\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n9.8\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n4.0\n9.3\nCRITICAL\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-97858\n\nAn attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.\n\nRead More\n\n4 Affected Products\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: <=4.9.86.0\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: <=4.9.86.0\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nAdditional Metrics\n\nRelevant CWE: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n\n4.0\n6.9\nMEDIUM\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-105664\n\nThe endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.\n\nRead More\n\n6 Affected Products\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: <=4.9.86.0\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: <=4.9.86.0\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: <=4.9.86.0\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nAdditional Metrics\n\nRelevant CWE: CWE-204 Observable Response Discrepancy\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n\n4.0\n8.7\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-107617", "CVE-2026-97858", "CVE-2026-105664" ] }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "Thermo Fisher Torrent Suite Software | CISA\n\nSummary\n\nSuccessful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server.\n\nThe following versions of Thermo Fisher Torrent Suite Software are affected:\n\nTorrent Suite Software <=5.18 (CVE-2026-107777)\n\nCVSS\nVendor\nEquipment\n\nv3 6.5\nThermo Fisher\nTorrent Suite Software\n\n1 Vulnerability\n\nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\n\nBackground\n\nCritical Infrastructure Sectors: Healthcare and Public Health\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: United States\n\nVulnerabilities\n\nCVE-2026-107777\n\nThe affected product is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.\n\nRead More\n\n1 Affected Product\n\nThermo Fisher Torrent Suite Software: <=5.18\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThermo Fisher has fixed the vulnerability and recommends users update Torrent Suite Software to version 5.22 or later.\n\nMitigation\nFor more information, refer to Thermo Fisher's Security bulletin.\n\nAdditional Metrics\n\nRelevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\n\n4.0\n7.1\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-107777" ] }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "J4Care dcm4che | CISA\n\nSummary\n\nSuccessful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition.\n\nThe following versions of J4Care dcm4che are affected:\n\ndcm4chee-arc-light 5.35.1 (CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, CVE-2026-105667)\n\nCVSS\nVendor\nEquipment\n\nv3 9.1\nJ4Care\ndcm4chee-arc-light\n\n4 Vulnerabilities\n\nMissing Authorization, Loop with Unreachable Exit Condition ('Infinite Loop'), Inefficient Algorithmic Complexity, Missing Authentication for Critical Function\n\nBackground\n\nCritical Infrastructure Sectors: Healthcare and Public Health\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Austria\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-97851\n\nThe storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.\n\nRead More\n\n1 Affected Product\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-862 Missing Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n\n4.0\n8.8\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107621\n\nJPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.\n\nRead More\n\n2 Affected Products\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n4.0\n9.3\nCRITICAL\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-105273\n\nMP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.\n\nRead More\n\n3 Affected Products\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n4.0\n9.3\nCRITICAL\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-101021\n\nMultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.\n\nRead More\n\n4 Affected Products\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-407 Inefficient Algorithmic Complexity\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n4.0\n8.7\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-105279\n\nIn the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.\n\nRead More\n\n5 Affected Products\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n\n4.0\n9.3\nCRITICAL\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-105667\n\nIn the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.\n\nRead More\n\n6 Affected Products\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n4.0\n8.7\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-97851", "CVE-2026-107621", "CVE-2026-105273", "CVE-2026-101021", "CVE-2026-105279", "CVE-2026-105667" ] } ], "limits": { "completeness": "bounded", "truncatedFields": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01" ], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2026-107336", "CVE-2026-107361", "CVE-2026-107337", "CVE-2026-107335", "CVE-2026-107334", "CVE-2026-107333", "CVE-2026-107362", "CVE-2026-32645", "CVE-2026-39460", "CVE-2026-28745", "CVE-2026-33367", "CVE-2026-29797", "CVE-2026-39453", "CVE-2026-33272", "CVE-2026-63252", "CVE-2026-63248", "CVE-2026-60007", "CVE-2026-62927", "CVE-2026-58080", "CVE-2026-61387", "CVE-2026-107617", "CVE-2026-97858", "CVE-2026-105664", "CVE-2026-107777", "CVE-2026-97851", "CVE-2026-107621", "CVE-2026-105273", "CVE-2026-101021", "CVE-2026-105279", "CVE-2026-105667" ], "supplementarySources": [ { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "title": "CISA Malcolm | CISA", "relatedCves": [ "CVE-2026-107336", "CVE-2026-107361", "CVE-2026-107337", "CVE-2026-107335", "CVE-2026-107334", "CVE-2026-107333", "CVE-2026-107362" ] }, { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "title": "Red Lion Controls N-Tron 700 Series (Update A) | CISA", "relatedCves": [ "CVE-2026-32645", "CVE-2026-39460", "CVE-2026-28745", "CVE-2026-33367", "CVE-2026-29797", "CVE-2026-39453", "CVE-2026-33272" ] }, { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "title": "Eclipse Foundation Eclipse Milo | CISA", "relatedCves": [ "CVE-2026-63252", "CVE-2026-63248", "CVE-2026-60007", "CVE-2026-62927", "CVE-2026-58080", "CVE-2026-61387" ] }, { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "title": "Guangzhou Juan IoT Technology EseeCloud | CISA", "relatedCves": [ "CVE-2026-107617", "CVE-2026-97858", "CVE-2026-105664" ] }, { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "title": "Thermo Fisher Torrent Suite Software | CISA", "relatedCves": [ "CVE-2026-107777" ] }, { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "title": "J4Care dcm4che | CISA", "relatedCves": [ "CVE-2026-97851", "CVE-2026-107621", "CVE-2026-105273", "CVE-2026-101021", "CVE-2026-105279", "CVE-2026-105667" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "title": "CISA Malcolm | CISA", "relatedCves": [ "CVE-2026-107336", "CVE-2026-107361", "CVE-2026-107337", "CVE-2026-107335", "CVE-2026-107334", "CVE-2026-107333", "CVE-2026-107362" ], "truncated": false }, { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "title": "Red Lion Controls N-Tron 700 Series (Update A) | CISA", "relatedCves": [ "CVE-2026-32645", "CVE-2026-39460", "CVE-2026-28745", "CVE-2026-33367", "CVE-2026-29797", "CVE-2026-39453", "CVE-2026-33272" ], "truncated": true }, { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "title": "Eclipse Foundation Eclipse Milo | CISA", "relatedCves": [ "CVE-2026-63252", "CVE-2026-63248", "CVE-2026-60007", "CVE-2026-62927", "CVE-2026-58080", "CVE-2026-61387" ], "truncated": false }, { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "title": "Guangzhou Juan IoT Technology EseeCloud | CISA", "relatedCves": [ "CVE-2026-107617", "CVE-2026-97858", "CVE-2026-105664" ], "truncated": false }, { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "title": "Thermo Fisher Torrent Suite Software | CISA", "relatedCves": [ "CVE-2026-107777" ], "truncated": false }, { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "title": "J4Care dcm4che | CISA", "relatedCves": [ "CVE-2026-97851", "CVE-2026-107621", "CVE-2026-105273", "CVE-2026-101021", "CVE-2026-105279", "CVE-2026-105667" ], "truncated": false } ] }, "relatedCves": [ "CVE-2026-107336", "CVE-2026-107361", "CVE-2026-107337", "CVE-2026-107335", "CVE-2026-107334", "CVE-2026-107333", "CVE-2026-107362", "CVE-2026-32645", "CVE-2026-39460", "CVE-2026-28745", "CVE-2026-33367", "CVE-2026-29797", "CVE-2026-39453", "CVE-2026-33272", "CVE-2026-63252", "CVE-2026-63248", "CVE-2026-60007", "CVE-2026-62927", "CVE-2026-58080", "CVE-2026-61387", "CVE-2026-107617", "CVE-2026-97858", "CVE-2026-105664", "CVE-2026-107777", "CVE-2026-97851", "CVE-2026-107621", "CVE-2026-105273", "CVE-2026-101021", "CVE-2026-105279", "CVE-2026-105667" ], "sourceSummary": "米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T03:49:22.000Z", "reviewState": "current", "summary": "対象はMalcolm、Red Lion N-Tron 700、Eclipse Milo、EseeCloud、Torrent Suite、dcm4chee-arc-lightです。製品と版を確認して該当項目だけを見てください。修正のある製品と、開発元への確認が必要な製品を区別しています。", "risk": "Malcolmには認証・アクセス制御などの問題、N-Tronには管理アクセスや再起動、Miloにはデータ・認証情報・サービス継続への問題、EseeCloudにはカメラ制御の問題があります。Torrent Suiteはログインした攻撃者によるファイル読み取り、dcm4cheeは医療画像や患者情報などへの影響です。", "applicability": [ { "text": "MalcolmはCVE-2026-107336・107361・107337・107335・107334についてv26.07.1以下、CVE-2026-107333・107362についてv26.08.0以下が対象です。認証を経由しない経路、ログイン済み利用者の権限制限回避、サーバーからの不正な通信、圧縮データ処理など、問題ごとに条件が異なります。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Red Lion N-Tron 700 SeriesはFirmware 3.11.0以下、Bootloader 2.0.6.1以下が掲載されています。認証情報・SNMP/TFTP・Web管理などの問題により、設定を読み書きされたり再起動を繰り返させられたりするおそれがあります。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01" ], "evidenceIds": [ "E3", "E4" ] }, { "text": "Eclipse MiloはCVE-2026-63252・63248・60007が0.6.0〜1.1.4、CVE-2026-62927・58080・61387が1.0.0〜1.1.4です。匿名セッションの許可、RoleMapperのcopy()による設定、Basic128Rsa15のユーザー名トークンなど、CVEごとに条件があります。例えば監視項目の枠を使い切る問題は新しい監視項目の作成を妨げますが、既存項目と他のサーバー機能には影響しないと説明されています。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01" ], "evidenceIds": [ "E5", "E6" ] }, { "text": "EseeCloud App 4.9.6以下、EseeCloud Firmware 4.9.86.0以下では、固定認証情報などによりIPカメラを制御される可能性があります。Torrent Suite Software 5.18以下では、ログイン済み攻撃者がWebサービス用アカウントの権限で読めるファイルを取得できる可能性があります。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01" ], "evidenceIds": [ "E7", "E8", "E9" ] }, { "text": "J4Care dcm4chee-arc-light 5.35.1が掲載されています。医療画像の削除、患者情報の露出、偽の検査情報の登録・患者の付け替え、ファイルの上書き、サービス停止など、複数の処理に問題があります。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02" ], "evidenceIds": [ "E10", "E11", "E12" ] }, { "text": "利用中の製品名・型番・完全な版番号を確認し、自分の製品の項目だけを照合してください。複数製品をまとめた告知では、別製品の修正版や対策を流用しません。分からない項目は管理担当者にこのページを渡して確認します。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU96928590/" ], "evidenceIds": [ "E13", "E14", "E15", "E16", "E17" ] }, { "text": "最初に「CISA ICS Advisory / ICS Medical Advisory（2026年10月15日）」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU96928590/" ] } ], "versionChecks": [ { "text": "「CISA ICS Advisory / ICS Medical Advisory（2026年10月15日）」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU96928590/" ] } ], "actions": [ { "text": "Malcolmの最初の5件はv26.08.0で修正、CVE-2026-107333・107362はv26.09.0で修正されています。v26.08.0へ更新しただけで全件対応済みとはせず、後者を含む更新を確認します。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01" ], "evidenceIds": [ "E1", "E18", "E19" ] }, { "text": "N-Tron 700は3.11.1以降へ更新し、SNMP communitiesの設定または無効化、Web GUIへのアクセス無効化も開発元が勧めています。設備の管理経路への影響を担当者が確認して適用します。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01" ], "evidenceIds": [ "E3", "E20" ] }, { "text": "Eclipse Miloは1.1.5以降へ更新します。0.6.x系列には修正版がないと公表されているため、0.6.xを使う場合も1.1.5以降への移行が必要です。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01" ], "evidenceIds": [ "E5", "E21", "E22" ] }, { "text": "EseeCloudは開発元がCISAの調整に応答しなかったと公表されています。修正版番号を推測せず、Guangzhou Juanへ対象機器とアプリ・ファームウェアの版を伝え、対応状況を問い合わせてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02" ], "evidenceIds": [ "E7", "E23" ] }, { "text": "Torrent Suite Softwareは5.22以降へ、dcm4chee-arc-lightは5.35.2以降へ更新するよう、それぞれの開発元が勧めています。", "kind": "fix", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02" ], "evidenceIds": [ "E9", "E10", "E12" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU96928590/" ] } ], "temporaryMitigations": [], "verification": [ { "text": "担当者から、対象だった製品・適用した修正や設定・反映日時を回答してもらいます。製品ごとの公式情報と照合してから完了とし、通常業務が続けられることも確認してください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/vu/JVNVU96928590/" ], "evidenceIds": [ "E13", "E14", "E15", "E16", "E17" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU96928590/" ] } ], "unknowns": [ "公表時点の公式資料を照合した説明です。実際の機器や設定を検査した結果ではありません。修正版や対応状況は製品・系列ごとに確認してください。", "医療・産業機器では、接続先や業務停止の影響を管理担当者と確認してから更新します。Miloの「〜」は両端を含みます。" ], "supportRequest": "件名：JVNVU96928590（CISA ICS Advisory / ICS Medical Advisory（2026年10月15日））の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nJVNVU96928590について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVNVU96928590", "sources": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "label": "公的機関・開発元の個別告知" }, { "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU96928590/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "reviewedSourceFingerprint": "reviewed-source-v1:b4d06167e74b70930f098d0f51b188dabc6946159c0d7e392aa78a92b96e419f", "reviewedSourceScope": "official_evidence", "evidence": [ { "id": "E1", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "CISA Malcolm | CISA\n\nSummary\n\nThe following versions of CISA Malcolm are affected:\n\nMalcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334)\n\nMalcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362)\n\nCVSS\nVendor\nEquipment\n\nv3 8.1\nCISA\nMalcolm\n\n6 Vulnerabilities\n\nAuthentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Data Amplification)\n\nBackground\n\nCritical Infrastructure Sectors: Energy, Information Technology, Water and Wastewater Systems\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: United States\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-107336\n\nMalcolm's front nginx reverse proxy defines a \"Dashboards → Arkime shortcut\" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the", "language": "en" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "CISA Malcolm | CISA\n\nSummary\n\nThe following versions of CISA Malcolm are affected:\n\nMalcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334)\n\nMalcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362)\n\nCVSS\nVendor\nEquipment\n\nv3 8.1\nCISA\nMalcolm\n\n6 Vulnerabilities\n\nAuthentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Dat", "language": "en" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "Red Lion Controls N-Tron 700 Series (Update A) | CISA\n\nSummary\n\nSuccessful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to reboot by navigating to a specific URL on the device. This action can be scripted on the malicious user's local machine to cause continuous rebooting of the switch.\n\nThe following versions of Red Lion Controls N-Tron 700 Series are affected:\n\n700 Series <=Firmware_3.11.0 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272)\n\n700 Series <=Bootloader_2.0.6.1 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272)\n\nCVSS\nVendor\nEquipment\n\nv3 8.3\nRed Lion Controls\n700 Series\n\n7 Vulnerabilities\n\nUse of Hard-coded Credentials, Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format, Missing Authentication for Critical Function, Download of Code Without Integrity Check, Reachable Assertion, Authentication Bypass Using an Alternate Path or Channel\n\nBackground\n\nCritical Infrastructure", "language": "en" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "local machine to cause continuous rebooting of the switch.\n\nThe following versions of Red Lion Controls N-Tron 700 Series are affected:\n\n700 Series <=Firmware_3.11.0 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272)\n\n700 Series <=Bootloader_2.0.6.1 (CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272)\n\nCVSS\nVendor\nEquipment\n\nv3 8.3\nRed Lion Controls\n700 Series\n\n7 Vulnerabilities\n\nUse of Hard-coded Credentials, Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format, Missing Authen", "language": "en" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "Eclipse Foundation Eclipse Milo | CISA\n\nSummary\n\nSuccessful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.\n\nThe following versions of Eclipse Foundation Eclipse Milo are affected:\n\nEclipse Milo >=0.6.0|<=1.1.4 (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007)\n\nEclipse Milo >=1.0.0|<=1.1.4 (CVE-2026-62927, CVE-2026-58080, CVE-2026-61387)\n\nCVSS\nVendor\nEquipment\n\nv3 8.2\nEclipse Foundation\nEclipse Milo\n\n5 Vulnerabilities\n\nIncorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization, Observable Response Discrepancy, Missing Release of Resource after Effective Lifetime\n\nBackground\n\nCritical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Belgium\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-62927\n\nIn Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching", "language": "en" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "gitimate users, or cause the server to stop responding to all clients.\n\nThe following versions of Eclipse Foundation Eclipse Milo are affected:\n\nEclipse Milo >=0.6.0|<=1.1.4 (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007)\n\nEclipse Milo >=1.0.0|<=1.1.4 (CVE-2026-62927, CVE-2026-58080, CVE-2026-61387)\n\nCVSS\nVendor\nEquipment\n\nv3 8.2\nEclipse Foundation\nEclipse Milo\n\n5 Vulnerabilities\n\nIncorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization, Observable Response Discrepancy, Missing Release of Resource after Effective Lifetime\n\nBackground\n\nCrit", "language": "en" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "Guangzhou Juan IoT Technology EseeCloud | CISA\n\nSummary\n\nSuccessful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras.\n\nThe following versions of Guangzhou Juan IoT Technology EseeCloud are affected:\n\nEseeCloud App <=4.9.6 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664)\n\nEseeCloud Firmware <=4.9.86.0 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664)\n\nCVSS\nVendor\nEquipment\n\nv3 9.8\nGuangzhou Juan IoT Technology Co., Ltd.\nEseeCloud App\n\n3 Vulnerabilities\n\nUse of Hard-coded Credentials, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Observable Response Discrepancy\n\nBackground\n\nCritical Infrastructure Sectors: Energy, Communications, Transportation Systems, Financial Services, Government Services and Facilities\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: China\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-107617\n\nAn attacker can use a hard-coded credential to log in to EseeCloud devices.\n\nRead More\n\n2 Affected Products\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. E", "language": "en" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "d allow an attacker to gain control over affected IP cameras.\n\nThe following versions of Guangzhou Juan IoT Technology EseeCloud are affected:\n\nEseeCloud App <=4.9.6 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664)\n\nEseeCloud Firmware <=4.9.86.0 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664)\n\nCVSS\nVendor\nEquipment\n\nv3 9.8\nGuangzhou Juan IoT Technology Co., Ltd.\nEseeCloud App\n\n3 Vulnerabilities\n\nUse of Hard-coded Credentials, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Observable Response Discrepancy\n\nBackground\n\nCritica", "language": "en" }, { "id": "E9", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "Thermo Fisher Torrent Suite Software | CISA\n\nSummary\n\nSuccessful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server.\n\nThe following versions of Thermo Fisher Torrent Suite Software are affected:\n\nTorrent Suite Software <=5.18 (CVE-2026-107777)\n\nCVSS\nVendor\nEquipment\n\nv3 6.5\nThermo Fisher\nTorrent Suite Software\n\n1 Vulnerability\n\nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\n\nBackground\n\nCritical Infrastructure Sectors: Healthcare and Public Health\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: United States\n\nVulnerabilities\n\nCVE-2026-107777\n\nThe affected product is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.\n\nRead More\n\n1 Affected Product\n\nThermo Fisher Torrent Suite Software: <=5.18\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThermo Fisher has fixed the vulnerability and recommends users update Torrent Suite Software to version 5.22 or later.\n\nMitigation\nFor more information, refer to Thermo Fisher's Security bulletin.\n\nAdditional Metrics\n\nRelevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\n\n4.0\n7.1\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details", "language": "en" }, { "id": "E10", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "J4Care dcm4che | CISA\n\nSummary\n\nSuccessful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition.\n\nThe following versions of J4Care dcm4che are affected:\n\ndcm4chee-arc-light 5.35.1 (CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, CVE-2026-105667)\n\nCVSS\nVendor\nEquipment\n\nv3 9.1\nJ4Care\ndcm4chee-arc-light\n\n4 Vulnerabilities\n\nMissing Authorization, Loop with Unreachable Exit Condition ('Infinite Loop'), Inefficient Algorithmic Complexity, Missing Authentication for Critical Function\n\nBackground\n\nCritical Infrastructure Sectors: Healthcare and Public Health\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Austria\n\nVulnerabilities\n\nExpand All +\n\nCVE-2026-97851\n\nThe storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.\n\nRead More\n\n1 Affected Product", "language": "en" }, { "id": "E11", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "reassign patient records, overwrite files, and cause a denial-of-service condition.\n\nThe following versions of J4Care dcm4che are affected:\n\ndcm4chee-arc-light 5.35.1 (CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, CVE-2026-105667)\n\nCVSS\nVendor\nEquipment\n\nv3 9.1\nJ4Care\ndcm4chee-arc-light\n\n4 Vulnerabilities\n\nMissing Authorization, Loop with Unreachable Exit Condition ('Infinite Loop'), Inefficient Algorithmic Complexity, Missing Authentication fo", "language": "en" }, { "id": "E12", "sourceUrl": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "ted Product\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-862 Missing Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n\n4.0\n8.8\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107621\n\nJPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.\n\nRead More\n\n2 Affected Products\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nJ4Care dcm4chee-arc-light: 5.35.1\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nJ4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n4.0\n9.3\nCRITICAL\nCVSS:4.0/AV", "language": "en" }, { "id": "E13", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourceField": "section:概要", "excerpt": "米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。", "language": "ja" }, { "id": "E14", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourceField": "section:影響を受けるシステム", "excerpt": "ICS Advisory / ICS Medical Advisoryを参照してください。", "language": "ja" }, { "id": "E15", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourceField": "section:詳細情報", "excerpt": "新規：5件\n\nICSA-26-280-01: CISA Malcolm\n\nICSA-26-288-01: Eclipse Foundation Eclipse Milo\n\nICSA-26-288-02: Guangzhou Juan IoT Technology EseeCloud\n\nICSMA-26-288-01: Thermo Fisher Torrent Suite Software\n\nICSMA-26-288-02: J4Care dcm4che\n\n更新：1件\n\nICSA-26-281-01: Red Lion Controls N-Tron 700 Series (Update A)", "language": "ja" }, { "id": "E16", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourceField": "section:想定される影響", "excerpt": "ICS Advisory / ICS Medical Advisoryを参照してください。", "language": "ja" }, { "id": "E17", "sourceUrl": "https://jvn.jp/vu/JVNVU96928590/", "sourceField": "section:対策方法", "excerpt": "ICS Advisory / ICS Medical Advisoryを参照してください。", "language": "ja" }, { "id": "E18", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "ing versions of CISA Malcolm are affected:\n\nMalcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334)\n\nMalcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362)\n\nCVSS\nVendor\nEquipment\n\nv3 8.1\nCISA\nMalcolm\n\n6 Vulnerabilities\n\nAuthentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Dat", "language": "en" }, { "id": "E19", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "e\n\n1 Affected Product\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-290 Authentication Bypass by Spoofing\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n4.0\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107333\n\nMalcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.\n\nRead More\n\n2 Affected Products\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.09.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-863 Incorrect Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\n\n4.0\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107362\n\nMalcolm file-upload component ship", "language": "en" }, { "id": "E20", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "ed Lion Controls 700 Series: <=Firmware_3.11.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nRed Lion Controls 700 Series: <=Bootloader_2.0.6.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nRed Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.\n\nMitigation\nThe upgrade procedure document can be found at https://www.hms-networks.com/.\n\nMitigation\nThe advisory issued by HMS Networks regarding these vulnerabilities can be found at https://www.hms-networks.com/cybersecurity.\n\nAdditional Metrics\n\nRelevant CWE: CWE-798 Use of Hard-coded Credentials\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1", "language": "en" }, { "id": "E21", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "gitimate users, or cause the server to stop responding to all clients.\n\nThe following versions of Eclipse Foundation Eclipse Milo are affected:\n\nEclipse Milo >=0.6.0|<=1.1.4 (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007)\n\nEclipse Milo >=1.0.0|<=1.1.4 (CVE-2026-62927, CVE-2026-58080, CVE-2026-61387)\n\nCVSS\nVendor\nEquipment\n\nv3 8.2\nEclipse Foundation\nEclipse Milo\n\n5 Vulnerabilities\n\nIncorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization", "language": "en" }, { "id": "E22", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "lipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.\n\nMitigation\nFor users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.\n\nAdditional Metrics\n\nRelevant CWE: CWE-863 Incorrect Authorization\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n4.0\n8.7\nHIGH\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-63252\n\nIn Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.\n\nRead More\n\n2 Affected Products\n\nEclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nEclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThe Eclipse Foundation recommends users upgrade to Eclipse Mi", "language": "en" }, { "id": "E23", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "oT Technology Co., Ltd. EseeCloud App: <=4.9.6\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nGuangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware: <=4.9.86.0\n\nProduct Status: known_affected\n\nRemediations\n\nMitigation\nGuangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.\n\nAdditional Metrics\n\nRelevant CWE: CWE-798 Use of Hard-coded Credentials\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n9.8\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n4.0\n9.3\nCRITICAL\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-97858\n\nAn attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.\n\nRead More\n\n4 Affected Products\n\nGuangzhou Juan IoT Technology Co., Lt", "language": "en" }, { "id": "E24", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "e\n\n1 Affected Product\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.08.0\n\nAdditional Metrics\n\nRelevant CWE: CWE-290 Authentication Bypass by Spoofing\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n4.0\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nView CVE Details\n\nCVE-2026-107333\n\nMalcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.\n\nRead More\n\n2 Affected Products\n\nCISA Malcolm <=v26.07.1\n\nProduct Status: known_affected\n\nRemediations\n\nCISA Malcolm <=v26.08.0\n\nProduct Status: known_affected\n\nRemediations\n\nVendor fix\nThis vulnerability was patched in Malcolm Version v26.09.0\n\nAdditional Metrics\n\nRelevant C", "language": "en" } ], "summaryEvidenceIds": [ "E1", "E24", "E3", "E20", "E5", "E22", "E7", "E23", "E9", "E10", "E12" ], "riskEvidenceIds": [ "E1", "E24", "E3", "E20", "E5", "E22", "E7", "E23", "E9", "E10", "E12" ], "glossary": [] } }, { "id": "CVE-2025-61624", "aliases": [], "title": "FortiOS / FortiProxy / FortiSwitchManager / FortiPAM：ファイルへの不正アクセス", "summary": "Fortinet FortiOS 7.6.0 から 7.6.4、FortiOS 7.4.0 から 7.4.9、FortiOS 7.2 のすべてのバージョン、FortiOS 7.0 のすべてのバージョン、FortiOS 6.4 のすべてのバージョン、FortiPAM 1.7.0、FortiPAM 1.6 のすべてのバージョン、FortiPAM 1.5 のすべてのバージョン、FortiPAM 1.4 のすべてのバージョン、FortiPAM 1.3 のすべてのバージョン、FortiPAM 1.2 のすべてのバージョン、FortiPAM 1.1 のすべてのバージョン、FortiPAM 1.0 のすべてのバージョン、FortiProxy 7.6.0 から 7.6.4、FortiProxy 7.4.0 から 7.4.11、FortiProxy 7.2 のすべてのバージョン、FortiProxy 7.0 のすべてのバージョン、FortiSwitchManager 7.2.0 から 7.2.7、FortiSwitchManager 7.0.0 から 7.0.6 において、管理者プロファイルを持ち、少なくとも読み書き権限を有する認証済み攻撃者が特定の CLI コマンドを利用して任意のファイルを書き込んだり削除したりできるパス・トラバーサル（Path Traversal）脆弱性が存在する。", "risk": "認証された管理者権限を持つ攻撃者が任意のファイルを書き換え・削除できるため、システムの機能破壊や情報漏洩のリスクがある。", "product": "FortiOS / FortiProxy / FortiSwitchManager / FortiPAM", "category": "other", "component": "package", "severity": "medium", "cvss": 5.4, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C", "affected": [ { "product": "FortiOS", "range": ">= 7.6.0 / <= 7.6.4" }, { "product": "FortiOS", "range": ">= 7.4.0 / <= 7.4.9" }, { "product": "FortiOS", "range": ">= 7.2.0 / <= 7.2.13" }, { "product": "FortiOS", "range": ">= 7.0.0 / <= 7.0.19" }, { "product": "FortiOS", "range": ">= 6.4.0 / <= 6.4.16" }, { "product": "FortiProxy", "range": ">= 7.6.0 / <= 7.6.4" }, { "product": "FortiProxy", "range": ">= 7.4.0 / <= 7.4.11" }, { "product": "FortiProxy", "range": ">= 7.2.0 / <= 7.2.16" }, { "product": "FortiProxy", "range": ">= 7.0.0 / <= 7.0.23" }, { "product": "FortiSwitchManager", "range": ">= 7.2.0 / <= 7.2.7" }, { "product": "FortiSwitchManager", "range": ">= 7.0.0 / <= 7.0.6" }, { "product": "FortiPAM", "range": "1.7.0" }, { "product": "FortiPAM", "range": ">= 1.6.0 / <= 1.6.2" }, { "product": "FortiPAM", "range": ">= 1.5.0 / <= 1.5.1" }, { "product": "FortiPAM", "range": ">= 1.4.0 / <= 1.4.3" }, { "product": "FortiPAM", "range": ">= 1.3.0 / <= 1.3.1" }, { "product": "FortiPAM", "range": "1.2.0" }, { "product": "FortiPAM", "range": ">= 1.1.0 / <= 1.1.2" }, { "product": "FortiPAM", "range": ">= 1.0.0 / <= 1.0.3" } ], "fixed": [], "steps": [ "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiOS を 8.0.0 以上にアップグレードする。", "FortiOS を 7.6.5 以上にアップグレードする。", "FortiOS を 7.4.10 以上にアップグレードする。", "FortiProxy を 7.6.5 以上にアップグレードする。", "FortiProxy を 7.4.12 以上にアップグレードする。", "FortiPAM を 1.8.0 以上にアップグレードする。", "FortiPAM を 1.7.1 以上にアップグレードする。", "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiSwitch を 8.0.0 以上にアップグレードする。", "FortiSwitch を 7.6.5 以上にアップグレードする。", "FortiSwitch を 7.4.9 以上にアップグレードする。", "FortiSwitchManager を 7.2.8 以上にアップグレードする。", "FortiSwitchManager を 7.0.7 以上にアップグレードする。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-61624", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-122", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61624", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-04-14T15:39:51.445Z", "modifiedAt": "2026-10-17T03:55:20.565Z", "fetchedAt": "2026-10-23T02:43:39.704Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiOS", "cpes": [ "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "7.6.4", "status": "affected" }, { "versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.9", "status": "affected" }, { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.13", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.19", "status": "affected" }, { "versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.16", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.23:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.22:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.21:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.20:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "7.6.4", "status": "affected" }, { "versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.11", "status": "affected" }, { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.16", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.23", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSwitchManager", "cpes": [ "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.7", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.6", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiPAM", "cpes": [ "cpe:2.3:o:fortinet:fortipam:1.7.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.5.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "version": "1.7.0", "status": "affected" }, { "versionType": "semver", "version": "1.6.0", "lessThanOrEqual": "1.6.2", "status": "affected" }, { "versionType": "semver", "version": "1.5.0", "lessThanOrEqual": "1.5.1", "status": "affected" }, { "versionType": "semver", "version": "1.4.0", "lessThanOrEqual": "1.4.3", "status": "affected" }, { "versionType": "semver", "version": "1.3.0", "lessThanOrEqual": "1.3.1", "status": "affected" }, { "version": "1.2.0", "status": "affected" }, { "versionType": "semver", "version": "1.1.0", "lessThanOrEqual": "1.1.2", "status": "affected" }, { "versionType": "semver", "version": "1.0.0", "lessThanOrEqual": "1.0.3", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-61624", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "fetchedAt": "2026-10-23T02:43:39.704Z", "publishedAt": "2026-04-14T15:39:51.445Z", "modifiedAt": "2026-10-17T03:55:20.565Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiOS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.6.0", "lessThanOrEqual": "7.6.4", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.4.0", "lessThanOrEqual": "7.4.9", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.2.0", "lessThanOrEqual": "7.2.13", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.0.0", "lessThanOrEqual": "7.0.19", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "6.4.0", "lessThanOrEqual": "6.4.16", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.23:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.22:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.21:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.20:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "7.6.0", "lessThanOrEqual": "7.6.4", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "7.4.0", "lessThanOrEqual": "7.4.11", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "7.2.0", "lessThanOrEqual": "7.2.16", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "7.0.0", "lessThanOrEqual": "7.0.23", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSwitchManager", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "7.2.0", "lessThanOrEqual": "7.2.7", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "7.0.0", "lessThanOrEqual": "7.0.6", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiPAM", "sourcePath": "/containers/cna/affected/3", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:o:fortinet:fortipam:1.7.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.5.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "1.7.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/1", "version": "1.6.0", "lessThanOrEqual": "1.6.2", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/2", "version": "1.5.0", "lessThanOrEqual": "1.5.1", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/3", "version": "1.4.0", "lessThanOrEqual": "1.4.3", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/4", "version": "1.3.0", "lessThanOrEqual": "1.3.1", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/5", "version": "1.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/6", "version": "1.1.0", "lessThanOrEqual": "1.1.2", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/7", "version": "1.0.0", "lessThanOrEqual": "1.0.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to upcoming FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.5 or above\nUpgrade to FortiOS version 7.4.10 or above\nUpgrade to FortiProxy version 7.6.5 or above\nUpgrade to FortiProxy version 7.4.12 or above\nUpgrade to FortiPAM version 1.8.0 or above\nUpgrade to FortiPAM version 1.7.1 or above\nFortinet remediated this issue in FortiSASE version 25.4.b and hence customers do not need to perform any action.\nUpgrade to upcoming FortiSwitch version 8.0.0 or above\nUpgrade to FortiSwitch version 7.6.5 or above\nUpgrade to FortiSwitch version 7.4.9 or above\nUpgrade to FortiSwitchManager version 7.2.8 or above\nUpgrade to FortiSwitchManager version 7.0.7 or above", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "Escalation of privilege", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C", "baseScore": 5.4, "baseSeverity": "MEDIUM", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-122", "label": "https://fortiguard.fortinet.com/psirt/FG-IR-26-122", "tags": [], "provider": "fortinet", "sourcePath": "/containers/cna/references/0" }, { "url": "https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html", "label": "siemens-SADP", "tags": [], "provider": "siemens-SADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.4\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.9\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.19\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.4.0\",\"lessThanOrEqual\":\"6.4.16\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiProxy\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.16:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.14:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.13:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.23:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.22:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.21:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.20:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.4\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.11\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.16\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.23\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSwitchManager\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.7\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.6\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiPAM\",\"cpes\":[\"cpe:2.3:o:fortinet:fortipam:1.7.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.5.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.3.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.7.0\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.6.0\",\"lessThanOrEqual\":\"1.6.2\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.5.0\",\"lessThanOrEqual\":\"1.5.1\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.4.0\",\"lessThanOrEqual\":\"1.4.3\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.3.0\",\"lessThanOrEqual\":\"1.3.1\",\"status\":\"affected\"},{\"version\":\"1.2.0\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.1.0\",\"lessThanOrEqual\":\"1.1.2\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.0.0\",\"lessThanOrEqual\":\"1.0.3\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to upcoming FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.5 or above\nUpgrade to FortiOS version 7.4.10 or above\nUpgrade to FortiProxy version 7.6.5 or above\nUpgrade to FortiProxy version 7.4.12 or above\nUpgrade to FortiPAM version 1.8.0 or above\nUpgrade to FortiPAM version 1.7.1 or above\nFortinet remediated this issue in FortiSASE version 25.4.b and hence customers do not need to perform any action.\nUpgrade to upcoming FortiSwitch version 8.0.0 or above\nUpgrade to FortiSwitch version 7.6.5 or above\nUpgrade to FortiSwitch version 7.4.9 or above\nUpgrade to FortiSwitchManager version 7.2.8 or above\nUpgrade to FortiSwitchManager version 7.0.7 or above", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-22\",\"description\":\"Escalation of privilege\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"LOW\",\"attackVector\":\"LOCAL\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-975644.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html", "sourcePath": "body:advisory", "text": "SSA-975644\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-975644: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-03-10\n\nLast Update:\n\n2026-05-12\n\nCurrent Version:\n\nV1.1\n\nCVSS v3.1 Base Score:\n9.8\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products.\n\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nRUGGEDCOM APE1808\n\nShow more details\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.11\n\naffected by\n\nCVE-2026-24858\n\nUpdate Fortigate NGFW to V7.4.11 or later version. Contact customer support to receive patch and update information\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.10\n\naffected by\n\nmultiple CVEs\n\nCVE-2025-55018\n\nCVE-2025-64157\n\nCVE-2025-61624\n\nUpdate Fortigate NGFW to V7.4.10 or later version. Contact customer support to receive patch and update information\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.10\n\naffected by\n\nCVE-2025-62439\n\nUpdate Fortigate NGFW to V7.4.10 or later version with FSSO TS Agent version 5.0 build 0324 or later version. Contact customer support to receive patch and update information\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.9\n\naffected by\n\nCVE-2025-53847\n\nUpdate Fortigate NGFW to V7.4.9 or later version. Contact customer support to receive patch and update information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-53847\n\nA missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiOS 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or commands via specially crafted packets.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n\nCWE\nCWE-306: Missing Authentication for Critical Function\n\nVulnerability CVE-2025-55018\n\nAn inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header\n\nCVSS v3.1 Base Score\n5.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N\n\nCWE\nCWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')\n\nVulnerability CVE-2025-61624\n\nAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.\n\nCVSS v3.1 Base Score\n6.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H\n\nCWE\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\n\nVulnerability CVE-2025-62439\n\nAn Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations to gain unauthorized access to protected network resources via crafted requests.\n\nCVSS v3.1 Base Score\n4.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N\n\nCWE\nCWE-940: Improper Verification of Source of a Communication Channel\n\nVulnerability CVE-2025-64157\n\nA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0 all versions allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-134: Use of Externally-Controlled Format String\n\nVulnerability CVE-2026-24858\n\nAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-288: Authentication Bypass Using an Alternate Path or Channel\n\nADDITIONAL INFORMATION\n\nSiemens recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications .\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-03-10):\n\nPublication Date\n\nV1.1 (2026-05-12):\n\nAdded CVE-2025-61624 and CVE-2025-53847\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-975644\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCve": "CVE-2025-61624", "relatedCves": [ "CVE-2026-24858", "CVE-2025-55018", "CVE-2025-64157", "CVE-2025-61624", "CVE-2025-62439", "CVE-2025-53847" ] } ], "limits": { "completeness": "official_record_with_linked_advisories", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html", "title": "SSA-975644", "relatedCves": [ "CVE-2026-24858", "CVE-2025-55018", "CVE-2025-64157", "CVE-2025-61624", "CVE-2025-62439", "CVE-2025-53847" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html", "title": "SSA-975644", "relatedCves": [ "CVE-2026-24858", "CVE-2025-55018", "CVE-2025-64157", "CVE-2025-61624", "CVE-2025-62439", "CVE-2025-53847" ], "truncated": false } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-17T03:55:20.565Z", "fetchedAt": "2026-10-23T02:43:39.704Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-10-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "FortiOS / FortiProxy / FortiSwitchManager / FortiPAMにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:41.987Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ec450ef60efedc5db6e4a5be9b67e60075a731c8c2d9a598c23a9f6c8e894119", "sourceModifiedAt": "2026-10-17T03:55:20.565Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Fortinet FortiOS 7.6.0 から 7.6.4、FortiOS 7.4.0 から 7.4.9、FortiOS 7.2 のすべてのバージョン、FortiOS 7.0 のすべてのバージョン、FortiOS 6.4 のすべてのバージョン、FortiPAM 1.7.0、FortiPAM 1.6 のすべてのバージョン、FortiPAM 1.5 のすべてのバージョン、FortiPAM 1.4 のすべてのバージョン、FortiPAM 1.3 のすべてのバージョン、FortiPAM 1.2 のすべてのバージョン、FortiPAM 1.1 のすべてのバージョン、FortiPAM 1.0 のすべてのバージョン、FortiProxy 7.6.0 から 7.6.4、FortiProxy 7.4.0 から 7.4.11、FortiProxy 7.2 のすべてのバージョン、FortiProxy 7.0 のすべてのバージョン、FortiSwitchManager 7.2.0 から 7.2.7、FortiSwitchManager 7.0.0 から 7.0.6 において、管理者プロファイルを持ち、少なくとも読み書き権限を有する認証済み攻撃者が特定の CLI コマンドを利用して任意のファイルを書き込んだり削除したりできるパス・トラバーサル（Path Traversal）脆弱性が存在する。", "risk": "認証された管理者権限を持つ攻撃者が任意のファイルを書き換え・削除できるため、システムの機能破壊や情報漏洩のリスクがある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者は認証済みであること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者は管理者プロファイルを持っていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者は少なくとも読み書き権限を有していること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象製品は FortiOS、FortiPAM、FortiProxy、FortiSwitchManager の上記バージョン範囲に該当すること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.6.0以上、7.6.4以下。影響ありとして記載：7.4.0以上、7.4.9以下。影響ありとして記載：7.2.0以上、7.2.13以下。影響ありとして記載：7.0.0以上、7.0.19以下。影響ありとして記載：6.4.0以上、6.4.16以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Fortinet / FortiProxy。影響ありとして記載：7.6.0以上、7.6.4以下。影響ありとして記載：7.4.0以上、7.4.11以下。影響ありとして記載：7.2.0以上、7.2.16以下。影響ありとして記載：7.0.0以上、7.0.23以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Fortinet / FortiSwitchManager。影響ありとして記載：7.2.0以上、7.2.7以下。影響ありとして記載：7.0.0以上、7.0.6以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Fortinet / FortiPAM。影響ありとして記載：1.7.0。影響ありとして記載：1.6.0以上、1.6.2以下。影響ありとして記載：1.5.0以上、1.5.1以下。影響ありとして記載：1.4.0以上、1.4.3以下。影響ありとして記載：1.3.0以上、1.3.1以下。影響ありとして記載：1.2.0。影響ありとして記載：1.1.0以上、1.1.2以下。影響ありとして記載：1.0.0以上、1.0.3以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E2" ] }, { "text": "「FortiOS / FortiProxy / FortiSwitchManager / FortiPAM」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-61624", "https://fortiguard.fortinet.com/psirt/FG-IR-26-122", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-61624" ] } ], "actions": [ { "text": "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiOS を 8.0.0 以上にアップグレードする。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiOS を 7.6.5 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiOS を 7.4.10 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiProxy を 7.6.5 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiProxy を 7.4.12 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiPAM を 1.8.0 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiPAM を 1.7.1 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiSwitch を 8.0.0 以上にアップグレードする。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiSwitch を 7.6.5 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiSwitch を 7.4.9 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiSwitchManager を 7.2.8 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] }, { "text": "FortiSwitchManager を 7.0.7 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E6" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-61624", "https://fortiguard.fortinet.com/psirt/FG-IR-26-122", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-61624" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-61624", "https://fortiguard.fortinet.com/psirt/FG-IR-26-122", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-61624" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-61624", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-122", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61624", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.4\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.9\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.19\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.4.0\",\"lessThanOrEqual\":\"6.4.16\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiProxy\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.16:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.14:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.13:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.23:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.22:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.21:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.20:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.4\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.11\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.16\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.23\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSwitchManager\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.7\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.6\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiPAM\",\"cpes\":[\"cpe:2.3:o:fortinet:fortipam:1.7.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.5.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.3.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.7.0\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.6.0\",\"lessThanOrEqual\":\"1.6.2\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.5.0\",\"lessThanOrEqual\":\"1.5.1\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.4.0\",\"lessThanOrEqual\":\"1.4.3\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.3.0\",\"lessThanOrEqual\":\"1.3.1\",\"status\":\"affected\"},{\"version\":\"1.2.0\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.1.0\",\"lessThanOrEqual\":\"1.1.2\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"1.0.0\",\"lessThanOrEqual\":\"1.0.3\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61624.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to upcoming FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.5 or above\nUpgrade to FortiOS version 7.4.10 or above\nUpgrade to FortiProxy version 7.6.5 or above\nUpgrade to FortiProxy version 7.4.12 or above\nUpgrade to FortiPAM version 1.8.0 or above\nUpgrade to FortiPAM version 1.7.1 or above\nFortinet remediated this issue in FortiSASE version 25.4.b and hence customers do not need to perform any action.\nUpgrade to upcoming FortiSwitch version 8.0.0 or above\nUpgrade to FortiSwitch version 7.6.5 or above\nUpgrade to FortiSwitch version 7.4.9 or above\nUpgrade to FortiSwitchManager version 7.2.8 or above\nUpgrade to FortiSwitchManager version 7.0.7 or above", "language": "en", "representation": "source_excerpt" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-61624\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-61624（FortiOS / FortiProxy / FortiSwitchManager / FortiPAM）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者は認証済みであること。\n・攻撃者は管理者プロファイルを持っていること。\n・攻撃者は少なくとも読み書き権限を有していること。\n・対象製品は FortiOS、FortiPAM、FortiProxy、FortiSwitchManager の上記バージョン範囲に該当すること。\n・公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.6.0以上、7.6.4以下。影響ありとして記載：7.4.0以上、7.4.9以下。影響ありとして記載：7.2.0以上、7.2.13以下。影響ありとして記載：7.0.0以上、7.0.19以下。影響ありとして記載：6.4.0以上、6.4.16以下。\n・公式の対象表：Fortinet / FortiProxy。影響ありとして記載：7.6.0以上、7.6.4以下。影響ありとして記載：7.4.0以上、7.4.11以下。影響ありとして記載：7.2.0以上、7.2.16以下。影響ありとして記載：7.0.0以上、7.0.23以下。\n・公式の対象表：Fortinet / FortiSwitchManager。影響ありとして記載：7.2.0以上、7.2.7以下。影響ありとして記載：7.0.0以上、7.0.6以下。\n・公式の対象表：Fortinet / FortiPAM。影響ありとして記載：1.7.0。影響ありとして記載：1.6.0以上、1.6.2以下。影響ありとして記載：1.5.0以上、1.5.1以下。影響ありとして記載：1.4.0以上、1.4.3以下。影響ありとして記載：1.3.0以上、1.3.1以下。影響ありとして記載：1.2.0。影響ありとして記載：1.1.0以上、1.1.2以下。影響ありとして記載：1.0.0以上、1.0.3以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-61624\n\n公式資料で追加確認が必要な点：\n・公式情報では 8.0.0 が公開予定または未リリースとして記載されています。", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [ { "code": "planned_release", "text": "公式情報では 8.0.0 が公開予定または未リリースとして記載されています。", "evidenceIds": [ "E6" ] } ], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:41.987Z", "lastSuccess": "2026-10-23T03:37:41.987Z", "sourceCheckedAt": "2026-10-23T02:43:39.704Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-102764", "aliases": [], "title": "Remote Support：脆弱性情報", "summary": "BeyondTrust Remote Support の内部メッセージングコンポーネントは、受信したメッセージの送信元を十分に検証しませんでした。適切な条件下では、攻撃者がアプライアンス上でファイル操作を行える可能性があります。", "risk": "攻撃者がアプライアンス上のファイルを操作できる可能性があります。", "product": "Remote Support", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "BT", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "Remote Support", "range": "<= 26.2.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "label": "CVE：BT" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-102764", "label": "CVE公式レコード" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102764", "label": "CISAが示す関連情報" }, { "url": "https://www.beyondtrust.com/blog/entry/bt26-05", "label": "CVE掲載の参考情報" }, { "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066", "label": "CVE掲載の参考情報" }, { "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-05", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-15T20:30:32.240Z", "modifiedAt": "2026-10-17T03:55:27.214Z", "fetchedAt": "2026-10-23T02:43:40.966Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.", "sourceTitle": "Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "BeyondTrust", "product": "Remote Support", "versions": [ { "status": "affected", "version": "0", "lessThanOrEqual": "26.2.3", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-102764", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "fetchedAt": "2026-10-23T02:43:40.966Z", "publishedAt": "2026-10-15T20:30:32.240Z", "modifiedAt": "2026-10-17T03:55:27.214Z", "state": "published", "provider": "BT", "title": "Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support", "descriptions": [ { "lang": "en", "value": "The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "BeyondTrust", "product": "Remote Support", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "26.2.3", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-290", "lang": "en", "description": "CWE-290 Authentication bypass by spoofing", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "BT", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102764", "label": "BT", "tags": [], "provider": "BT", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.beyondtrust.com/blog/entry/bt26-05", "label": "BT", "tags": [], "provider": "BT", "sourcePath": "/containers/cna/references/1" }, { "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066", "label": "BT", "tags": [], "provider": "BT", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"BeyondTrust\",\"product\":\"Remote Support\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThanOrEqual\":\"26.2.3\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-290\",\"description\":\"CWE-290 Authentication bypass by spoofing\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-17T03:55:27.214Z", "fetchedAt": "2026-10-23T02:43:40.966Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-10-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Remote Supportに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:12.661Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "fd9bc10673efdc440b6ade6fef848d7103b19bc6d9a2fcd95a24c387dccb8fe1", "sourceModifiedAt": "2026-10-17T03:55:27.214Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "BeyondTrust Remote Support の内部メッセージングコンポーネントは、受信したメッセージの送信元を十分に検証しませんでした。適切な条件下では、攻撃者がアプライアンス上でファイル操作を行える可能性があります。", "risk": "攻撃者がアプライアンス上のファイルを操作できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "BeyondTrust Remote Support の内部メッセージングコンポーネントが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 26.2.3 以下のすべてのリリースが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：BeyondTrust / Remote Support。影響ありとして記載：26.2.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Remote Support」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-102764", "https://nvd.nist.gov/vuln/detail/CVE-2026-102764", "https://www.beyondtrust.com/blog/entry/bt26-05", "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764", "https://www.beyondtrust.com/trust-center/security-advisories/bt26-05", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-102764", "https://nvd.nist.gov/vuln/detail/CVE-2026-102764", "https://www.beyondtrust.com/blog/entry/bt26-05", "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764", "https://www.beyondtrust.com/trust-center/security-advisories/bt26-05", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-102764", "https://nvd.nist.gov/vuln/detail/CVE-2026-102764", "https://www.beyondtrust.com/blog/entry/bt26-05", "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764", "https://www.beyondtrust.com/trust-center/security-advisories/bt26-05", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "label": "CVE：BT" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-102764", "label": "CVE公式レコード" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102764", "label": "CISAが示す関連情報" }, { "url": "https://www.beyondtrust.com/blog/entry/bt26-05", "label": "CVE掲載の参考情報" }, { "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066", "label": "CVE掲載の参考情報" }, { "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-05", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "sourceField": "/containers/cna/title", "excerpt": "Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102764.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"BeyondTrust\",\"product\":\"Remote Support\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThanOrEqual\":\"26.2.3\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-102764\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-102764（Remote Support）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・BeyondTrust Remote Support の内部メッセージングコンポーネントが対象です。\n・バージョン 26.2.3 以下のすべてのリリースが影響を受けます。\n・公式の対象表：BeyondTrust / Remote Support。影響ありとして記載：26.2.3以下の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-102764", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:12.661Z", "lastSuccess": "2026-10-23T03:21:12.661Z", "sourceCheckedAt": "2026-10-23T02:43:40.966Z", "errorCode": null }, "glossary": [] } }, { "id": "JVN48627289", "aliases": [], "title": "スマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」におけるオープンリダイレクトの脆弱性", "summary": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、オープンリダイレクトの脆弱性が存在します。", "risk": "webブラウザーから細工されたURLにアクセスすることで当該アプリが起動され、その画面内に攻撃者が用意したウェブサイトが表示される可能性があります。結果として、フィッシングなどの被害にあう可能性があります。", "product": "スマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "アップデートする\n\n製品開発者が提供する情報をもとに、最新版へアップデートしてください。", "「JVN48627289」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN48627289/", "label": "JVNの原文" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-15T03:00:30.000Z", "modifiedAt": "2026-10-15T03:00:30.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、オープンリダイレクトの脆弱性が存在します。", "sourceTitle": "スマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」におけるオープンリダイレクトの脆弱性", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-15T03:00:30.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-15T03:00:30.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVN48627289", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "fetchedAt": "2026-10-23T02:43:53.938Z", "publishedAt": "2026-10-14T15:00:00.000Z", "modifiedAt": "2026-10-14T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVN#48627289\n\nスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」におけるオープンリダイレクトの脆弱性", "descriptions": [ { "lang": "ja", "value": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、オープンリダイレクトの脆弱性が存在します。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、次の脆弱性が存在します。\n\nオープンリダイレクト（ CWE-601 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 基本値 4.3\n\nCVE-2026-72528", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "webブラウザーから細工されたURLにアクセスすることで当該アプリが起動され、その画面内に攻撃者が用意したウェブサイトが表示される可能性があります。結果として、フィッシングなどの被害にあう可能性があります。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "Androidアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」2.436.0より前のバージョン\n\niOSアプリ「Creema（クリーマ）- ハンドメイドマーケットプレイスアプリ」2.432.0より前のバージョン", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "アップデートする\n\n製品開発者が提供する情報をもとに、最新版へアップデートしてください。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://cwe.mitre.org/data/definitions/601.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://play.google.com/store/apps/details?id=jp.creema.creema_android&hl=ja", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://apps.apple.com/jp/app/id916614208", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-72528", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2026-000117", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、オープンリダイレクトの脆弱性が存在します。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "Androidアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」2.436.0より前のバージョン\n\niOSアプリ「Creema（クリーマ）- ハンドメイドマーケットプレイスアプリ」2.432.0より前のバージョン", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、次の脆弱性が存在します。\n\nオープンリダイレクト（ CWE-601 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 基本値 4.3\n\nCVE-2026-72528", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "webブラウザーから細工されたURLにアクセスすることで当該アプリが起動され、その画面内に攻撃者が用意したウェブサイトが表示される可能性があります。結果として、フィッシングなどの被害にあう可能性があります。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "アップデートする\n\n製品開発者が提供する情報をもとに、最新版へアップデートしてください。", "sourcePath": "section:対策方法" }, { "heading": "ベンダ情報", "value": "ベンダ\n\nリンク\n\n株式会社クリーマ\n\nハンドメイドマーケットアプリ - Creema（クリーマ）- Google Play のアプリ\n\nCreema（クリーマ）- ハンドメイドマーケットプレイスアプリ- App Store", "sourcePath": "section:ベンダ情報" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourcePath": "section:概要", "text": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、オープンリダイレクトの脆弱性が存在します。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourcePath": "section:影響を受けるシステム", "text": "Androidアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」2.436.0より前のバージョン\n\niOSアプリ「Creema（クリーマ）- ハンドメイドマーケットプレイスアプリ」2.432.0より前のバージョン", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourcePath": "section:詳細情報", "text": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、次の脆弱性が存在します。\n\nオープンリダイレクト（ CWE-601 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 基本値 4.3\n\nCVE-2026-72528", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourcePath": "section:想定される影響", "text": "webブラウザーから細工されたURLにアクセスすることで当該アプリが起動され、その画面内に攻撃者が用意したウェブサイトが表示される可能性があります。結果として、フィッシングなどの被害にあう可能性があります。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourcePath": "section:対策方法", "text": "アップデートする\n\n製品開発者が提供する情報をもとに、最新版へアップデートしてください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:ベンダ情報", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourcePath": "section:ベンダ情報", "text": "ベンダ\n\nリンク\n\n株式会社クリーマ\n\nハンドメイドマーケットアプリ - Creema（クリーマ）- Google Play のアプリ\n\nCreema（クリーマ）- ハンドメイドマーケットプレイスアプリ- App Store", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "related:CVE-2026-72528:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72528.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"CREEMA LTD.\",\"product\":\"\\\"Handmade Marketplace App - Creema\\\" for Android\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThan\":\"2.436.0\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-72528" }, { "evidenceId": "related:CVE-2026-72528:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72528.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"CREEMA LTD.\",\"product\":\"\\\"Creema - Handmade Marketplace App\\\" for iOS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThan\":\"2.432.0\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-72528" }, { "evidenceId": "related:CVE-2026-72528:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72528.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "\"Handmade Marketplace App - Creema\" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-72528" }, { "evidenceId": "related:CVE-2026-72528:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72528.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"URL redirection to untrusted site ('Open Redirect')\",\"lang\":\"en-US\",\"cweId\":\"CWE-601\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-72528" }, { "evidenceId": "related:CVE-2026-72528:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72528.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":4.3,\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-72528" }, { "evidenceId": "related:CVE-2026-72528:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72528.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.1,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-72528" } ], "limits": { "completeness": "official_article_with_linked_advisories", "truncatedFields": [], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2026-72528" ], "supplementarySources": [ { "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72528.json", "id": "CVE-2026-72528", "modifiedAt": "2026-10-15T14:09:44.035Z" } ], "relatedDocuments": [ { "type": "cve", "id": "CVE-2026-72528", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/72xxx/CVE-2026-72528.json", "modifiedAt": "2026-10-15T14:09:44.035Z", "affected": [ { "vendor": "CREEMA LTD.", "product": "\"Handmade Marketplace App - Creema\" for Android", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "2.436.0", "versionType": "semver", "status": "affected" } ] }, { "vendor": "CREEMA LTD.", "product": "\"Creema - Handmade Marketplace App\" for iOS", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThan": "2.432.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [] } ] }, "relatedCves": [ "CVE-2026-72528" ], "sourceSummary": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、オープンリダイレクトの脆弱性が存在します。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:12.802Z", "sourceFingerprint": "8de47ac7e56b8bf6007087218ee7a231a7f4b5c562dc38acc1a8563b461a6d00", "generatorVersion": "2026-10-23.3", "sourceModifiedAt": "2026-10-15T03:00:30.000Z", "verificationMethod": "official_japanese_source_with_structured_checks", "summary": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、オープンリダイレクトの脆弱性が存在します。", "risk": "webブラウザーから細工されたURLにアクセスすることで当該アプリが起動され、その画面内に攻撃者が用意したウェブサイトが表示される可能性があります。結果として、フィッシングなどの被害にあう可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "JVNが公表している対象範囲です。\nAndroidアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」2.436.0より前のバージョン\n\niOSアプリ「Creema（クリーマ）- ハンドメイドマーケットプレイスアプリ」2.432.0より前のバージョン", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN48627289/" ], "evidenceIds": [ "E3" ] }, { "text": "利用中の製品名・開発元・版を、この対象範囲と照らし合わせてください。OSや製品の種類、機能の設定、例外の記載がある場合は、番号だけでなくその条件も確認します。自分で判断できない場合は、下の確認メモを管理担当者に渡してください。", "kind": "check", "sourceUrls": [ "https://jvn.jp/jp/JVN48627289/" ], "evidenceIds": [ "E3" ] }, { "text": "公表されたCVSS評価では、攻撃前に対象システムの権限を持っている必要はありません。他の構成・機能の条件まで不要という意味ではありません。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN48627289/" ], "evidenceIds": [ "E4" ] }, { "text": "公表されたCVSS評価では、ネットワーク越しに攻撃が届く経路があります。あなたの環境がインターネットから到達可能かどうかは、公開設定を別に確認する必要があります。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN48627289/" ], "evidenceIds": [ "E4" ] }, { "text": "公表されたCVSS評価では、利用者が特定の操作を進んで行うことが必要です。必要な操作は個別の説明と照合してください。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN48627289/" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "「スマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN48627289/" ] } ], "actions": [ { "text": "アップデートする\n\n製品開発者が提供する情報をもとに、最新版へアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN48627289/" ], "evidenceIds": [ "E5" ] }, { "text": "「JVN48627289」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN48627289/" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN48627289/" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN48627289/" ] } ], "verification": [ { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN48627289/" ] } ], "unknowns": [ "これはJVNが公表した対象・影響・対策を整理した案内です。利用中の環境を検査した結果ではありません。対象外と判断するときは、製品・版だけでなく、設定や権限などの条件も照合してください。", "公表時点の対策を掲載しています。現在提供されている修正とサポート状況は、利用中の製品・系列に合わせて管理担当者に確認してください。対象範囲の上限だけから、修正版の番号を推測しないでください。" ], "supportRequest": "件名：JVN48627289 の対象確認と対応の依頼\n\n利用中の製品・型番：[記入してください]\nOS・現在の版・ビルド番号：[不明なら「不明」と記入]\n利用している機能・設定：[分かる範囲で記入]\n\nJVNは次の対象範囲を公表しています。\nAndroidアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」2.436.0より前のバージョン\n\niOSアプリ「Creema（クリーマ）- ハンドメイドマーケットプレイスアプリ」2.432.0より前のバージョン\n\nこの環境が対象か、対象外ならその理由を教えてください。対象の場合は次の公表対策に基づき、実施する修正・手順・停止や再起動の必要性と実施予定を確認してください。\nアップデートする\n\n製品開発者が提供する情報をもとに、最新版へアップデートしてください。\n\n対応後は適用した版・設定と、この問題への対処が完了したと判断した根拠を連絡してください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVN48627289", "sources": [ { "url": "https://jvn.jp/jp/JVN48627289/", "label": "JVNの原文" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourceField": "section:概要", "excerpt": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、オープンリダイレクトの脆弱性が存在します。", "language": "ja" }, { "id": "E2", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourceField": "section:想定される影響", "excerpt": "webブラウザーから細工されたURLにアクセスすることで当該アプリが起動され、その画面内に攻撃者が用意したウェブサイトが表示される可能性があります。結果として、フィッシングなどの被害にあう可能性があります。", "language": "ja" }, { "id": "E3", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourceField": "section:影響を受けるシステム", "excerpt": "Androidアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」2.436.0より前のバージョン\n\niOSアプリ「Creema（クリーマ）- ハンドメイドマーケットプレイスアプリ」2.432.0より前のバージョン", "language": "ja" }, { "id": "E4", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourceField": "section:詳細情報", "excerpt": "株式会社クリーマが提供するスマートフォンアプリ「ハンドメイドマーケットアプリ - Creema（クリーマ）」には、次の脆弱性が存在します。\n\nオープンリダイレクト（ CWE-601 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 基本値 4.3\n\nCVE-2026-72528", "language": "ja" }, { "id": "E5", "sourceUrl": "https://jvn.jp/jp/JVN48627289/", "sourceField": "section:対策方法", "excerpt": "アップデートする\n\n製品開発者が提供する情報をもとに、最新版へアップデートしてください。", "language": "ja" } ], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:12.802Z", "lastSuccess": "2026-10-23T03:21:12.802Z", "sourceCheckedAt": "2026-10-23T02:43:53.938Z", "errorCode": null }, "glossary": [] } }, { "id": "JVN94004488", "aliases": [], "title": "「車検証閲覧アプリ」における送信データへの機微な情報の挿入の脆弱性", "summary": "国土交通省が提供する「車検証閲覧アプリ」には、送信データへの機微な情報の挿入の脆弱性が存在します。", "risk": "API連携用のアクセスIDおよびアクセスキーが漏えいする可能性があります。", "product": "「車検証閲覧アプリ」", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "アップデートする\n\n開発者が提供する情報をもとに、アプリを最新版へアップデートしてください。\n\nなお、開発者はAPI利用事業者に対して新しいアクセスIDおよびアクセスキーを発行するとともに、漏えいする可能性があるアクセスIDおよびアクセスキーを無効化しています。\n\nそのため、本脆弱性を悪用することはできません。", "「JVN94004488」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN94004488/", "label": "JVNの原文" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-15T03:00:15.000Z", "modifiedAt": "2026-10-15T05:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "国土交通省が提供する「車検証閲覧アプリ」には、送信データへの機微な情報の挿入の脆弱性が存在します。", "sourceTitle": "「車検証閲覧アプリ」における送信データへの機微な情報の挿入の脆弱性", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-15T05:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-15T05:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVN94004488", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "fetchedAt": "2026-10-23T02:43:53.968Z", "publishedAt": "2026-10-14T15:00:00.000Z", "modifiedAt": "2026-10-14T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVN#94004488\n\n「車検証閲覧アプリ」における送信データへの機微な情報の挿入の脆弱性", "descriptions": [ { "lang": "ja", "value": "国土交通省が提供する「車検証閲覧アプリ」には、送信データへの機微な情報の挿入の脆弱性が存在します。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "国土交通省が提供する「車検証閲覧アプリ」には、車検証を扱う事業者向けに車検証情報を提供するための、API連携機能が実装されています。このAPI連携の仕様において、次の脆弱性が存在します。\n\n送信データへの機微な情報の挿入（ CWE-201 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N 基本値 6.9\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 基本値 5.3\n\nCVE-2026-75559", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "API連携用のアクセスIDおよびアクセスキーが漏えいする可能性があります。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "車検証閲覧アプリ（Android版）ver.6.2.0およびそれ以前\n\n車検証閲覧アプリ（iOS版）ver.6.2.0およびそれ以前", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "アップデートする\n\n開発者が提供する情報をもとに、アプリを最新版へアップデートしてください。\n\nなお、開発者はAPI利用事業者に対して新しいアクセスIDおよびアクセスキーを発行するとともに、漏えいする可能性があるアクセスIDおよびアクセスキーを無効化しています。\n\nそのため、本脆弱性を悪用することはできません。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://cwe.mitre.org/data/definitions/201.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://play.google.com/store/apps/details?id=jp.go.mlit.android.shakenetsuran&hl=ja", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://apps.apple.com/jp/app/%E8%BB%8A%E6%A4%9C%E8%A8%BC%E9%96%B2%E8%A6%A7%E3%82%A2%E3%83%97%E3%83%AA/id1633947799", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75559", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2026-000151", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "国土交通省が提供する「車検証閲覧アプリ」には、送信データへの機微な情報の挿入の脆弱性が存在します。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "車検証閲覧アプリ（Android版）ver.6.2.0およびそれ以前\n\n車検証閲覧アプリ（iOS版）ver.6.2.0およびそれ以前", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "国土交通省が提供する「車検証閲覧アプリ」には、車検証を扱う事業者向けに車検証情報を提供するための、API連携機能が実装されています。このAPI連携の仕様において、次の脆弱性が存在します。\n\n送信データへの機微な情報の挿入（ CWE-201 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N 基本値 6.9\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 基本値 5.3\n\nCVE-2026-75559", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "API連携用のアクセスIDおよびアクセスキーが漏えいする可能性があります。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "アップデートする\n\n開発者が提供する情報をもとに、アプリを最新版へアップデートしてください。\n\nなお、開発者はAPI利用事業者に対して新しいアクセスIDおよびアクセスキーを発行するとともに、漏えいする可能性があるアクセスIDおよびアクセスキーを無効化しています。\n\nそのため、本脆弱性を悪用することはできません。", "sourcePath": "section:対策方法" }, { "heading": "ベンダ情報", "value": "ベンダ\n\nリンク\n\n国土交通省\n\n車検証閲覧アプリ（Android版）\n\n車検証閲覧アプリ（iOS版）", "sourcePath": "section:ベンダ情報" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourcePath": "section:概要", "text": "国土交通省が提供する「車検証閲覧アプリ」には、送信データへの機微な情報の挿入の脆弱性が存在します。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourcePath": "section:影響を受けるシステム", "text": "車検証閲覧アプリ（Android版）ver.6.2.0およびそれ以前\n\n車検証閲覧アプリ（iOS版）ver.6.2.0およびそれ以前", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourcePath": "section:詳細情報", "text": "国土交通省が提供する「車検証閲覧アプリ」には、車検証を扱う事業者向けに車検証情報を提供するための、API連携機能が実装されています。このAPI連携の仕様において、次の脆弱性が存在します。\n\n送信データへの機微な情報の挿入（ CWE-201 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N 基本値 6.9\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 基本値 5.3\n\nCVE-2026-75559", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourcePath": "section:想定される影響", "text": "API連携用のアクセスIDおよびアクセスキーが漏えいする可能性があります。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourcePath": "section:対策方法", "text": "アップデートする\n\n開発者が提供する情報をもとに、アプリを最新版へアップデートしてください。\n\nなお、開発者はAPI利用事業者に対して新しいアクセスIDおよびアクセスキーを発行するとともに、漏えいする可能性があるアクセスIDおよびアクセスキーを無効化しています。\n\nそのため、本脆弱性を悪用することはできません。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:ベンダ情報", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourcePath": "section:ベンダ情報", "text": "ベンダ\n\nリンク\n\n国土交通省\n\n車検証閲覧アプリ（Android版）\n\n車検証閲覧アプリ（iOS版）", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "related:CVE-2026-75559:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Ministry of Land, Infrastructure, Transport and Tourism\",\"product\":\"Vehicle Inspection Certificate Viewer (for Android)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"ver.6.2.0\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-75559" }, { "evidenceId": "related:CVE-2026-75559:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Ministry of Land, Infrastructure, Transport and Tourism\",\"product\":\"Vehicle Inspection Certificate Viewer (for iOS)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"ver.6.2.0\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-75559" }, { "evidenceId": "related:CVE-2026-75559:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The smartphone application \"Vehicle Inspection Certificate Viewer\" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key.", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-75559" }, { "evidenceId": "related:CVE-2026-75559:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Insertion of sensitive information into sent data\",\"lang\":\"en-US\",\"cweId\":\"CWE-201\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-75559" }, { "evidenceId": "related:CVE-2026-75559:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.3,\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-75559" }, { "evidenceId": "related:CVE-2026-75559:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.9,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-75559" } ], "limits": { "completeness": "official_article_with_linked_advisories", "truncatedFields": [], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2026-75559" ], "supplementarySources": [ { "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", "id": "CVE-2026-75559", "modifiedAt": "2026-10-15T14:15:40.048Z" } ], "relatedDocuments": [ { "type": "cve", "id": "CVE-2026-75559", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75559.json", "modifiedAt": "2026-10-15T14:15:40.048Z", "affected": [ { "vendor": "Ministry of Land, Infrastructure, Transport and Tourism", "product": "Vehicle Inspection Certificate Viewer (for Android)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "ver.6.2.0", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Ministry of Land, Infrastructure, Transport and Tourism", "product": "Vehicle Inspection Certificate Viewer (for iOS)", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThanOrEqual": "ver.6.2.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [] } ] }, "relatedCves": [ "CVE-2026-75559" ], "sourceSummary": "国土交通省が提供する「車検証閲覧アプリ」には、送信データへの機微な情報の挿入の脆弱性が存在します。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:12.809Z", "sourceFingerprint": "9633687ff0b6cb7537c099a2ae6ff73fc753c820214df592bdfcaaa619fe7892", "generatorVersion": "2026-10-23.3", "sourceModifiedAt": "2026-10-15T05:00:00.000Z", "verificationMethod": "official_japanese_source_with_structured_checks", "summary": "国土交通省が提供する「車検証閲覧アプリ」には、送信データへの機微な情報の挿入の脆弱性が存在します。", "risk": "API連携用のアクセスIDおよびアクセスキーが漏えいする可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "JVNが公表している対象範囲です。\n車検証閲覧アプリ（Android版）ver.6.2.0およびそれ以前\n\n車検証閲覧アプリ（iOS版）ver.6.2.0およびそれ以前", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN94004488/" ], "evidenceIds": [ "E3" ] }, { "text": "利用中の製品名・開発元・版を、この対象範囲と照らし合わせてください。OSや製品の種類、機能の設定、例外の記載がある場合は、番号だけでなくその条件も確認します。自分で判断できない場合は、下の確認メモを管理担当者に渡してください。", "kind": "check", "sourceUrls": [ "https://jvn.jp/jp/JVN94004488/" ], "evidenceIds": [ "E3" ] }, { "text": "公表されたCVSS評価では、攻撃前に対象システムの権限を持っている必要はありません。他の構成・機能の条件まで不要という意味ではありません。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN94004488/" ], "evidenceIds": [ "E4" ] }, { "text": "公表されたCVSS評価では、ネットワーク越しに攻撃が届く経路があります。あなたの環境がインターネットから到達可能かどうかは、公開設定を別に確認する必要があります。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN94004488/" ], "evidenceIds": [ "E4" ] }, { "text": "公表されたCVSS評価では、攻撃者以外の利用者がリンクを開くなどの操作をしなくても、攻撃が成立し得ます。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN94004488/" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "「「車検証閲覧アプリ」」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN94004488/" ] } ], "actions": [ { "text": "アップデートする\n\n開発者が提供する情報をもとに、アプリを最新版へアップデートしてください。\n\nなお、開発者はAPI利用事業者に対して新しいアクセスIDおよびアクセスキーを発行するとともに、漏えいする可能性があるアクセスIDおよびアクセスキーを無効化しています。\n\nそのため、本脆弱性を悪用することはできません。", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN94004488/" ], "evidenceIds": [ "E5" ] }, { "text": "「JVN94004488」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN94004488/" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN94004488/" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN94004488/" ] } ], "verification": [ { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN94004488/" ] } ], "unknowns": [ "これはJVNが公表した対象・影響・対策を整理した案内です。利用中の環境を検査した結果ではありません。対象外と判断するときは、製品・版だけでなく、設定や権限などの条件も照合してください。", "公表時点の対策を掲載しています。現在提供されている修正とサポート状況は、利用中の製品・系列に合わせて管理担当者に確認してください。対象範囲の上限だけから、修正版の番号を推測しないでください。" ], "supportRequest": "件名：JVN94004488 の対象確認と対応の依頼\n\n利用中の製品・型番：[記入してください]\nOS・現在の版・ビルド番号：[不明なら「不明」と記入]\n利用している機能・設定：[分かる範囲で記入]\n\nJVNは次の対象範囲を公表しています。\n車検証閲覧アプリ（Android版）ver.6.2.0およびそれ以前\n\n車検証閲覧アプリ（iOS版）ver.6.2.0およびそれ以前\n\nこの環境が対象か、対象外ならその理由を教えてください。対象の場合は次の公表対策に基づき、実施する修正・手順・停止や再起動の必要性と実施予定を確認してください。\nアップデートする\n\n開発者が提供する情報をもとに、アプリを最新版へアップデートしてください。\n\nなお、開発者はAPI利用事業者に対して新しいアクセスIDおよびアクセスキーを発行するとともに、漏えいする可能性があるアクセスIDおよびアクセスキーを無効化しています。\n\nそのため、本脆弱性を悪用することはできません。\n\n対応後は適用した版・設定と、この問題への対処が完了したと判断した根拠を連絡してください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVN94004488", "sources": [ { "url": "https://jvn.jp/jp/JVN94004488/", "label": "JVNの原文" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourceField": "section:概要", "excerpt": "国土交通省が提供する「車検証閲覧アプリ」には、送信データへの機微な情報の挿入の脆弱性が存在します。", "language": "ja" }, { "id": "E2", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourceField": "section:想定される影響", "excerpt": "API連携用のアクセスIDおよびアクセスキーが漏えいする可能性があります。", "language": "ja" }, { "id": "E3", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourceField": "section:影響を受けるシステム", "excerpt": "車検証閲覧アプリ（Android版）ver.6.2.0およびそれ以前\n\n車検証閲覧アプリ（iOS版）ver.6.2.0およびそれ以前", "language": "ja" }, { "id": "E4", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourceField": "section:詳細情報", "excerpt": "国土交通省が提供する「車検証閲覧アプリ」には、車検証を扱う事業者向けに車検証情報を提供するための、API連携機能が実装されています。このAPI連携の仕様において、次の脆弱性が存在します。\n\n送信データへの機微な情報の挿入（ CWE-201 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N 基本値 6.9\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 基本値 5.3\n\nCVE-2026-75559", "language": "ja" }, { "id": "E5", "sourceUrl": "https://jvn.jp/jp/JVN94004488/", "sourceField": "section:対策方法", "excerpt": "アップデートする\n\n開発者が提供する情報をもとに、アプリを最新版へアップデートしてください。\n\nなお、開発者はAPI利用事業者に対して新しいアクセスIDおよびアクセスキーを発行するとともに、漏えいする可能性があるアクセスIDおよびアクセスキーを無効化しています。\n\nそのため、本脆弱性を悪用することはできません。", "language": "ja" } ], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:12.809Z", "lastSuccess": "2026-10-23T03:21:12.809Z", "sourceCheckedAt": "2026-10-23T02:43:53.968Z", "errorCode": null }, "glossary": [] } }, { "id": "JVN40460777", "aliases": [], "title": "スマートフォンアプリ「ゲオアプリ」における複数の脆弱性", "summary": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、複数の脆弱性が存在します。", "risk": "想定される影響は各脆弱性により異なりますが、次のような影響を受ける可能性があります。\n\n当該アプリ内のブラウザで任意のWebサイトにアクセスさせられ、結果としてフィッシング被害を受けたり、当該サービスのセッションIDが窃取されたりする（CVE-2026-96614）\n\n攻撃者によって当該アプリのユーザーのパスワードが窃取される（CVE-2026-105271）", "product": "スマートフォンアプリ「ゲオアプリ」", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n本脆弱性を修正した以下のバージョンがリリースされています。\n\nAndroidアプリ「ゲオアプリ」Ver 11.8.8\n\niOSアプリ「ゲオアプリ」Ver 11.8.8", "「JVN40460777」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN40460777/", "label": "JVNの原文" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-15T03:00:00.000Z", "modifiedAt": "2026-10-15T03:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、複数の脆弱性が存在します。", "sourceTitle": "スマートフォンアプリ「ゲオアプリ」における複数の脆弱性", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-15T03:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-15T03:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVN40460777", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "fetchedAt": "2026-10-23T02:43:53.922Z", "publishedAt": "2026-10-14T15:00:00.000Z", "modifiedAt": "2026-10-14T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVN#40460777\n\nスマートフォンアプリ「ゲオアプリ」における複数の脆弱性", "descriptions": [ { "lang": "ja", "value": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、複数の脆弱性が存在します。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、次の複数の脆弱性が存在します。\n\nCustom URL Schemeの処理におけるアクセス制限不備（ CWE-939 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 基本値 5.4\n\nCVE-2026-96614\n\n重要情報の平文保存（ CWE-312 ）\n\nCVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 基本値 4.3\n\nCVE-2026-105271", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "想定される影響は各脆弱性により異なりますが、次のような影響を受ける可能性があります。\n\n当該アプリ内のブラウザで任意のWebサイトにアクセスさせられ、結果としてフィッシング被害を受けたり、当該サービスのセッションIDが窃取されたりする（CVE-2026-96614）\n\n攻撃者によって当該アプリのユーザーのパスワードが窃取される（CVE-2026-105271）", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "Androidアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン\n\niOSアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n本脆弱性を修正した以下のバージョンがリリースされています。\n\nAndroidアプリ「ゲオアプリ」Ver 11.8.8\n\niOSアプリ「ゲオアプリ」Ver 11.8.8", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://cwe.mitre.org/data/definitions/939.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cwe.mitre.org/data/definitions/312.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://play.google.com/store/apps/details?id=jp.co.geoonline.app&hl=ja", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://apps.apple.com/jp/app/id590190880", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-96614", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-105271", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2026-000149", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、複数の脆弱性が存在します。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "Androidアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン\n\niOSアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、次の複数の脆弱性が存在します。\n\nCustom URL Schemeの処理におけるアクセス制限不備（ CWE-939 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 基本値 5.4\n\nCVE-2026-96614\n\n重要情報の平文保存（ CWE-312 ）\n\nCVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 基本値 4.3\n\nCVE-2026-105271", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "想定される影響は各脆弱性により異なりますが、次のような影響を受ける可能性があります。\n\n当該アプリ内のブラウザで任意のWebサイトにアクセスさせられ、結果としてフィッシング被害を受けたり、当該サービスのセッションIDが窃取されたりする（CVE-2026-96614）\n\n攻撃者によって当該アプリのユーザーのパスワードが窃取される（CVE-2026-105271）", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n本脆弱性を修正した以下のバージョンがリリースされています。\n\nAndroidアプリ「ゲオアプリ」Ver 11.8.8\n\niOSアプリ「ゲオアプリ」Ver 11.8.8", "sourcePath": "section:対策方法" }, { "heading": "ベンダ情報", "value": "ベンダ\n\nリンク\n\n株式会社ゲオ\n\nゲオ　クーポンが貰える！ゲーム予約もできる！ - Google Play のアプリ\n\nゲオ　クーポンが貰える！ゲーム予約もできる！アプリ - App Store", "sourcePath": "section:ベンダ情報" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourcePath": "section:概要", "text": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、複数の脆弱性が存在します。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourcePath": "section:影響を受けるシステム", "text": "Androidアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン\n\niOSアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourcePath": "section:詳細情報", "text": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、次の複数の脆弱性が存在します。\n\nCustom URL Schemeの処理におけるアクセス制限不備（ CWE-939 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N 基本値 5.4\n\nCVE-2026-96614\n\n重要情報の平文保存（ CWE-312 ）\n\nCVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 基本値 5.1\n\nCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 基本値 4.3\n\nCVE-2026-105271", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourcePath": "section:想定される影響", "text": "想定される影響は各脆弱性により異なりますが、次のような影響を受ける可能性があります。\n\n当該アプリ内のブラウザで任意のWebサイトにアクセスさせられ、結果としてフィッシング被害を受けたり、当該サービスのセッションIDが窃取されたりする（CVE-2026-96614）\n\n攻撃者によって当該アプリのユーザーのパスワードが窃取される（CVE-2026-105271）", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourcePath": "section:対策方法", "text": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n本脆弱性を修正した以下のバージョンがリリースされています。\n\nAndroidアプリ「ゲオアプリ」Ver 11.8.8\n\niOSアプリ「ゲオアプリ」Ver 11.8.8", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:ベンダ情報", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourcePath": "section:ベンダ情報", "text": "ベンダ\n\nリンク\n\n株式会社ゲオ\n\nゲオ　クーポンが貰える！ゲーム予約もできる！ - Google Play のアプリ\n\nゲオ　クーポンが貰える！ゲーム予約もできる！アプリ - App Store", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "related:CVE-2026-105271:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"GEO CORPORATION\",\"product\":\"\\\"ゲオアプリ\\\" for Android\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"11.8.6\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-105271" }, { "evidenceId": "related:CVE-2026-105271:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"GEO CORPORATION\",\"product\":\"\\\"ゲオアプリ\\\" for iOS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"11.8.6\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-105271" }, { "evidenceId": "related:CVE-2026-105271:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "\"ゲオアプリ\" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application.", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-105271" }, { "evidenceId": "related:CVE-2026-105271:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Cleartext storage of sensitive information\",\"lang\":\"en-US\",\"cweId\":\"CWE-312\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-105271" }, { "evidenceId": "related:CVE-2026-105271:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":4.3,\"vectorString\":\"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-105271" }, { "evidenceId": "related:CVE-2026-105271:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.1,\"vectorString\":\"CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-105271" }, { "evidenceId": "related:CVE-2026-96614:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"GEO CORPORATION\",\"product\":\"\\\"ゲオアプリ\\\" for Android\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"11.8.6\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-96614" }, { "evidenceId": "related:CVE-2026-96614:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"GEO CORPORATION\",\"product\":\"\\\"ゲオアプリ\\\" for iOS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"11.8.6\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-96614" }, { "evidenceId": "related:CVE-2026-96614:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "\"ゲオアプリ\" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-96614" }, { "evidenceId": "related:CVE-2026-96614:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Improper authorization in handler for custom URL scheme\",\"lang\":\"en-US\",\"cweId\":\"CWE-939\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-96614" }, { "evidenceId": "related:CVE-2026-96614:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.4,\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-96614" }, { "evidenceId": "related:CVE-2026-96614:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.1,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-96614" } ], "limits": { "completeness": "official_article_with_linked_advisories", "truncatedFields": [], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2026-96614", "CVE-2026-105271" ], "supplementarySources": [ { "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", "id": "CVE-2026-105271", "modifiedAt": "2026-10-15T18:28:26.549Z" }, { "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", "id": "CVE-2026-96614", "modifiedAt": "2026-10-15T14:19:54.516Z" } ], "relatedDocuments": [ { "type": "cve", "id": "CVE-2026-105271", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105271.json", "modifiedAt": "2026-10-15T18:28:26.549Z", "affected": [ { "vendor": "GEO CORPORATION", "product": "\"ゲオアプリ\" for Android", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "11.8.6", "versionType": "semver", "status": "affected" } ] }, { "vendor": "GEO CORPORATION", "product": "\"ゲオアプリ\" for iOS", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThanOrEqual": "11.8.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [] }, { "type": "cve", "id": "CVE-2026-96614", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96614.json", "modifiedAt": "2026-10-15T14:19:54.516Z", "affected": [ { "vendor": "GEO CORPORATION", "product": "\"ゲオアプリ\" for Android", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "11.8.6", "versionType": "semver", "status": "affected" } ] }, { "vendor": "GEO CORPORATION", "product": "\"ゲオアプリ\" for iOS", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThanOrEqual": "11.8.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [] } ] }, "relatedCves": [ "CVE-2026-96614", "CVE-2026-105271" ], "sourceSummary": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、複数の脆弱性が存在します。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:12.816Z", "sourceFingerprint": "e2fc10fb24b7ff80c6f67539196e6882008210061fae9c6bdeeb72256f59db58", "generatorVersion": "2026-10-23.3", "sourceModifiedAt": "2026-10-15T03:00:00.000Z", "verificationMethod": "official_japanese_source_with_structured_checks", "summary": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、複数の脆弱性が存在します。", "risk": "想定される影響は各脆弱性により異なりますが、次のような影響を受ける可能性があります。\n\n当該アプリ内のブラウザで任意のWebサイトにアクセスさせられ、結果としてフィッシング被害を受けたり、当該サービスのセッションIDが窃取されたりする（CVE-2026-96614）\n\n攻撃者によって当該アプリのユーザーのパスワードが窃取される（CVE-2026-105271）", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "JVNが公表している対象範囲です。\nAndroidアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン\n\niOSアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN40460777/" ], "evidenceIds": [ "E3" ] }, { "text": "利用中の製品名・開発元・版を、この対象範囲と照らし合わせてください。OSや製品の種類、機能の設定、例外の記載がある場合は、番号だけでなくその条件も確認します。自分で判断できない場合は、下の確認メモを管理担当者に渡してください。", "kind": "check", "sourceUrls": [ "https://jvn.jp/jp/JVN40460777/" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "「スマートフォンアプリ「ゲオアプリ」」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN40460777/" ] } ], "actions": [ { "text": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n本脆弱性を修正した以下のバージョンがリリースされています。\n\nAndroidアプリ「ゲオアプリ」Ver 11.8.8\n\niOSアプリ「ゲオアプリ」Ver 11.8.8", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN40460777/" ], "evidenceIds": [ "E4" ] }, { "text": "「JVN40460777」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN40460777/" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN40460777/" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN40460777/" ] } ], "verification": [ { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN40460777/" ] } ], "unknowns": [ "これはJVNが公表した対象・影響・対策を整理した案内です。利用中の環境を検査した結果ではありません。対象外と判断するときは、製品・版だけでなく、設定や権限などの条件も照合してください。", "公表時点の対策を掲載しています。現在提供されている修正とサポート状況は、利用中の製品・系列に合わせて管理担当者に確認してください。対象範囲の上限だけから、修正版の番号を推測しないでください。", "複数の脆弱性をまとめた案内です。CVE番号ごとに対象製品・版・成立条件が異なる場合があります。あるCVEの条件や修正を、ほかのCVEへ一律に当てはめないでください。" ], "supportRequest": "件名：JVN40460777 の対象確認と対応の依頼\n\n利用中の製品・型番：[記入してください]\nOS・現在の版・ビルド番号：[不明なら「不明」と記入]\n利用している機能・設定：[分かる範囲で記入]\n\nJVNは次の対象範囲を公表しています。\nAndroidアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン\n\niOSアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン\n\nこの環境が対象か、対象外ならその理由を教えてください。対象の場合は次の公表対策に基づき、実施する修正・手順・停止や再起動の必要性と実施予定を確認してください。\nアップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n本脆弱性を修正した以下のバージョンがリリースされています。\n\nAndroidアプリ「ゲオアプリ」Ver 11.8.8\n\niOSアプリ「ゲオアプリ」Ver 11.8.8\n\n対応後は適用した版・設定と、この問題への対処が完了したと判断した根拠を連絡してください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVN40460777", "sources": [ { "url": "https://jvn.jp/jp/JVN40460777/", "label": "JVNの原文" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourceField": "section:概要", "excerpt": "株式会社ゲオが提供するスマートフォンアプリ「ゲオアプリ」には、複数の脆弱性が存在します。", "language": "ja" }, { "id": "E2", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourceField": "section:想定される影響", "excerpt": "想定される影響は各脆弱性により異なりますが、次のような影響を受ける可能性があります。\n\n当該アプリ内のブラウザで任意のWebサイトにアクセスさせられ、結果としてフィッシング被害を受けたり、当該サービスのセッションIDが窃取されたりする（CVE-2026-96614）\n\n攻撃者によって当該アプリのユーザーのパスワードが窃取される（CVE-2026-105271）", "language": "ja" }, { "id": "E3", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourceField": "section:影響を受けるシステム", "excerpt": "Androidアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン\n\niOSアプリ「ゲオアプリ」Ver 11.8.6およびそれ以前のバージョン", "language": "ja" }, { "id": "E4", "sourceUrl": "https://jvn.jp/jp/JVN40460777/", "sourceField": "section:対策方法", "excerpt": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n本脆弱性を修正した以下のバージョンがリリースされています。\n\nAndroidアプリ「ゲオアプリ」Ver 11.8.8\n\niOSアプリ「ゲオアプリ」Ver 11.8.8", "language": "ja" } ], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:12.816Z", "lastSuccess": "2026-10-23T03:21:12.816Z", "sourceCheckedAt": "2026-10-23T02:43:53.922Z", "errorCode": null }, "glossary": [] } }, { "id": "JVNVU95613365", "aliases": [], "title": "BoringSSL：証明書の名前制限に関する5件の報告を分けて確認", "summary": "BoringSSLの名前制限の検証について、修正済み2件、受理され調整中1件、見解が分かれる1件、脆弱性として採用されなかった1件があります。BoringSSLを含むだけでChromeやAndroidが影響すると断定できません。製品が使う検証処理と証明書の形式を確認します。", "risk": "問題のある検証経路でName Constraintsを使い、攻撃者の選んだSANの項目に信頼された署名が得られ、その名前が権限判定に使われる場合に、意図しない名前が受け入れられる可能性があります。旧crypto/x509と新しいpkiの経路では、報告の対象が異なります。", "product": "Google BoringSSL証明書検証", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "VU#410595.8と.12は、2026年3月4日のコミット5774ecaで修正されています。BoringSSLそのものの共通バージョン番号を推測せず、利用製品の提供元に、この修正がその製品へ取り込まれた更新を確認してください。", "VU#410595.9は受理され調整中です。CERT/CCはBoringSSLの修正調整を担当していないため、提供元・BoringSSL側のGoogle Issue Trackerの対応状況を確認します。.10や.11を修正済みと読み替えないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://kb.cert.org/vuls/id/410595", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU95613365/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-15T01:30:30.000Z", "modifiedAt": "2026-10-15T01:30:30.000Z", "fetchedAt": "2026-10-23T03:17:49.705Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourceTitle": "Google BoringSSL証明書検証における複数の名前制約回避の脆弱性", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-15T01:30:30.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-15T01:30:30.000Z", "fetchedAt": "2026-10-23T03:17:49.705Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVNVU95613365", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "fetchedAt": "2026-10-23T02:43:54.016Z", "publishedAt": "2026-10-14T15:00:00.000Z", "modifiedAt": "2026-10-14T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVNVU#95613365\n\nGoogle BoringSSL証明書検証における複数の名前制約回避の脆弱性", "descriptions": [ { "lang": "ja", "value": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "Vulnerability Note VU#410595 Google BoringSSL Name Constraints Bypass in SAN Validation Logic", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://kb.cert.org/vuls/id/410595", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "Vulnerability Note VU#410595 Google BoringSSL Name Constraints Bypass in SAN Validation Logic", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:対策方法" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourcePath": "section:概要", "text": "CERT/CCから本件に関するアドバイザリが公表されました。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourcePath": "section:影響を受けるシステム", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourcePath": "section:詳細情報", "text": "Vulnerability Note VU#410595 Google BoringSSL Name Constraints Bypass in SAN Validation Logic", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourcePath": "section:想定される影響", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourcePath": "section:対策方法", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "linked:https://kb.cert.org/vuls/id/410595", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "sourcePath": "article:overview-description-impact-solution", "text": "VU#410595 - Google BoringSSL Name Constraints Bypass in SAN Validation Logic\n\nOverview\n\nFive Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined.\n\nDescription\n\nName Constraints limit the names a subordinate certificate authority may issue. The reports concern how BoringSSL applies those limits to certain SAN (Subject Alternative Name) forms. The records do not share one status, and they do not all affect the same validation path.\n\nVU#410595.8 ( Fixed 2026-03-04 ): A wildcard DNS name may not be treated as covering a specifically excluded host.\n\nVU#410595.9 ( Accepted ): A URI with a colon before @ may cause the wrong host to be used when matching URI constraints.\n\nVU#410595.10 ( Disputed ): The finding concerns first-@ domain extraction in rfc822Name constraint matching. How consuming mail applications interpret the submitted multi-@ input, and whether that creates deployment exploitation, was not established.\n\nVU#410595.11 ( Rejected ): Trailing-dot handling in rfc822Name domains. The BoringSSL team declined this on 2026-02-28 as below its security threshold.\n\nVU#410595.12 ( Fixed 2026-03-04 ): Trailing-dot DNS names were not always normalized on the legacy validation path.\n\nUsing BoringSSL in a product does not mean that product invokes an affected path or name form.\n\nImpact\n\nThese findings matter only where Name Constraints are enforced on an affected path, a trusted signature can be obtained over attacker-chosen SAN fields, and the accepted name is used for authorization. Mixed-library environments may accept or reject the same certificate differently. Presence of BoringSSL does not, by itself, mean that Chrome, Android, or other products are affected.\n\nSolution\n\nBoringSSL fixes land in the upstream repository and reach products through each product's own update process.\n\nVU#410595.8 and .12 were fixed in commit 5774eca on 2026-03-04.\n\nVU#410595.9 is accepted and under coordination.\n\nVU#410595.10 is disputed.\n\nVU#410595.11 was declined.\n\nCERT/CC is not coordinating BoringSSL fixes. For vendor status, contact the BoringSSL team through the Google Issue Tracker . Operators should confirm whether their deployment uses an affected path, apply available updates, and keep issued SANs well formed. A second validator helps only when it uses the same inputs and fails closed.", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [] } ], "limits": { "completeness": "official_article_with_linked_advisories", "truncatedFields": [], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [], "supplementarySources": [ { "sourceType": "CERT/CC", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "title": "VU#410595 - Google BoringSSL Name Constraints Bypass in SAN Validation Logic", "relatedCves": [] } ], "relatedDocuments": [ { "type": "html", "sourceType": "CERT/CC", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "title": "VU#410595 - Google BoringSSL Name Constraints Bypass in SAN Validation Logic", "relatedCves": [], "truncated": false } ] }, "relatedCves": [], "sourceSummary": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T03:49:22.000Z", "reviewState": "current", "summary": "BoringSSLの名前制限の検証について、修正済み2件、受理され調整中1件、見解が分かれる1件、脆弱性として採用されなかった1件があります。BoringSSLを含むだけでChromeやAndroidが影響すると断定できません。製品が使う検証処理と証明書の形式を確認します。", "risk": "問題のある検証経路でName Constraintsを使い、攻撃者の選んだSANの項目に信頼された署名が得られ、その名前が権限判定に使われる場合に、意図しない名前が受け入れられる可能性があります。旧crypto/x509と新しいpkiの経路では、報告の対象が異なります。", "applicability": [ { "text": "VU#410595.8・.9・.10・.12は旧crypto/x509の検証経路、.11は新しいpki経路の報告です。.8は除外されたホストとDNSワイルドカード、.12はDNS名の末尾のドットの扱いです。.9はURIの@より前にコロンがある場合、.10はメール形式の名前に複数の@がある場合の扱いを指します。", "kind": "fact", "sourceUrls": [ "https://kb.cert.org/vuls/id/410595" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "VU#410595.10は、メールアプリがその入力をどう解釈し実際に悪用できるか確立されておらず、見解が分かれています。.11のメールドメイン末尾のドットの報告は、2026年2月28日にBoringSSL側がセキュリティ基準未満として採用しませんでした。", "kind": "fact", "sourceUrls": [ "https://kb.cert.org/vuls/id/410595" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "利用中の製品名・型番・完全な版番号を確認し、自分の製品の項目だけを照合してください。複数製品をまとめた告知では、別製品の修正版や対策を流用しません。分からない項目は管理担当者にこのページを渡して確認します。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU95613365/" ], "evidenceIds": [ "E4", "E5", "E6", "E7", "E8" ] }, { "text": "最初に「Google BoringSSL証明書検証」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU95613365/" ] } ], "versionChecks": [ { "text": "「Google BoringSSL証明書検証」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU95613365/" ] } ], "actions": [ { "text": "VU#410595.8と.12は、2026年3月4日のコミット5774ecaで修正されています。BoringSSLそのものの共通バージョン番号を推測せず、利用製品の提供元に、この修正がその製品へ取り込まれた更新を確認してください。", "kind": "fix", "sourceUrls": [ "https://kb.cert.org/vuls/id/410595" ], "evidenceIds": [ "E1", "E2", "E9" ] }, { "text": "VU#410595.9は受理され調整中です。CERT/CCはBoringSSLの修正調整を担当していないため、提供元・BoringSSL側のGoogle Issue Trackerの対応状況を確認します。.10や.11を修正済みと読み替えないでください。", "kind": "fact", "sourceUrls": [ "https://kb.cert.org/vuls/id/410595" ], "evidenceIds": [ "E1", "E10", "E9" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU95613365/" ] } ], "temporaryMitigations": [ { "text": "実際に使う検証経路を確認し、発行するSANの形式を正しく整えます。第2の検証器で補完するときは同じ入力を使い、検証が失敗したら許可しない構成が必要です。", "kind": "fix", "sourceUrls": [ "https://kb.cert.org/vuls/id/410595" ], "evidenceIds": [ "E1", "E11" ] } ], "verification": [ { "text": "担当者から、対象だった製品・適用した修正や設定・反映日時を回答してもらいます。製品ごとの公式情報と照合してから完了とし、通常業務が続けられることも確認してください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/vu/JVNVU95613365/" ], "evidenceIds": [ "E4", "E5", "E6", "E7", "E8" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU95613365/" ] } ], "unknowns": [ "公表時点の公式資料を照合した説明です。実際の機器や設定を検査した結果ではありません。修正版や対応状況は製品・系列ごとに確認してください。" ], "supportRequest": "件名：JVNVU95613365（Google BoringSSL証明書検証）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nJVNVU95613365について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVNVU95613365", "sources": [ { "url": "https://kb.cert.org/vuls/id/410595", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU95613365/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "reviewedSourceFingerprint": "reviewed-source-v1:f8e7f25ef177a327f0fc53c8d5273441937e60e6261de2a4f90b76d33657e361", "reviewedSourceScope": "official_evidence", "evidence": [ { "id": "E1", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "sourceField": "article:overview-description-impact-solution", "excerpt": "VU#410595 - Google BoringSSL Name Constraints Bypass in SAN Validation Logic\n\nOverview\n\nFive Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined.\n\nDescription\n\nName Constraints limit the names a subordinate certificate authority may issue. The reports concern how BoringSSL applies those limits to certain SAN (Subject Alternative Name) forms. The records do not share one status, and they do not all affect the same validation path.\n\nVU#410595.8 ( Fixed 2026-03-04 ): A wildcard DNS name may not be treated as covering a specifically excluded host.\n\nVU#410595.9 ( Accepted ): A URI with a colon before @ may cause the wrong host to be used when matching URI constraints.\n\nVU#410595.10 ( Disputed ): The finding concerns first-@ domain extraction in rfc822Name constraint matching. How consuming mail applications interpret the submitted multi-@ input, and whether that creates deployment exploitation, was not established.\n\nVU#410595.11 ( Rejected ): Trailing-dot handling in rfc822Name domains.", "language": "en" }, { "id": "E2", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "sourceField": "article:overview-description-impact-solution", "excerpt": "VU#410595 - Google BoringSSL Name Constraints Bypass in SAN Validation Logic\n\nOverview\n\nFive Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined.\n\nDescription\n\nName Constraints limit the names a subordinate cer", "language": "en" }, { "id": "E3", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "sourceField": "article:overview-description-impact-solution", "excerpt": "ing a specifically excluded host.\n\nVU#410595.9 ( Accepted ): A URI with a colon before @ may cause the wrong host to be used when matching URI constraints.\n\nVU#410595.10 ( Disputed ): The finding concerns first-@ domain extraction in rfc822Name constraint matching. How consuming mail applications interpret the submitted multi-@ input, and whether that creates deployment exploitation, was not established.\n\nVU#410595.11 ( Rejected ): Trailing-dot handling in rfc822Name domains. The Bori", "language": "en" }, { "id": "E4", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourceField": "section:概要", "excerpt": "CERT/CCから本件に関するアドバイザリが公表されました。", "language": "ja" }, { "id": "E5", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourceField": "section:影響を受けるシステム", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E6", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourceField": "section:詳細情報", "excerpt": "Vulnerability Note VU#410595 Google BoringSSL Name Constraints Bypass in SAN Validation Logic", "language": "en" }, { "id": "E7", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourceField": "section:想定される影響", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E8", "sourceUrl": "https://jvn.jp/vu/JVNVU95613365/", "sourceField": "section:対策方法", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E9", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "sourceField": "article:overview-description-impact-solution", "excerpt": "oes not, by itself, mean that Chrome, Android, or other products are affected.\n\nSolution\n\nBoringSSL fixes land in the upstream repository and reach products through each product's own update process.\n\nVU#410595.8 and .12 were fixed in commit 5774eca on 2026-03-04.\n\nVU#410595.9 is accepted and under coordination.\n\nVU#410595.10 is disputed.\n\nVU#410595.11 was declined.\n\nCERT/CC is not coordinating BoringSSL fixes. For vendor status, contact the BoringSSL team through the Google Issue Tracker . Operators should confirm whether their deployment uses an affected path, apply available updates, and keep issued SANs well formed. A second validator helps only when it uses the same inputs and fails closed.", "language": "en" }, { "id": "E10", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "sourceField": "article:overview-description-impact-solution", "excerpt": "ot all affect the same validation path.\n\nVU#410595.8 ( Fixed 2026-03-04 ): A wildcard DNS name may not be treated as covering a specifically excluded host.\n\nVU#410595.9 ( Accepted ): A URI with a colon before @ may cause the wrong host to be used when matching URI constraints.\n\nVU#410595.10 ( Disputed ): The finding concerns first-@ domain extraction in rfc822Name constraint matching. How consuming mail applications interpret the submitted multi-@ input, and whether that creates depl", "language": "en" }, { "id": "E11", "sourceUrl": "https://kb.cert.org/vuls/id/410595", "sourceField": "article:overview-description-impact-solution", "excerpt": "VU#410595 - Google BoringSSL Name Constraints Bypass in SAN Validation Logic\n\nOverview\n\nFive Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, a", "language": "en" } ], "summaryEvidenceIds": [ "E1", "E11", "E9" ], "riskEvidenceIds": [ "E1", "E11", "E9" ], "glossary": [] } }, { "id": "JVNVU95474776", "aliases": [], "title": "複数のTLSライブラリー：証明書の名前制限の扱いが異なる問題", "summary": "証明書の「この認証局が発行してよい名前の範囲」を制限するName Constraintsに関する13件の報告です。TLSやHTTPSを使う製品がすべて危険という告知ではありません。実際のライブラリー、証明書の名前形式、認証・権限判定への使い方を担当者が確認します。", "risk": "攻撃者が選んだ証明書の項目に信頼された署名を得られ、問題のある検証経路を通り、その名前をアプリが権限判定に使う場合に、許可範囲外の名前が受け入れられる可能性があります。ライブラリー間で結果が異なるだけでは、攻撃できることや情報漏えいを証明しません。報告には修正済み・調査中・脆弱性として認められていないものが混在します。", "product": "複数のTLSライブラリ", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "修正番号が明記されているものは、GnuTLSのCVE-2026-3833が3.8.13、pyca/cryptographyのCVE-2026-34073が46.0.6、wolfSSLのCVE-2026-3547が5.9.0です。それぞれ使っているライブラリーの提供元の更新を適用します。これらの番号を別のライブラリーへ当てはめません。", "OpenSSLのURI処理のPR #30319は、2026年9月10日の確認では当時サポートされていた公開版すべてに入っていますが、別のuserinfo-colonの報告は調査中です。AWS-LCのワイルドカードCN問題は修正済みで、Unicode CNは調整中です。Goの別2件、Apple Security.framework、NSS、LibreSSL、s2n-tlsにも調査・調整中の項目があります。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://kb.cert.org/vuls/id/948176", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU95474776/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-15T01:30:15.000Z", "modifiedAt": "2026-10-15T01:30:15.000Z", "fetchedAt": "2026-10-23T03:17:49.705Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourceTitle": "複数のTLSライブラリにおける名前制約回避の問題", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-15T01:30:15.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-15T01:30:15.000Z", "fetchedAt": "2026-10-23T03:17:49.705Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVNVU95474776", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "fetchedAt": "2026-10-23T02:43:54.010Z", "publishedAt": "2026-10-14T15:00:00.000Z", "modifiedAt": "2026-10-14T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVNVU#95474776\n\n複数のTLSライブラリにおける名前制約回避の問題", "descriptions": [ { "lang": "ja", "value": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "Vulnerability Note VU#948176 Multiple TLS Libraries can Bypass Delegation Enforcement", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://kb.cert.org/vuls/id/948176", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "Vulnerability Note VU#948176 Multiple TLS Libraries can Bypass Delegation Enforcement", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:対策方法" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourcePath": "section:概要", "text": "CERT/CCから本件に関するアドバイザリが公表されました。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourcePath": "section:影響を受けるシステム", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourcePath": "section:詳細情報", "text": "Vulnerability Note VU#948176 Multiple TLS Libraries can Bypass Delegation Enforcement", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourcePath": "section:想定される影響", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourcePath": "section:対策方法", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "linked:https://kb.cert.org/vuls/id/948176", "sourceUrl": "https://kb.cert.org/vuls/id/948176", "sourcePath": "article:overview-description-impact-solution", "text": "VU#948176 - Multiple TLS Libraries can Bypass Delegation Enforcement\n\nOverview\n\nThis note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a constrained name may be accepted by one library and rejected by another. Some are fixed, some remain under review, and some were not accepted as security issues.\n\nDescription\n\nName Constraints are meant to keep a subordinate CA inside an allowed namespace. The records cover several name forms and do not all have the same classification. VU#948176.7 does not exist.\n\nDNS case-sensitivity and wildcards. While RFC 5280 requires case-insensitive DNS matching, it does not explicitly define wildcard Subject Alternative Name (SAN) matching, leading to varied implementation behaviors. For instance, GnuTLS was found to perform case-sensitive comparisons on certain names (CVE-2026-3833, fixed in 3.8.13). Similar discrepancies regarding case handling in wildcard parent-constraint lookups were reported in Go, as well as wildcard inconsistencies in LibreSSL and wolfSSL. Additionally, pyca/cryptography was identified to check DNS Name Constraints against certificate SANs but failed to validate them against the requested peer name (CVE-2026-34073, fixed in 46.0.6).\n\nIP addresses. Some libraries treat IPv4 and IPv4-mapped IPv6 forms as different when matching constraints. The Go security team determined that report did not meet its security bar; similar reports exist for Apple's Security.framework and Mozilla NSS and are included as comparative evidence.\n\nURIs. Libraries can differ on which host they extract from a URI SAN. OpenSSL merged PR #30319 for an @ in the path, query, or fragment; a separate userinfo-colon report remains in triage. Related URI reports exist for Apple, NSS, and wolfSSL (CVE-2026-3547, fixed in 5.9.0). A well-formed single @ is handled per RFC 3986 by most implementations.\n\nCommon Name fallback. AWS-LC and s2n-tls were reported to apply DNS constraints inconsistently when a leaf has no SAN and uses a wildcard Common Name. The AWS-LC wildcard-CN issue has been fixed; a separate Unicode CN question remains under coordination. s2n-tls is in triage.\n\nNon-critical constraints. In the reported Mbed TLS configuration, non-critical Name Constraints are not enforced. RFC 5280 requires conforming CAs to mark the extension critical, and the reviewed Mbed TLS 3.x configuration rejects unsupported critical extensions. The vendor treats adding support as a feature request; the reporter's concern remains disputed.\n\nImpact\n\nThese records matter only when an attacker can obtain a trusted signature over chosen certificate fields, reach an affected validation path, and the application uses the accepted identity for authorization. Validator disagreement alone is not exploitation. Effects, if any, are deployment-specific and may include acceptance of a name outside the intended namespace.\n\nSolution\n\nCERT/CC is coordinating remediation across the affected projects. The following summarizes available status; individual entries reflect different reporting and confirmation dates.\n\nGnuTLS — CVE-2026-3833 fixed in 3.8.13.\n\npyca/cryptography — CVE-2026-34073 fixed in 46.0.6.\n\nwolfSSL — CVE-2026-3547 fixed in 5.9.0. The wildcard was addressed in PR# 9991 .\n\nGo's crypto/x509 — Two reports are in triage. The IPv4-mapped IPv6 report was not accepted as meeting the project's security bar.\n\nOpenSSL — PR #30319 was merged and, as confirmed on 10 September 2026, is present in all then-current publicly supported versions. The separate userinfo-colon report remains in triage.\n\nApple's Security.framework — Three reports submitted on 2026-03-16 remain in triage.\n\nMozilla NSS — IP-address report under coordination.\n\nLibreSSL — Wildcard report under coordination.\n\nAWS-LC — Wildcard CN issue fixed; Unicode CN report under coordination. s2n-tls is in triage.\n\nMbed TLS — Non-critical Name Constraints are not enforced in the reported configuration. Marking the extension critical causes such chains to fail closed rather than adding enforcement.\n\nUntil updates are widely deployed, operators who depend on Name Constraints should confirm the behavior of the libraries they actually run, keep leaf certificates to explicit SANs, and treat issuance policy as the first control. A second validator helps only when it uses the same inputs and fails closed.", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-3833", "CVE-2026-34073", "CVE-2026-3547" ] } ], "limits": { "completeness": "official_article_with_linked_advisories", "truncatedFields": [], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2026-3833", "CVE-2026-34073", "CVE-2026-3547" ], "supplementarySources": [ { "sourceType": "CERT/CC", "sourceUrl": "https://kb.cert.org/vuls/id/948176", "title": "VU#948176 - Multiple TLS Libraries can Bypass Delegation Enforcement", "relatedCves": [ "CVE-2026-3833", "CVE-2026-34073", "CVE-2026-3547" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "CERT/CC", "sourceUrl": "https://kb.cert.org/vuls/id/948176", "title": "VU#948176 - Multiple TLS Libraries can Bypass Delegation Enforcement", "relatedCves": [ "CVE-2026-3833", "CVE-2026-34073", "CVE-2026-3547" ], "truncated": false } ] }, "relatedCves": [ "CVE-2026-3833", "CVE-2026-34073", "CVE-2026-3547" ], "sourceSummary": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T03:49:22.000Z", "reviewState": "current", "summary": "証明書の「この認証局が発行してよい名前の範囲」を制限するName Constraintsに関する13件の報告です。TLSやHTTPSを使う製品がすべて危険という告知ではありません。実際のライブラリー、証明書の名前形式、認証・権限判定への使い方を担当者が確認します。", "risk": "攻撃者が選んだ証明書の項目に信頼された署名を得られ、問題のある検証経路を通り、その名前をアプリが権限判定に使う場合に、許可範囲外の名前が受け入れられる可能性があります。ライブラリー間で結果が異なるだけでは、攻撃できることや情報漏えいを証明しません。報告には修正済み・調査中・脆弱性として認められていないものが混在します。", "applicability": [ { "text": "DNS名の大小文字・ワイルドカード、IPv4とIPv4を埋め込んだIPv6、URIから取り出すホスト名、SANがない場合のCommon Nameなどが論点です。GnuTLS、pyca/cryptography、wolfSSLで修正が明記された問題と、ほかのライブラリーの調整中の報告を混同しないでください。", "kind": "fact", "sourceUrls": [ "https://kb.cert.org/vuls/id/948176" ], "evidenceIds": [ "E1", "E2", "E3" ] }, { "text": "GoのIPv4-mapped IPv6の報告は同プロジェクトのセキュリティ問題としての基準を満たさないと判断されています。Mbed TLSの報告は非criticalのName Constraintsを強制しない構成に関するもので、開発元は対応を機能追加として扱い、見解が一致していません。", "kind": "fact", "sourceUrls": [ "https://kb.cert.org/vuls/id/948176" ], "evidenceIds": [ "E1" ] }, { "text": "利用中の製品名・型番・完全な版番号を確認し、自分の製品の項目だけを照合してください。複数製品をまとめた告知では、別製品の修正版や対策を流用しません。分からない項目は管理担当者にこのページを渡して確認します。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU95474776/" ], "evidenceIds": [ "E4", "E5", "E6", "E7", "E8" ] }, { "text": "最初に「複数のTLSライブラリ」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU95474776/" ] } ], "versionChecks": [ { "text": "「複数のTLSライブラリ」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU95474776/" ] } ], "actions": [ { "text": "修正番号が明記されているものは、GnuTLSのCVE-2026-3833が3.8.13、pyca/cryptographyのCVE-2026-34073が46.0.6、wolfSSLのCVE-2026-3547が5.9.0です。それぞれ使っているライブラリーの提供元の更新を適用します。これらの番号を別のライブラリーへ当てはめません。", "kind": "fix", "sourceUrls": [ "https://kb.cert.org/vuls/id/948176" ], "evidenceIds": [ "E1", "E9", "E10", "E3" ] }, { "text": "OpenSSLのURI処理のPR #30319は、2026年9月10日の確認では当時サポートされていた公開版すべてに入っていますが、別のuserinfo-colonの報告は調査中です。AWS-LCのワイルドカードCN問題は修正済みで、Unicode CNは調整中です。Goの別2件、Apple Security.framework、NSS、LibreSSL、s2n-tlsにも調査・調整中の項目があります。", "kind": "fact", "sourceUrls": [ "https://kb.cert.org/vuls/id/948176" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU95474776/" ] } ], "temporaryMitigations": [ { "text": "Name Constraintsに依存する運用では、実際のライブラリーでの挙動を確認し、末端証明書のSANに明示した名前を使い、証明書を発行する段階の制限を第一の対策にします。第2の検証器を使うなら、同じ入力を渡し、検証が失敗した場合に許可しない構成でなければ補完になりません。", "kind": "fix", "sourceUrls": [ "https://kb.cert.org/vuls/id/948176" ], "evidenceIds": [ "E1", "E2", "E3" ] } ], "verification": [ { "text": "担当者から、対象だった製品・適用した修正や設定・反映日時を回答してもらいます。製品ごとの公式情報と照合してから完了とし、通常業務が続けられることも確認してください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/vu/JVNVU95474776/" ], "evidenceIds": [ "E4", "E5", "E6", "E7", "E8" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU95474776/" ] } ], "unknowns": [ "公表時点の公式資料を照合した説明です。実際の機器や設定を検査した結果ではありません。修正版や対応状況は製品・系列ごとに確認してください。" ], "supportRequest": "件名：JVNVU95474776（複数のTLSライブラリ）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nJVNVU95474776について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVNVU95474776", "sources": [ { "url": "https://kb.cert.org/vuls/id/948176", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU95474776/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "reviewedSourceFingerprint": "reviewed-source-v1:972bc13f83aea0164c27d4534408497fc07fddb8c630d2223f69e61de4a0cdad", "reviewedSourceScope": "official_evidence", "evidence": [ { "id": "E1", "sourceUrl": "https://kb.cert.org/vuls/id/948176", "sourceField": "article:overview-description-impact-solution", "excerpt": "VU#948176 - Multiple TLS Libraries can Bypass Delegation Enforcement\n\nOverview\n\nThis note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a constrained name may be accepted by one library and rejected by another. Some are fixed, some remain under review, and some were not accepted as security issues.\n\nDescription\n\nName Constraints are meant to keep a subordinate CA inside an allowed namespace. The records cover several name forms and do not all have the same classification. VU#948176.7 does not exist.\n\nDNS case-sensitivity and wildcards. While RFC 5280 requires case-insensitive DNS matching, it does not explicitly define wildcard Subject Alternative Name (SAN) matching, leading to varied implementation behaviors. For instance, GnuTLS was found to perform case-sensitive comparisons on certain names (CVE-2026-3833, fixed in 3.8.13). Similar discrepancies regarding case handling in wildcard parent-constraint lookups were reported in Go, as well as wildcard inconsistencies in LibreSSL and wolfSSL. Additionally, pyca/cryptography was identified to check DNS Name Constraints against certificate SANs but failed to validate them", "language": "en" }, { "id": "E2", "sourceUrl": "https://kb.cert.org/vuls/id/948176", "sourceField": "article:overview-description-impact-solution", "excerpt": "t.\n\nDNS case-sensitivity and wildcards. While RFC 5280 requires case-insensitive DNS matching, it does not explicitly define wildcard Subject Alternative Name (SAN) matching, leading to varied implementation behaviors. For instance, GnuTLS was found to perform case-sensitive comparisons on certain names (CVE-2026-3833, fixed in 3.8.13). Similar discrepancies regarding case handling in wildcard parent-constraint lookups were reported in Go, as well as wildcard inconsistencies in", "language": "en" }, { "id": "E3", "sourceUrl": "https://kb.cert.org/vuls/id/948176", "sourceField": "article:overview-description-impact-solution", "excerpt": "-specific and may include acceptance of a name outside the intended namespace.\n\nSolution\n\nCERT/CC is coordinating remediation across the affected projects. The following summarizes available status; individual entries reflect different reporting and confirmation dates.\n\nGnuTLS — CVE-2026-3833 fixed in 3.8.13.\n\npyca/cryptography — CVE-2026-34073 fixed in 46.0.6.\n\nwolfSSL — CVE-2026-3547 fixed in 5.9.0. The wildcard was addressed in PR# 9991 .\n\nGo's crypto/x509 — Two reports are in triage. The IPv4-mapped IPv6 report was not accepted as meeting the project's security bar.\n\nOpenSSL — PR #30319 was merged and, as confirmed on 10 September 2026, is present in all then-current publicly supported versions. The separate userinfo-colon report remains in triage.\n\nApple's Security.framework — Three reports submitted on 2026-03-16 remain in triage.\n\nMozilla NSS — IP-address report under coordination.\n\nLibreSSL — Wildcard report under coordination.\n\nAWS-LC — Wildcard CN issue fixed; Unicode CN report under coordination. s2n-tls is in triage.\n\nMbed TLS — Non-critical Name Constraints are not enforced in the reported configuration. Marking the extension critical causes such chains to fail closed rather than adding enforcement.\n\nUntil updates are widely deployed, operators wh", "language": "en" }, { "id": "E4", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourceField": "section:概要", "excerpt": "CERT/CCから本件に関するアドバイザリが公表されました。", "language": "ja" }, { "id": "E5", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourceField": "section:影響を受けるシステム", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E6", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourceField": "section:詳細情報", "excerpt": "Vulnerability Note VU#948176 Multiple TLS Libraries can Bypass Delegation Enforcement", "language": "en" }, { "id": "E7", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourceField": "section:想定される影響", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E8", "sourceUrl": "https://jvn.jp/vu/JVNVU95474776/", "sourceField": "section:対策方法", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E9", "sourceUrl": "https://kb.cert.org/vuls/id/948176", "sourceField": "article:overview-description-impact-solution", "excerpt": "rnative Name (SAN) matching, leading to varied implementation behaviors. For instance, GnuTLS was found to perform case-sensitive comparisons on certain names (CVE-2026-3833, fixed in 3.8.13). Similar discrepancies regarding case handling in wildcard parent-constraint lookups were reported in Go, as well as wildcard inconsistencies in LibreSSL and wolfSSL. Additionally, pyca/cryptography was identified to check DNS Name Constraints against certificate SANs but failed to validate them against the requested peer name (CVE-2026-34073, fixed in 46.0.6).\n\nIP addresses. Some libraries treat IPv4 and IPv4-mapped IPv6 forms as different when matching constraints. The Go security team determined that report did not meet its security bar; similar reports exist for Apple's Security.framework and Mozilla NSS and are included as comparative evidence.\n\nURIs. Libraries can di", "language": "en" }, { "id": "E10", "sourceUrl": "https://kb.cert.org/vuls/id/948176", "sourceField": "article:overview-description-impact-solution", "excerpt": "PR #30319 for an @ in the path, query, or fragment; a separate userinfo-colon report remains in triage. Related URI reports exist for Apple, NSS, and wolfSSL (CVE-2026-3547, fixed in 5.9.0). A well-formed single @ is handled per RFC 3986 by most implementations.\n\nCommon Name fallback. AWS-LC and s2n-tls were reported to apply DNS constraints inconsistently when a leaf has no SAN and uses a wildcard Common Name. The AWS-LC wildcard-CN issue has been fixed; a separate Unicode CN question remains under coo", "language": "en" } ], "summaryEvidenceIds": [ "E1", "E3" ], "riskEvidenceIds": [ "E1", "E3" ], "glossary": [] } }, { "id": "JVNVU94697946", "aliases": [], "title": "Bisheng：ログイン回避、他人のワークフロー閲覧、AI利用料の不正使用", "summary": "LLMアプリ開発基盤Bishengを運用している方は、3件を別々に確認してください。AI利用に関する問題は2.5.0、他人のワークフローを読む問題は3.0.0で修正されています。一方、旧SSOのログイン回避はCERT/CCの公表時点では未修正で、3.0.0への更新だけで全部解決とはいえません。", "risk": "旧SSOではログイン前の攻撃者が他人のアカウントになりすまし、条件により管理権限を得るおそれがあります。別の2件ではログイン済み利用者が、他人のワークフロー設定を読んだり、他人のAI接続設定で料金が発生する処理を動かしたりする可能性があります。", "product": "Bisheng", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "CVE-2026-100156の修正はBisheng 2.5.0、CVE-2026-96681の修正は3.0.0です。両方への対応を管理者に依頼してください。CVE-2026-96679の旧SSO問題は、この2つの修正に含まれるとは扱いません。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://kb.cert.org/vuls/id/166125", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU94697946/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-15T01:30:00.000Z", "modifiedAt": "2026-10-15T01:30:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourceTitle": "Bishengにおける複数の認証回避の脆弱性", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-15T01:30:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-15T01:30:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVNVU94697946", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "fetchedAt": "2026-10-23T02:43:54.009Z", "publishedAt": "2026-10-14T15:00:00.000Z", "modifiedAt": "2026-10-14T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVNVU#94697946\n\nBishengにおける複数の認証回避の脆弱性", "descriptions": [ { "lang": "ja", "value": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "Vulnerability Note VU#166125 Bisheng has authentication bypass vulnerabilities", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://kb.cert.org/vuls/id/166125", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "Vulnerability Note VU#166125 Bisheng has authentication bypass vulnerabilities", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "CERT/CCのアドバイザリを参照してください。", "sourcePath": "section:対策方法" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourcePath": "section:概要", "text": "CERT/CCから本件に関するアドバイザリが公表されました。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourcePath": "section:影響を受けるシステム", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourcePath": "section:詳細情報", "text": "Vulnerability Note VU#166125 Bisheng has authentication bypass vulnerabilities", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourcePath": "section:想定される影響", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourcePath": "section:対策方法", "text": "CERT/CCのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "linked:https://kb.cert.org/vuls/id/166125", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "sourcePath": "article:overview-description-impact-solution", "text": "VU#166125 - Bisheng has authentication bypass vulnerabilities\n\nOverview\n\nBisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perform cross-user LLM credential abuse and data disclosure due to missing service-layer access checks. Together, these flaws could allow unauthenticated attackers to gain administrative control while enabling authenticated users access to sensitive data and hardcoded credentials.\n\nDescription\n\nBisheng is an open-source Large Language Model (LLM) application DevOps platform, developed by DataElement, designed to assist in building, managing, and scaling LLMs.\n\nCVE-2026-96679 (Legacy SSO Bypass) A vulnerability resides in the legacy SSO endpoint ( POST /user/sso ). The application processes incoming JSON payloads containing arbitrary usernames and issues a valid JSON Web Token (JWT) without enforcing any form of caller authentication, such as signature verification, shared secrets, or network allowlisting. Furthermore, if the provided username does not exist, the system automatically registers the account. If this newly generated account matches the configured administrative username or is the first user in the system, it is automatically granted super-administrator privileges.\n\nCVE-2026-96681 (IDOR Workflow Exposure) There are missing authorization controls across multiple version retrieval endpoints. The underlying source code retrieves flow and workflow version records based on user-supplied parameters without performing any data ownership or permission validation. Any authenticated user can query and read the complete Domain-Specific Language (DSL) configurations belonging to other accounts.\n\nCVE-2026-100156 (Credential Abuse & Access Control Skip) Within the assistant service's prompt auto-optimization feature, endpoints accept an assistant identifier from the caller without verifying whether the caller owned that assistant. An assistant identifier is a mechanism that lets users or systems recognize that content or interactions come from an AI assistant rather than a human.\n\nImpact\n\nAuthentication Bypass / Account Takeover: The legacy SSO vulnerability ( CVE-2026-96679 ) allows unauthenticated attackers to bind their session to an existing victim's profile by completely skipping JWT validation, potentially granting full super-administrative access, leading to full application compromise.\n\nUnauthorized Data Disclosure: The IDOR vulnerability ( CVE-2026-96681 ) causes a breach of data confidentiality, as the system fails to properly validate whether the authenticated user has permission to access the resource.\n\nResource and Credential Abuse: The assistant service vulnerability ( CVE-2026-100156 ) allows authenticated attackers to run unauthorized AI inferences billed directly to another user's provider account (such as OpenAI, Azure, or Anthropic), while also leaking the victim assistant's configured tools and workflows.\n\nSolution\n\nThe vendor has addressed two of the three discovered vulnerabilities in subsequent software releases. CERT/CC recommends upgrading to patched releases.\n\nCVE-2026-100156 : The vendor has remediated the assistant service vulnerability in version 2.5.0.\n\nCVE-2026-96681 : The vendor has remediated the IDOR workflow vulnerability in version 3.0.0.\n\nFor the remaining unpatched vulnerability ( CVE-2026-96679 ), DataElement/Bisheng has not responded to multiple coordination efforts. CERT/CC suggests implementing the manual mitigations below until an official update becomes available.\n\nMitigations\n\nCVE-2026-96679 Legacy SSO Vulnerability: Administrators should consider the following defensive measures:\n\nAvoid setting BISHENG_PRO=true in the environment configuration.\n\nDisable or deprecate the legacy SSO endpoint entirely, or enforce global JWT validation. The affected function is sso() , located in src/backend/bisheng/user/api/user.py , affecting the API endpoint POST /user/sso .\n\nRestrict access to the POST /user/sso network path to loopback/same-origin to provide defense-in-depth.", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-96679", "CVE-2026-96681", "CVE-2026-100156" ] } ], "limits": { "completeness": "official_article_with_linked_advisories", "truncatedFields": [], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2026-96679", "CVE-2026-96681", "CVE-2026-100156" ], "supplementarySources": [ { "sourceType": "CERT/CC", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "title": "VU#166125 - Bisheng has authentication bypass vulnerabilities", "relatedCves": [ "CVE-2026-96679", "CVE-2026-96681", "CVE-2026-100156" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "CERT/CC", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "title": "VU#166125 - Bisheng has authentication bypass vulnerabilities", "relatedCves": [ "CVE-2026-96679", "CVE-2026-96681", "CVE-2026-100156" ], "truncated": false } ] }, "relatedCves": [ "CVE-2026-96679", "CVE-2026-96681", "CVE-2026-100156" ], "sourceSummary": "CERT/CCから本件に関するアドバイザリが公表されました。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T03:49:22.000Z", "reviewState": "current", "summary": "LLMアプリ開発基盤Bishengを運用している方は、3件を別々に確認してください。AI利用に関する問題は2.5.0、他人のワークフローを読む問題は3.0.0で修正されています。一方、旧SSOのログイン回避はCERT/CCの公表時点では未修正で、3.0.0への更新だけで全部解決とはいえません。", "risk": "旧SSOではログイン前の攻撃者が他人のアカウントになりすまし、条件により管理権限を得るおそれがあります。別の2件ではログイン済み利用者が、他人のワークフロー設定を読んだり、他人のAI接続設定で料金が発生する処理を動かしたりする可能性があります。", "applicability": [ { "text": "CVE-2026-96679：旧SSOのPOST /user/ssoが、呼び出し元の署名・秘密情報・許可ネットワークなどを検証せず、指定された利用者として認証情報を発行します。新規アカウントが設定済みの管理者名と一致する場合や最初の利用者の場合は、特に強い権限を与えられる条件があります。", "kind": "fact", "sourceUrls": [ "https://kb.cert.org/vuls/id/166125" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "CVE-2026-96681：ログインした利用者が、所有権の確認なしに他人のフロー・ワークフローの版や設定を読める問題です。CVE-2026-100156は2.5.0より前のassistantサービスのプロンプト自動最適化で、他人のassistant識別子を指定すると、その人のAIアカウントで処理を動かせる問題です。", "kind": "fact", "sourceUrls": [ "https://kb.cert.org/vuls/id/166125" ], "evidenceIds": [ "E1", "E3", "E4" ] }, { "text": "利用中の製品名・型番・完全な版番号を確認し、自分の製品の項目だけを照合してください。複数製品をまとめた告知では、別製品の修正版や対策を流用しません。分からない項目は管理担当者にこのページを渡して確認します。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU94697946/" ], "evidenceIds": [ "E5", "E6", "E7", "E8", "E9" ] }, { "text": "最初に「Bisheng」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU94697946/" ] } ], "versionChecks": [ { "text": "「Bisheng」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU94697946/" ] } ], "actions": [ { "text": "CVE-2026-100156の修正はBisheng 2.5.0、CVE-2026-96681の修正は3.0.0です。両方への対応を管理者に依頼してください。CVE-2026-96679の旧SSO問題は、この2つの修正に含まれるとは扱いません。", "kind": "fix", "sourceUrls": [ "https://kb.cert.org/vuls/id/166125" ], "evidenceIds": [ "E1", "E3", "E2", "E4", "E10" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU94697946/" ] } ], "temporaryMitigations": [ { "text": "旧SSOのCVE-2026-96679についてCERT/CCは、BISHENG_PRO=trueの設定を避ける、旧SSO機能を無効化・廃止するか全体でJWTを検証する、POST /user/ssoへの接続をloopback・same-originの範囲へ制限する措置を示しています。認証への影響があるため、管理者が利用中のSSO構成を確認して適用します。", "kind": "fix", "sourceUrls": [ "https://kb.cert.org/vuls/id/166125" ], "evidenceIds": [ "E1", "E2", "E11" ] } ], "verification": [ { "text": "担当者から、対象だった製品・適用した修正や設定・反映日時を回答してもらいます。製品ごとの公式情報と照合してから完了とし、通常業務が続けられることも確認してください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/vu/JVNVU94697946/" ], "evidenceIds": [ "E5", "E6", "E7", "E8", "E9" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU94697946/" ] } ], "unknowns": [ "公表時点の公式資料を照合した説明です。実際の機器や設定を検査した結果ではありません。修正版や対応状況は製品・系列ごとに確認してください。" ], "supportRequest": "件名：JVNVU94697946（Bisheng）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nJVNVU94697946について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVNVU94697946", "sources": [ { "url": "https://kb.cert.org/vuls/id/166125", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU94697946/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "reviewedSourceFingerprint": "reviewed-source-v1:7612d3609e723115d0d927a3cbcd89c41b7e9c837afed902e7507c5afb666d0a", "reviewedSourceScope": "official_evidence", "evidence": [ { "id": "E1", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "sourceField": "article:overview-description-impact-solution", "excerpt": "VU#166125 - Bisheng has authentication bypass vulnerabilities\n\nOverview\n\nBisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perform cross-user LLM credential abuse and data disclosure due to missing service-layer access checks. Together, these flaws could allow unauthenticated attackers to gain administrative control while enabling authenticated users access to sensitive data and hardcoded credentials.\n\nDescription\n\nBisheng is an open-source Large Language Model (LLM) application DevOps platform, developed by DataElement, designed to assist in building, managing, and scaling LLMs.\n\nCVE-2026-96679 (Legacy SSO Bypass) A vulnerability resides in the legacy SSO endpoint ( POST /user/sso ). The application processes incoming JSON payloads containing arbitrary usernames and issues a valid JSON Web Token (JWT) without enforcing any form of caller authentication, such as signature verification, shared secrets, or network allowlisting. Furthermore, if the provided username does not exist, the system automatic", "language": "en" }, { "id": "E2", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "sourceField": "article:overview-description-impact-solution", "excerpt": "s an open-source Large Language Model (LLM) application DevOps platform, developed by DataElement, designed to assist in building, managing, and scaling LLMs.\n\nCVE-2026-96679 (Legacy SSO Bypass) A vulnerability resides in the legacy SSO endpoint ( POST /user/sso ). The application processes incoming JSON payloads containing arbitrary usernames and issues a valid JSON Web Token (JWT) without enforcing any form of caller authentication, such as signature verification, shared secrets, or netw", "language": "en" }, { "id": "E3", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "sourceField": "article:overview-description-impact-solution", "excerpt": "ia a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perform cross-user LLM credential abuse and data disclosure due to missing service-layer access checks. Together, these flaws could allow unauthenticated attackers to gain administrative control while enabling authenticated users access to sensitive data and hardcoded credentials.\n\nDescr", "language": "en" }, { "id": "E4", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "sourceField": "article:overview-description-impact-solution", "excerpt": "nerated account matches the configured administrative username or is the first user in the system, it is automatically granted super-administrator privileges.\n\nCVE-2026-96681 (IDOR Workflow Exposure) There are missing authorization controls across multiple version retrieval endpoints. The underlying source code retrieves flow and workflow version records based on user-supplied parameters without performing any data ownership or permission validation. Any authenticated user can query and read the complete Domain-Specific Language (DSL) configurations belonging to other accounts.\n\nCVE-2026-100156 (Credential Abuse & Access Control Skip) Within the assistant service's prompt auto-optimization feature, endpoints accept an assistant identifier from the caller without verifying whether the caller owned that assistant. An assistant identifier is a mechanism that lets users or systems recognize that content or inter", "language": "en" }, { "id": "E5", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourceField": "section:概要", "excerpt": "CERT/CCから本件に関するアドバイザリが公表されました。", "language": "ja" }, { "id": "E6", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourceField": "section:影響を受けるシステム", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E7", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourceField": "section:詳細情報", "excerpt": "Vulnerability Note VU#166125 Bisheng has authentication bypass vulnerabilities", "language": "en" }, { "id": "E8", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourceField": "section:想定される影響", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E9", "sourceUrl": "https://jvn.jp/vu/JVNVU94697946/", "sourceField": "section:対策方法", "excerpt": "CERT/CCのアドバイザリを参照してください。", "language": "ja" }, { "id": "E10", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "sourceField": "article:overview-description-impact-solution", "excerpt": "ic), while also leaking the victim assistant's configured tools and workflows.\n\nSolution\n\nThe vendor has addressed two of the three discovered vulnerabilities in subsequent software releases. CERT/CC recommends upgrading to patched releases.\n\nCVE-2026-100156 : The vendor has remediated the assistant service vulnerability in version 2.5.0.\n\nCVE-2026-96681 : The vendor has remediated the IDOR workflow vulnerability in version 3.0.0.\n\nFor the remaining unpatched vulnerability ( CVE-2026-96679 ), DataElement/Bisheng has not responded to multiple coordination efforts. CERT/CC suggests implementing the manual mitigations below until an official update becomes available.\n\nMitigations\n\nCVE-2026-96679 Legacy SSO Vulnerability: Administrators should consider the following defensive measures:\n\nAvoid setting BISHENG_PRO=true in the environment configuration.\n\nDisable or deprecate the legacy SSO endpoint entirely, or enforce global JWT validation. The affected function is sso() , located in src/backend/bisheng/user/api/user.py , affecting the API endpoint POST /user/sso .\n\nRestrict access to the POST /user/sso network path to loopback/same-origin to provide defense-in-depth.", "language": "en" }, { "id": "E11", "sourceUrl": "https://kb.cert.org/vuls/id/166125", "sourceField": "article:overview-description-impact-solution", "excerpt": "pdate becomes available.\n\nMitigations\n\nCVE-2026-96679 Legacy SSO Vulnerability: Administrators should consider the following defensive measures:\n\nAvoid setting BISHENG_PRO=true in the environment configuration.\n\nDisable or deprecate the legacy SSO endpoint entirely, or enforce global JWT validation. The affected function is sso() , located in src/backend/bisheng/user/api/user.py , affecting the API endpoint POST /user/sso .\n\nRestrict access to the POST /user/sso network path to loopback", "language": "en" } ], "summaryEvidenceIds": [ "E1", "E3", "E10" ], "riskEvidenceIds": [ "E1", "E3", "E10" ], "glossary": [ { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" } ] } }, { "id": "CVE-2026-21589", "aliases": [], "title": "Atlassianのサーバー製品：ログインなしで特定のファイルを読まれるおそれ", "summary": "Jira・Confluence・Bitbucketなど、対象のAtlassian製品を自分たちのサーバーで運用している場合に確認する問題です。攻撃者がファイルの正確な名前と場所を知っていると、ログインせずにWebアプリの配置場所にある特定のファイルを読める可能性があります。製品ごとに修正版が違います。", "risk": "Webアプリの配置場所に機密ファイルがある構成では、その内容が漏れる可能性があります。この問題だけでフォルダー内の一覧を見られるわけではなく、攻撃者は対象ファイルの正確な名前と場所を事前に知る必要があります。", "product": "Bamboo Data Center / Bitbucket Data Center / Confluence Data Center / Crowd Data Center / Crucible Data Center / Fisheye Data Center / Jira Service Management Data Center / Jira Software Data Center", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "atlassian", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H", "affected": [ { "product": "Bamboo Data Center", "range": "All other versions" }, { "product": "Bitbucket Data Center", "range": "All other versions" }, { "product": "Confluence Data Center", "range": "All other versions" }, { "product": "Crowd Data Center", "range": "All other versions" }, { "product": "Crucible Data Center", "range": "All other versions" }, { "product": "Fisheye Data Center", "range": "All other versions" }, { "product": "Jira Service Management Data Center", "range": "All other versions" }, { "product": "Jira Software Data Center", "range": "All other versions" } ], "fixed": [], "steps": [ "Bitbucket Data Centerの修正版は9.4.26 / 10.2.8 / 10.5.1です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "Confluence Data Centerの修正版は9.2.26 / 10.2.19です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "Crowd Data Centerの修正版は6.3.7 / 7.0.3 / 7.1.7 / 7.2.4です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "Jira Software Data Centerの修正版は9.12.40 / 10.3.26 / 11.3.12です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "Jira Service Management Data Centerの修正版は5.12.40 / 10.3.26 / 11.3.12です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "Bamboo Data Centerの修正版は10.2.24 / 12.1.12です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "Crucibleの修正版は4.9.15です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "Fisheyeの修正版は4.9.15です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "管理担当者へ製品名と現在の完全なバージョンを伝え、対象製品ごとに更新を依頼します。別製品の番号を流用せず、複数のAtlassian製品を運用している場合は、それぞれ確認してください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "label": "Atlassianが登録したCVE：製品別の修正版" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21589", "label": "CVE公式レコード" }, { "url": "https://jira.atlassian.com/browse/BAM-26567", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/BSERV-20604", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/CONFSERVER-104488", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/CRUC-8741", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/CWD-6610", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/FE-7583", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/JRASERVER-79546", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/JSDSERVER-16809", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589", "label": "CISA KEV（悪用確認）" }, { "url": "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-05T21:30:00.390Z", "modifiedAt": "2026-10-19T18:26:40.891Z", "fetchedAt": "2026-10-23T02:43:47.840Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.", "sourceTitle": "", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "Atlassian", "product": "Bamboo Data Center", "versions": [ { "version": "All other versions", "status": "affected" }, { "version": "Patch version 10.2.24 and later", "status": "unaffected" }, { "version": "Patch version 12.1.12 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Bitbucket Data Center", "versions": [ { "version": "All other versions", "status": "affected" }, { "version": "Patch version 10.2.8 and later", "status": "unaffected" }, { "version": "Patch version 10.5.1 and later", "status": "unaffected" }, { "version": "Patch version 9.4.26 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Confluence Data Center", "versions": [ { "version": "All other versions", "status": "affected" }, { "version": "Patch version 10.2.19 and later", "status": "unaffected" }, { "version": "Patch version 9.2.26 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Crowd Data Center", "versions": [ { "version": "All other versions", "status": "affected" }, { "version": "Patch version 7.2.4 and later", "status": "unaffected" }, { "version": "Patch version 7.1.7 and later", "status": "unaffected" }, { "version": "Patch version 7.0.3 and later", "status": "unaffected" }, { "version": "Patch version 6.3.7 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Crucible Data Center", "versions": [ { "version": "All other versions", "status": "affected" }, { "version": "Patch version 4.9.15 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Fisheye Data Center", "versions": [ { "version": "All other versions", "status": "affected" }, { "version": "Patch version 4.9.15 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Jira Service Management Data Center", "versions": [ { "version": "All other versions", "status": "affected" }, { "version": "Patch version 11.3.12 and later", "status": "unaffected" }, { "version": "Patch version 10.3.26 and later", "status": "unaffected" }, { "version": "Patch version 5.12.40 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Jira Software Data Center", "versions": [ { "version": "All other versions", "status": "affected" }, { "version": "Patch version 11.3.12 and later", "status": "unaffected" }, { "version": "Patch version 10.3.26 and later", "status": "unaffected" }, { "version": "Patch version 9.12.40 and later", "status": "unaffected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-21589", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "fetchedAt": "2026-10-23T02:43:47.840Z", "publishedAt": "2026-10-05T21:30:00.390Z", "modifiedAt": "2026-10-19T18:26:40.891Z", "state": "published", "provider": "atlassian", "title": "", "descriptions": [ { "lang": "en", "value": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Atlassian", "product": "Bamboo Data Center", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "All other versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "Patch version 10.2.24 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "Patch version 12.1.12 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Bitbucket Data Center", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "All other versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "Patch version 10.2.8 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "Patch version 10.5.1 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "Patch version 9.4.26 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Confluence Data Center", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "All other versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "Patch version 10.2.19 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/2/versions/2", "version": "Patch version 9.2.26 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Crowd Data Center", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "All other versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/1", "version": "Patch version 7.2.4 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/3/versions/2", "version": "Patch version 7.1.7 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/3/versions/3", "version": "Patch version 7.0.3 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/3/versions/4", "version": "Patch version 6.3.7 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Crucible Data Center", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "All other versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/1", "version": "Patch version 4.9.15 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Fisheye Data Center", "sourcePath": "/containers/cna/affected/5", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "All other versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/5/versions/1", "version": "Patch version 4.9.15 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Jira Service Management Data Center", "sourcePath": "/containers/cna/affected/6", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "All other versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/6/versions/1", "version": "Patch version 11.3.12 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/6/versions/2", "version": "Patch version 10.3.26 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/6/versions/3", "version": "Patch version 5.12.40 and later", "status": "unaffected" } ] }, { "vendor": "Atlassian", "product": "Jira Software Data Center", "sourcePath": "/containers/cna/affected/7", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "All other versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/7/versions/1", "version": "Patch version 11.3.12 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/7/versions/2", "version": "Patch version 10.3.26 and later", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/7/versions/3", "version": "Patch version 9.12.40 and later", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Path Traversal (Arbitrary Read/Write)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "atlassian", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://jira.atlassian.com/browse/BAM-26567", "label": "atlassian", "tags": [], "provider": "atlassian", "sourcePath": "/containers/cna/references/0" }, { "url": "https://jira.atlassian.com/browse/BSERV-20604", "label": "atlassian", "tags": [], "provider": "atlassian", "sourcePath": "/containers/cna/references/1" }, { "url": "https://jira.atlassian.com/browse/CONFSERVER-104488", "label": "atlassian", "tags": [], "provider": "atlassian", "sourcePath": "/containers/cna/references/2" }, { "url": "https://jira.atlassian.com/browse/CRUC-8741", "label": "atlassian", "tags": [], "provider": "atlassian", "sourcePath": "/containers/cna/references/3" }, { "url": "https://jira.atlassian.com/browse/CWD-6610", "label": "atlassian", "tags": [], "provider": "atlassian", "sourcePath": "/containers/cna/references/4" }, { "url": "https://jira.atlassian.com/browse/FE-7583", "label": "atlassian", "tags": [], "provider": "atlassian", "sourcePath": "/containers/cna/references/5" }, { "url": "https://jira.atlassian.com/browse/JRASERVER-79546", "label": "atlassian", "tags": [], "provider": "atlassian", "sourcePath": "/containers/cna/references/6" }, { "url": "https://jira.atlassian.com/browse/JSDSERVER-16809", "label": "atlassian", "tags": [], "provider": "atlassian", "sourcePath": "/containers/cna/references/7" }, { "url": "https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Bamboo Data Center\",\"versions\":[{\"version\":\"All other versions\",\"status\":\"affected\"},{\"version\":\"Patch version 10.2.24 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 12.1.12 and later\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Bitbucket Data Center\",\"versions\":[{\"version\":\"All other versions\",\"status\":\"affected\"},{\"version\":\"Patch version 10.2.8 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 10.5.1 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 9.4.26 and later\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Confluence Data Center\",\"versions\":[{\"version\":\"All other versions\",\"status\":\"affected\"},{\"version\":\"Patch version 10.2.19 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 9.2.26 and later\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Crowd Data Center\",\"versions\":[{\"version\":\"All other versions\",\"status\":\"affected\"},{\"version\":\"Patch version 7.2.4 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 7.1.7 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 7.0.3 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 6.3.7 and later\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Crucible Data Center\",\"versions\":[{\"version\":\"All other versions\",\"status\":\"affected\"},{\"version\":\"Patch version 4.9.15 and later\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Fisheye Data Center\",\"versions\":[{\"version\":\"All other versions\",\"status\":\"affected\"},{\"version\":\"Patch version 4.9.15 and later\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Jira Service Management Data Center\",\"versions\":[{\"version\":\"All other versions\",\"status\":\"affected\"},{\"version\":\"Patch version 11.3.12 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 10.3.26 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 5.12.40 and later\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Atlassian\",\"product\":\"Jira Software Data Center\",\"versions\":[{\"version\":\"All other versions\",\"status\":\"affected\"},{\"version\":\"Patch version 11.3.12 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 10.3.26 and later\",\"status\":\"unaffected\"},{\"version\":\"Patch version 9.12.40 and later\",\"status\":\"unaffected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Path Traversal (Arbitrary Read/Write)\",\"lang\":\"en\",\"type\":\"Path Traversal (Arbitrary Read/Write)\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-19T18:26:40.891Z", "fetchedAt": "2026-10-23T02:43:47.840Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-10-15T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Bamboo Data Center / Bitbucket Data Center / Confluence Data Center / Crowd Data Center / Crucible Data Center / Fisheye Data Center / Jira Service Management Data Center / Jira Software Data Centerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T03:34:23.000Z", "reviewState": "current", "summary": "Jira・Confluence・Bitbucketなど、対象のAtlassian製品を自分たちのサーバーで運用している場合に確認する問題です。攻撃者がファイルの正確な名前と場所を知っていると、ログインせずにWebアプリの配置場所にある特定のファイルを読める可能性があります。製品ごとに修正版が違います。", "risk": "Webアプリの配置場所に機密ファイルがある構成では、その内容が漏れる可能性があります。この問題だけでフォルダー内の一覧を見られるわけではなく、攻撃者は対象ファイルの正確な名前と場所を事前に知る必要があります。", "applicability": [ { "text": "対象として挙がっている製品はBitbucket Data Center、Confluence Data Center、Jira Service Management Data Center、Jira Software Data Center、Bamboo Data Center、Crowd Data Center、Crucible、Fisheyeです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式説明で問題の導入時期が挙がっているのはBitbucket 4.6.0以降、Confluence 5.10.0以降、Crowd 2.11.0以降、Jira Software 7.1.0以降、Jira Service Management 3.1.0以降、Bamboo 7.0.1以降です。これらより新しくても修正済みの版があるため、下の製品別の修正版と照合してください。", "kind": "check", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "最初に「Bamboo Data Center / Bitbucket Data Center / Confluence Data Center / Crowd Data Center / Crucible Data Center / Fisheye Data Center / Jira Service Management Data Center / Jira Software Data Center」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-21589", "https://jira.atlassian.com/browse/BAM-26567", "https://jira.atlassian.com/browse/BSERV-20604", "https://jira.atlassian.com/browse/CONFSERVER-104488", "https://jira.atlassian.com/browse/CRUC-8741", "https://jira.atlassian.com/browse/CWD-6610", "https://jira.atlassian.com/browse/FE-7583", "https://jira.atlassian.com/browse/JRASERVER-79546", "https://jira.atlassian.com/browse/JSDSERVER-16809", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589", "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-21589" ] } ], "versionChecks": [ { "text": "「Bamboo Data Center / Bitbucket Data Center / Confluence Data Center / Crowd Data Center / Crucible Data Center / Fisheye Data Center / Jira Service Management Data Center / Jira Software Data Center」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-21589", "https://jira.atlassian.com/browse/BAM-26567", "https://jira.atlassian.com/browse/BSERV-20604", "https://jira.atlassian.com/browse/CONFSERVER-104488", "https://jira.atlassian.com/browse/CRUC-8741", "https://jira.atlassian.com/browse/CWD-6610", "https://jira.atlassian.com/browse/FE-7583", "https://jira.atlassian.com/browse/JRASERVER-79546", "https://jira.atlassian.com/browse/JSDSERVER-16809", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589", "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-21589" ] } ], "actions": [ { "text": "Bitbucket Data Centerの修正版は9.4.26 / 10.2.8 / 10.5.1です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "Confluence Data Centerの修正版は9.2.26 / 10.2.19です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "Crowd Data Centerの修正版は6.3.7 / 7.0.3 / 7.1.7 / 7.2.4です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "Jira Software Data Centerの修正版は9.12.40 / 10.3.26 / 11.3.12です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "Jira Service Management Data Centerの修正版は5.12.40 / 10.3.26 / 11.3.12です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "Bamboo Data Centerの修正版は10.2.24 / 12.1.12です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "Crucibleの修正版は4.9.15です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "Fisheyeの修正版は4.9.15です。利用中の系列に対応する修正版、またはその修正を含む後続版へ更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ], "evidenceIds": [ "E1" ] }, { "text": "管理担当者へ製品名と現在の完全なバージョンを伝え、対象製品ごとに更新を依頼します。別製品の番号を流用せず、複数のAtlassian製品を運用している場合は、それぞれ確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-21589", "https://jira.atlassian.com/browse/BAM-26567", "https://jira.atlassian.com/browse/BSERV-20604", "https://jira.atlassian.com/browse/CONFSERVER-104488", "https://jira.atlassian.com/browse/CRUC-8741", "https://jira.atlassian.com/browse/CWD-6610", "https://jira.atlassian.com/browse/FE-7583", "https://jira.atlassian.com/browse/JRASERVER-79546", "https://jira.atlassian.com/browse/JSDSERVER-16809", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589", "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-21589" ] } ], "temporaryMitigations": [], "verification": [ { "text": "更新後に製品情報の画面で版・ビルド番号を記録し、このCVEの修正が含まれることを提供元の説明と照合します。普段の主要な操作も確認し、担当者から適用日時と結果を受け取ってください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-21589", "https://jira.atlassian.com/browse/BAM-26567", "https://jira.atlassian.com/browse/BSERV-20604", "https://jira.atlassian.com/browse/CONFSERVER-104488", "https://jira.atlassian.com/browse/CRUC-8741", "https://jira.atlassian.com/browse/CWD-6610", "https://jira.atlassian.com/browse/FE-7583", "https://jira.atlassian.com/browse/JRASERVER-79546", "https://jira.atlassian.com/browse/JSDSERVER-16809", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589", "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-21589" ] } ], "unknowns": [ "利用中の環境を検査した結果ではありません。製品名・版・利用条件と、実際に修正が適用されているかを確認してください。", "修正版の番号は製品ごとに異なるため、AI向けの共通fixed一覧にはまとめず、対策ごとに製品との対応関係を記載しています。" ], "supportRequest": "件名：CVE-2026-21589（Bamboo Data Center / Bitbucket Data Center / Confluence Data Center / Crowd Data Center / Crucible Data Center / Fisheye Data Center / Jira Service Management Data Center / Jira Software Data Center）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-21589について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-21589", "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "label": "Atlassianが登録したCVE：製品別の修正版" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21589", "label": "CVE公式レコード" }, { "url": "https://jira.atlassian.com/browse/BAM-26567", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/BSERV-20604", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/CONFSERVER-104488", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/CRUC-8741", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/CWD-6610", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/FE-7583", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/JRASERVER-79546", "label": "CVE掲載の参考情報" }, { "url": "https://jira.atlassian.com/browse/JSDSERVER-16809", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589", "label": "CISA KEV（悪用確認）" }, { "url": "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "reviewedSourceFingerprint": "reviewed-source-v1:61e44c4d48d18a375e52893fe6f6909c0a16259283f0bcbbe950e4409f537624", "reviewedSourceScope": "official_evidence", "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21589.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.", "language": "en", "representation": "source_excerpt" } ], "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "glossary": [] } }, { "id": "JVN43511918", "aliases": [], "title": "EC-CUBE4系用プラグイン「AmazonPayプラグイン」における不変と想定しているWebパラメータの外部制御の脆弱性", "summary": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、不変と想定しているWebパラメータの外部制御の脆弱性が存在します。", "risk": "注文手続き中に任意のウェブサイトにリダイレクトされる可能性があります。その結果、アカウント情報などを窃取される可能性があります。", "product": "EC-CUBE4系用プラグイン「AmazonPayプラグイン」", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "パッチを適用する\n\n開発者が提供する情報をもとに、パッチを適用してください。", "「JVN43511918」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN43511918/", "label": "JVNの原文" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-14T08:00:00.000Z", "modifiedAt": "2026-10-14T08:00:00.000Z", "fetchedAt": "2026-10-23T01:17:50.760Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、不変と想定しているWebパラメータの外部制御の脆弱性が存在します。", "sourceTitle": "EC-CUBE4系用プラグイン「AmazonPayプラグイン」における不変と想定しているWebパラメータの外部制御の脆弱性", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-14T08:00:00.000Z", "fetchedAt": "2026-10-23T01:17:50.760Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-14T08:00:00.000Z", "fetchedAt": "2026-10-23T01:17:50.760Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVN43511918", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "fetchedAt": "2026-10-23T02:43:53.931Z", "publishedAt": "2026-10-13T15:00:00.000Z", "modifiedAt": "2026-10-13T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVN#43511918\n\nEC-CUBE4系用プラグイン「AmazonPayプラグイン」における不変と想定しているWebパラメータの外部制御の脆弱性\n\n緊急", "descriptions": [ { "lang": "ja", "value": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、不変と想定しているWebパラメータの外部制御の脆弱性が存在します。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、次の脆弱性が存在します。\n\n不変と想定しているWebパラメータの外部制御（ CWE-472 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N 基本値 5.3\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N 基本値 4.7\n\nCVE-2026-103671\n\n開発者によると、本脆弱性を悪用した攻撃が既に確認されています。", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "注文手続き中に任意のウェブサイトにリダイレクトされる可能性があります。その結果、アカウント情報などを窃取される可能性があります。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "CV2版\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.1.7からv1.1.12\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.0.0からv1.1.6\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.3.1（バンドル版）\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.3からv4.3.1\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.0からv4.2.2\n\nCV1版\n\nAmazonPayプラグイン v1.3.0およびそれ以前のバージョン（4.0系）", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "パッチを適用する\n\n開発者が提供する情報をもとに、パッチを適用してください。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://cwe.mitre.org/data/definitions/472.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ec-cube.net/news/detail.php?news_id=490", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103671", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2026-000150", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、不変と想定しているWebパラメータの外部制御の脆弱性が存在します。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "CV2版\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.1.7からv1.1.12\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.0.0からv1.1.6\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.3.1（バンドル版）\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.3からv4.3.1\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.0からv4.2.2\n\nCV1版\n\nAmazonPayプラグイン v1.3.0およびそれ以前のバージョン（4.0系）", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、次の脆弱性が存在します。\n\n不変と想定しているWebパラメータの外部制御（ CWE-472 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N 基本値 5.3\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N 基本値 4.7\n\nCVE-2026-103671\n\n開発者によると、本脆弱性を悪用した攻撃が既に確認されています。", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "注文手続き中に任意のウェブサイトにリダイレクトされる可能性があります。その結果、アカウント情報などを窃取される可能性があります。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "パッチを適用する\n\n開発者が提供する情報をもとに、パッチを適用してください。", "sourcePath": "section:対策方法" }, { "heading": "ベンダ情報", "value": "ベンダ\nステータス\nステータス\n最終更新日\nベンダの告知ページ\n\n株式会社イーシーキューブ\n\n該当製品あり\n\n2026/10/14\n\n株式会社イーシーキューブ の告知ページ", "sourcePath": "section:ベンダ情報" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourcePath": "section:概要", "text": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、不変と想定しているWebパラメータの外部制御の脆弱性が存在します。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourcePath": "section:影響を受けるシステム", "text": "CV2版\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.1.7からv1.1.12\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.0.0からv1.1.6\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.3.1（バンドル版）\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.3からv4.3.1\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.0からv4.2.2\n\nCV1版\n\nAmazonPayプラグイン v1.3.0およびそれ以前のバージョン（4.0系）", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourcePath": "section:詳細情報", "text": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、次の脆弱性が存在します。\n\n不変と想定しているWebパラメータの外部制御（ CWE-472 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N 基本値 5.3\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N 基本値 4.7\n\nCVE-2026-103671\n\n開発者によると、本脆弱性を悪用した攻撃が既に確認されています。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourcePath": "section:想定される影響", "text": "注文手続き中に任意のウェブサイトにリダイレクトされる可能性があります。その結果、アカウント情報などを窃取される可能性があります。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourcePath": "section:対策方法", "text": "パッチを適用する\n\n開発者が提供する情報をもとに、パッチを適用してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:ベンダ情報", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourcePath": "section:ベンダ情報", "text": "ベンダ\nステータス\nステータス\n最終更新日\nベンダの告知ページ\n\n株式会社イーシーキューブ\n\n該当製品あり\n\n2026/10/14\n\n株式会社イーシーキューブ の告知ページ", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"EC-CUBE CO.,LTD.\",\"product\":\"AmazonPay V2 Plugin (4.0/4.1 series)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"v1.1.7\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"v1.1.12\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"EC-CUBE CO.,LTD.\",\"product\":\"AmazonPay V2 Plugin (4.0/4.1 series)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"v1.0.0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"v1.1.6\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"EC-CUBE CO.,LTD.\",\"product\":\"AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"v4.3.1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"EC-CUBE CO.,LTD.\",\"product\":\"AmazonPay V2 Plugin (4.2/4.3 series)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"v4.2.3\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"v4.3.1\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"EC-CUBE CO.,LTD.\",\"product\":\"AmazonPay V2 Plugin (4.2/4.3 series)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"v4.2.0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"v4.2.2\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"EC-CUBE CO.,LTD.\",\"product\":\"AmazonPay Plugin (4.0 series)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThanOrEqual\":\"v1.3.0\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) \"AmazonPay Plugin\". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"External control of assumed-Immutable web parameter\",\"lang\":\"en-US\",\"cweId\":\"CWE-472\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":4.7,\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" }, { "evidenceId": "related:CVE-2026-103671:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-103671" } ], "limits": { "completeness": "official_article_with_linked_advisories", "truncatedFields": [], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2026-103671" ], "supplementarySources": [ { "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "id": "CVE-2026-103671", "modifiedAt": "2026-10-14T14:15:44.172Z" } ], "relatedDocuments": [ { "type": "cve", "id": "CVE-2026-103671", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103671.json", "modifiedAt": "2026-10-14T14:15:44.172Z", "affected": [ { "vendor": "EC-CUBE CO.,LTD.", "product": "AmazonPay V2 Plugin (4.0/4.1 series)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "v1.1.7", "lessThanOrEqual": "v1.1.12", "versionType": "semver", "status": "affected" } ] }, { "vendor": "EC-CUBE CO.,LTD.", "product": "AmazonPay V2 Plugin (4.0/4.1 series)", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "v1.0.0", "lessThanOrEqual": "v1.1.6", "versionType": "semver", "status": "affected" } ] }, { "vendor": "EC-CUBE CO.,LTD.", "product": "AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition)", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "v4.3.1", "status": "affected" } ] }, { "vendor": "EC-CUBE CO.,LTD.", "product": "AmazonPay V2 Plugin (4.2/4.3 series)", "sourcePath": "/containers/cna/affected/3", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "v4.2.3", "lessThanOrEqual": "v4.3.1", "versionType": "semver", "status": "affected" } ] }, { "vendor": "EC-CUBE CO.,LTD.", "product": "AmazonPay V2 Plugin (4.2/4.3 series)", "sourcePath": "/containers/cna/affected/4", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "v4.2.0", "lessThanOrEqual": "v4.2.2", "versionType": "semver", "status": "affected" } ] }, { "vendor": "EC-CUBE CO.,LTD.", "product": "AmazonPay Plugin (4.0 series)", "sourcePath": "/containers/cna/affected/5", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "0", "lessThanOrEqual": "v1.3.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [] } ] }, "relatedCves": [ "CVE-2026-103671" ], "sourceSummary": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、不変と想定しているWebパラメータの外部制御の脆弱性が存在します。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:16.155Z", "sourceFingerprint": "fde554c8e1b42cff14a131a08283f50038babad9091fbc328ffee97fb3fc2fe3", "generatorVersion": "2026-10-23.3", "sourceModifiedAt": "2026-10-14T08:00:00.000Z", "verificationMethod": "official_japanese_source_with_structured_checks", "summary": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、不変と想定しているWebパラメータの外部制御の脆弱性が存在します。", "risk": "注文手続き中に任意のウェブサイトにリダイレクトされる可能性があります。その結果、アカウント情報などを窃取される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "JVNが公表している対象範囲です。\nCV2版\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.1.7からv1.1.12\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.0.0からv1.1.6\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.3.1（バンドル版）\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.3からv4.3.1\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.0からv4.2.2\n\nCV1版\n\nAmazonPayプラグイン v1.3.0およびそれ以前のバージョン（4.0系）", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ], "evidenceIds": [ "E3" ] }, { "text": "利用中の製品名・開発元・版を、この対象範囲と照らし合わせてください。OSや製品の種類、機能の設定、例外の記載がある場合は、番号だけでなくその条件も確認します。自分で判断できない場合は、下の確認メモを管理担当者に渡してください。", "kind": "check", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ], "evidenceIds": [ "E3" ] }, { "text": "公表されたCVSS評価では、攻撃前に対象システムの権限を持っている必要はありません。他の構成・機能の条件まで不要という意味ではありません。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ], "evidenceIds": [ "E4" ] }, { "text": "公表されたCVSS評価では、ネットワーク越しに攻撃が届く経路があります。あなたの環境がインターネットから到達可能かどうかは、公開設定を別に確認する必要があります。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ], "evidenceIds": [ "E4" ] }, { "text": "公表されたCVSS評価では、ページの表示など、利用者の限定的な関与が必要です。危険な警告を承認するような積極的な操作が必須とは限りません。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ], "evidenceIds": [ "E4" ] }, { "text": "開発者によると、本脆弱性を悪用した攻撃が既に確認されています。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "「EC-CUBE4系用プラグイン「AmazonPayプラグイン」」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN43511918/" ] } ], "actions": [ { "text": "パッチを適用する\n\n開発者が提供する情報をもとに、パッチを適用してください。", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ], "evidenceIds": [ "E5" ] }, { "text": "「JVN43511918」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN43511918/" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN43511918/" ] } ], "verification": [ { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN43511918/" ] } ], "unknowns": [ "これはJVNが公表した対象・影響・対策を整理した案内です。利用中の環境を検査した結果ではありません。対象外と判断するときは、製品・版だけでなく、設定や権限などの条件も照合してください。", "公表時点の対策を掲載しています。現在提供されている修正とサポート状況は、利用中の製品・系列に合わせて管理担当者に確認してください。対象範囲の上限だけから、修正版の番号を推測しないでください。" ], "supportRequest": "件名：JVN43511918 の対象確認と対応の依頼\n\n利用中の製品・型番：[記入してください]\nOS・現在の版・ビルド番号：[不明なら「不明」と記入]\n利用している機能・設定：[分かる範囲で記入]\n\nJVNは次の対象範囲を公表しています。\nCV2版\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.1.7からv1.1.12\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.0.0からv1.1.6\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.3.1（バンドル版）\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.3からv4.3.1\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.0からv4.2.2\n\nCV1版\n\nAmazonPayプラグイン v1.3.0およびそれ以前のバージョン（4.0系）\n\nこの環境が対象か、対象外ならその理由を教えてください。対象の場合は次の公表対策に基づき、実施する修正・手順・停止や再起動の必要性と実施予定を確認してください。\nパッチを適用する\n\n開発者が提供する情報をもとに、パッチを適用してください。\n\n対応後は適用した版・設定と、この問題への対処が完了したと判断した根拠を連絡してください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVN43511918", "sources": [ { "url": "https://jvn.jp/jp/JVN43511918/", "label": "JVNの原文" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourceField": "section:概要", "excerpt": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、不変と想定しているWebパラメータの外部制御の脆弱性が存在します。", "language": "ja" }, { "id": "E2", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourceField": "section:想定される影響", "excerpt": "注文手続き中に任意のウェブサイトにリダイレクトされる可能性があります。その結果、アカウント情報などを窃取される可能性があります。", "language": "ja" }, { "id": "E3", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourceField": "section:影響を受けるシステム", "excerpt": "CV2版\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.1.7からv1.1.12\n\nAmazonPay V2プラグイン（4.0/4.1系）v1.0.0からv1.1.6\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.3.1（バンドル版）\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.3からv4.3.1\n\nAmazonPay V2プラグイン（4.2/4.3系）v4.2.0からv4.2.2\n\nCV1版\n\nAmazonPayプラグイン v1.3.0およびそれ以前のバージョン（4.0系）", "language": "ja" }, { "id": "E4", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourceField": "section:詳細情報", "excerpt": "株式会社イーシーキューブが提供するEC-CUBE4系用プラグイン「AmazonPayプラグイン」には、次の脆弱性が存在します。\n\n不変と想定しているWebパラメータの外部制御（ CWE-472 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N 基本値 5.3\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N 基本値 4.7\n\nCVE-2026-103671\n\n開発者によると、本脆弱性を悪用した攻撃が既に確認されています。", "language": "ja" }, { "id": "E5", "sourceUrl": "https://jvn.jp/jp/JVN43511918/", "sourceField": "section:対策方法", "excerpt": "パッチを適用する\n\n開発者が提供する情報をもとに、パッチを適用してください。", "language": "ja" } ], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:16.155Z", "lastSuccess": "2026-10-23T03:21:16.155Z", "sourceCheckedAt": "2026-10-23T02:43:53.931Z", "errorCode": null }, "glossary": [] } }, { "id": "JVNVU90141693", "aliases": [], "title": "Siemens製品の39件の告知：型番と系列ごとの対象・更新先", "summary": "Siemensの産業機器・管理ソフトについて、39件の個別告知を製品と版ごとに整理しました。機器ラベルや管理画面の完全な型番・版を控え、下の該当する告知を照合します。同じ製品でも複数の告知があるため、一つの更新だけで全件解決とは判断しません。", "risk": "ネットワーク機器の停止、管理情報の露出、認証の回避、不正な処理の実行など、製品ごとに影響と必要な条件が違います。インストール時だけの問題、ログイン済み利用者が必要な問題、GNU/Linux部分だけの問題を分けて記載しています。", "product": "Siemens製品に対するアップデート（2026年10月）", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "SSA-019113の対応：\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)（V3.1.6以降）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)（V3.1.6以降、V3.1.7より前）：V3.1.7以降へ更新します。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)（V3.1.6以降）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-055299の対応：\nCapital Embedded AR Classic 431-422（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nCapital Embedded AR Classic R20-11（V2303より前）：V2303以降へ更新します。", "SSA-082556の対応：\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)（V3.1.5以降）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)（V3.1.5以降、V3.1.6より前）：V3.1.6以降へ更新します。\nSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)（V3.1.5以降）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-099819の対応：\nSENTRON 3NA COM Fuse（V5.2より前）：V5.2以降へ更新します。", "SSA-104023の対応：\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWを搭載した構成）：Siemensの顧客サポートへ、該当製品のパッチと更新・対応方法を依頼します。", "SSA-127084の対応：\nRUGGEDCOM APE1808（Fortinet NGFWを搭載した構成）：Fortigate NGFWをV7.6.7以降へ、Siemensの安全な更新手順に沿って更新します。手順の詳細は顧客サポートへ依頼します。", "SSA-148322の対応：\nPSS(R)SINCAL V21.5／PSS(R)SINCAL V22.0（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nPSS(R)SINCAL V22.5（V22.5 Update 5より前）：V22.5 Update 5以降へ更新します。", "SSA-159454の対応：\nSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G（V28.01.15より前）：V28.01.15以降へ更新します。\nSIMATIC IPC BX-21A（V31.01.13より前）：V31.01.13以降へ更新します。\nSIMATIC IPC RW-543A（V1.1.4より前）：V1.1.4以降へ更新します。\n修正版BIOSへ更新した後は、BIOSの既定設定を読み込みます。Secure Boot鍵を登録済みだった場合は、鍵を登録し直します。担当者が起動設定と鍵の復元手順を確認して実施してください。", "SSA-265688の対応：\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem（V1.1.1より前）：V1.1.1以降へ更新します。\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。", "SSA-267056の対応：\nLOGO! 12/24RCE (6ED1052-1MD08-0BA2)／LOGO! 12/24RCEo (6ED1052-2MD08-0BA2)／LOGO! 24CE (6ED1052-1CC08-0BA2)／LOGO! 24CEo (6ED1052-2CC08-0BA2)／LOGO! 24RCE (6ED1052-1HB08-0BA2)／LOGO! 24RCEo (6ED1052-2HB08-0BA2)／LOGO! 230RCE (6ED1052-1FB08-0BA2)／LOGO! 230RCEo (6ED1052-2FB08-0BA2)／SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2)／SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2)／SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2)／SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2)／SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2)／SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2)／SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2)／SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2)（V1.84.05より前）：V1.84.05以降へ更新します。", "SSA-282044の対応：\nAutomation License Manager V6.0／CEMAT V10.0／Energy Support Library (EnSL)／OpenPCS 7 V9.1／OpenPCS 7 V10.0／SIMATIC BATCH V9.1／SIMATIC BATCH V10.0／SIMATIC Logon V1.6／SIMATIC ODK 1500S／SIMATIC PCS 7 Advanced Process Functions V2.1／SIMATIC PCS 7 Advanced Process Functions V2.2／SIMATIC PCS 7 Advanced Process Graphics V9.1／SIMATIC PCS 7 Advanced Process Graphics V10.0／SIMATIC PCS 7 Advanced Process Library incl. Faceplates V10.0／SIMATIC PCS 7 Industry Library V9.0／SIMATIC PCS 7 Industry Library V9.1／SIMATIC PCS 7 Industry Library V10.0／SIMATIC PCS 7 Logic Matrix V10.0／SIMATIC PCS 7 PowerControl V9.1／SIMATIC PCS 7 Standard Chemical Library V9.1／SIMATIC PCS 7 Standard Chemical Library V10.0／SIMATIC PCS 7 TeleControl V9.1／SIMATIC PCS 7/OPEN OS V9.1／SIMATIC PCS neo V5.0／SIMATIC PDM V9.2／SIMATIC PDM Maintenance Station V5.0／SIMATIC Process Function Library (PFL) V4.0／SIMATIC Process Historian 2020／SIMATIC Process Historian 2022／SIMATIC ProSave V18／SIMATIC S7 F Systems V6.3／SIMATIC S7 F Systems V6.4／SIMATIC S7-1500 Software Controller V2／SIMATIC S7-PLCSIM V17／SIMATIC S7-PLCSIM V18／SIMATIC S7-PLCSIM V19／SIMATIC Safety Matrix V6.3／SIMATIC STEP 7 CFC V19／SIMATIC STEP 7 CFC V20／SIMATIC WinCC flexible ES／TIA Project-Server V17／SIMATIC Control Function Library (CFL) V1.x／TIA Portal Test Suite V17（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nAutomation License Manager V6.2（V6.2 Upd3より前）：V6.2 Upd3以降へ更新します。\nCP PtP Param configuring interface／FM Configuration Package／Modular PID CTRL Tool／SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)／SIMATIC eaSie Document Skills／SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)／SIMATIC eaSie Workflow Skills／SIMATIC NET PC Software V16／SIMATIC NET PC Software V17／SIMATIC NET PC Software V18／SIMATIC NET PC Software V19／SIMATIC PCS 7 MPC Configurator／SIMATIC ProSave V20／SIMATIC Route Control V9.1／SIMATIC Route Control V10.0／SIMATIC STEP 7 V5.7／SIMATIC WinCC Runtime Professional V20／SIMATIC WinCC TeleControl／SIMIT Rapid Tester／SIMIT Simulation Platform／SINEMA Remote Connect Client／SITRANS／Standard PID CTRL Tool／SIMATIC Energy Suite V17／SINAMICS Startdrive V17（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nCreate MyConfig (CMC)（V6.9より前）：V6.9以降へ更新します。\nMultiFieldbus Configuration Tool (MFCT)（V1.5.5.0より前）：V1.5.5.0以降へ更新します。\nSiemens Network Planner (SINETPLAN)（V2.0 SP2より前）：V2.0 SP2以降へ更新します。\nSIMATIC Automation Tool／SIMATIC Automation Tool SDK Windows（V5.0 SP4より前）：V5.0 SP4以降へ更新します。\nSIMATIC Logon V2.0（V2.0 Upd3より前）：V2.0 Upd3以降へ更新します。\nSIMATIC Management Agent／SIMATIC Management Console（V9.1 SP1 Upd8より前）：V9.1 SP1 Upd8以降へ更新します。\nSIMATIC NET PC Software V20（V20.0 Update 1より前）：V20.0 Update 1以降へ更新します。\nSIMATIC PCS 7 V9.1（V9.1 SP1 UC08より前）：V9.1 SP1 UC08以降へ更新します。\nSIMATIC PCS 7 V10.0（V10.0 SP1 UC01より前）：V10.0 SP1 UC01以降へ更新します。\nSIMATIC PCS 7 Advanced Process Faceplates V9.1（V9.1 SP2 Upd4より前）：V9.1 SP2 Upd4以降へ更新します。\nSIMATIC PCS 7 Advanced Process Library V9.1（V9.1 SP2 Upd6より前）：V9.1 SP2 Upd6以降へ更新します。\nSIMATIC PCS 7 Basis Faceplates V9.1（V9.1 SP2 Upd2より前）：V9.1 SP2 Upd2以降へ更新します。\nSIMATIC PCS 7 Basis Library V9.1（V9.1 SP2 Upd8より前）：V9.1 SP2 Upd8以降へ更新します。\nSIMATIC PCS 7 Basis Library V10.0（V10.0 SP1 Upd2より前）：V10.0 SP1 Upd2以降へ更新します。\nSIMATIC PCS 7 Logic Matrix V9.1（V9.1 Upd8より前）：V9.1 Upd8以降へ更新します。\nSIMATIC PCS neo V6.0（V6.0 SP1より前）：V6.0 SP1以降へ更新します。\nSIMATIC PDM V9.3（V9.3 SP1 Upd2より前）：V9.3 SP1 Upd2以降へ更新します。\nSIMATIC Process Historian 2024（V2024 SP1 Upd2より前）：V2024 SP1 Upd2以降へ更新します。\nSIMATIC ProSave V17／SIMATIC WinCC Runtime Advanced／Totally Integrated Automation Portal (TIA Portal) V17／SIMATIC WinCC Visualization Architect (SiVArc) V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMATIC ProSave V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMATIC S7-1500 Software Controller V3（V31.1.5より前）：V31.1.5以降へ更新します。\nSIMATIC S7-Fail-safe Configuration Tool (S7-FCT)（V4.0.1より前）：V4.0.1以降へ更新します。\nSIMATIC S7-PCT（V3.5 SP4 Update 1より前）：V3.5 SP4 Update 1以降へ更新します。\nSIMATIC S7-PLCSIM V20（V20 Update 1より前）：V20 Update 1以降へ更新します。\nSIMATIC S7-PLCSIM Advanced（V7.0 Update 1より前）：V7.0 Update 1以降へ更新します。\nSIMATIC Target（V6.0 SP3より前）：V6.0 SP3以降へ更新します。\nSIMATIC WinCC V7.5（V7.5 SP2 Update 20より前）：V7.5 SP2 Update 20以降へ更新します。\nSIMATIC WinCC V8.0（V8.0 Update 8より前）：V8.0 Update 8以降へ更新します。\nSIMATIC WinCC V8.1（V8.1 Update 3より前）：V8.1 Update 3以降へ更新します。\nSIMATIC WinCC Runtime Professional（V21より前）：V21以降へ更新します。\nSIMATIC WinCC Unified Line Coordination／SIMATIC WinCC Unified Sequence（V20より前）：V20以降へ更新します。\nSIMATIC D7-SYS（V10.0 SP1より前）：V10.0 SP1以降へ更新します。\nSINEC NMS（V4.0より前）：V4.0以降へ更新します。\nTeleControl Server Basic V3.1（V3.1.2.2より前）：V3.1.2.2以降へ更新します。\nTIA Administrator（V3.0.6より前）：V3.0.6以降へ更新します。\nTIA Portal Cloud Connector（V2.3より前）：V2.3以降へ更新します。\nTIA Project-Server（V2.2より前）：V2.2以降へ更新します。\nSIMATIC MTP CREATOR V2.x（V2.1より前）：V2.1以降へ更新します。", "SSA-333035の対応：\nAPOGEE MBC (PPC) (BACnet)（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nAPOGEE MBC (PPC) (P2 Ethernet)／APOGEE MEC (PPC) (BACnet)／APOGEE MEC (PPC) (P2 Ethernet)（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nAPOGEE PXC Compact (BACnet)／APOGEE PXC Modular (BACnet)／TALON TC Compact (BACnet)／TALON TC Modular (BACnet)（V3.5.7より前）：V3.5.7以降へ更新します。\nAPOGEE PXC Compact (P2 Ethernet)／APOGEE PXC Modular (P2 Ethernet)（V2.8.21より前）：V2.8.21以降へ更新します。\nDesigo PXC00-E.D／Desigo PXC00-U／Desigo PXC001-E.D／Desigo PXC12-E.D／Desigo PXC22-E.D／Desigo PXC22.1-E.D／Desigo PXC36.1-E.D／Desigo PXC50-E.D／Desigo PXC64-U／Desigo PXC100-E.D／Desigo PXC128-U／Desigo PXC200-E.D／Desigo PXM20-E（V2.3以降）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。", "SSA-377139の対応：\nIndustrial Edge Device Kit - arm64 V1.5／Industrial Edge Device Kit - arm64 V1.6／Industrial Edge Device Kit - arm64 V1.7／Industrial Edge Device Kit - arm64 V1.8／Industrial Edge Device Kit - arm64 V1.9／Industrial Edge Device Kit - arm64 V1.10／Industrial Edge Device Kit - arm64 V1.11／Industrial Edge Device Kit - arm64 V1.12／Industrial Edge Device Kit - arm64 V1.13／Industrial Edge Device Kit - arm64 V1.14／Industrial Edge Device Kit - arm64 V1.15／Industrial Edge Device Kit - arm64 V1.16／Industrial Edge Device Kit - arm64 V1.17／Industrial Edge Device Kit - arm64 V1.18／Industrial Edge Device Kit - arm64 V1.19／Industrial Edge Device Kit - arm64 V1.20／Industrial Edge Device Kit - arm64 V1.21／Industrial Edge Device Kit - arm64 V1.22／Industrial Edge Device Kit - arm64 V1.23／Industrial Edge Device Kit - arm64 V1.24／Industrial Edge Device Kit - arm64 V1.25／Industrial Edge Device Kit - x86-64 V1.5／Industrial Edge Device Kit - x86-64 V1.6／Industrial Edge Device Kit - x86-64 V1.7／Industrial Edge Device Kit - x86-64 V1.8／Industrial Edge Device Kit - x86-64 V1.9／Industrial Edge Device Kit - x86-64 V1.10／Industrial Edge Device Kit - x86-64 V1.11／Industrial Edge Device Kit - x86-64 V1.12／Industrial Edge Device Kit - x86-64 V1.13／Industrial Edge Device Kit - x86-64 V1.14／Industrial Edge Device Kit - x86-64 V1.15／Industrial Edge Device Kit - x86-64 V1.16／Industrial Edge Device Kit - x86-64 V1.17／Industrial Edge Device Kit - x86-64 V1.18／Industrial Edge Device Kit - x86-64 V1.19／Industrial Edge Device Kit - x86-64 V1.20／Industrial Edge Device Kit - x86-64 V1.21／Industrial Edge Device Kit - x86-64 V1.22／Industrial Edge Device Kit - x86-64 V1.23／Industrial Edge Device Kit - x86-64 V1.24／Industrial Edge Device Kit - x86-64 V1.25（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nIndustrial Edge Device Kit - arm64 V1.26／Industrial Edge Device Kit - x86-64 V1.26（V1.26.2-1より前）：V1.26.2-1以降へ更新します。\nIndustrial Edge Device Kit - arm64 V1.27／Industrial Edge Device Kit - x86-64 V1.27（V1.27.1-1より前）：V1.27.1-1以降へ更新します。\nIndustrial Edge Device Kit - arm64 V1.28／Industrial Edge Device Kit - x86-64 V1.28（V1.28.0-6より前）：V1.28.0-6以降へ更新します。", "SSA-390352の対応：\n.NET Client Library for SIMATIC S7 Webserver API（V3.3.61より前）：V3.3.61以降へ更新します。\n.NET Client Library for SIMATIC S7 Webserver API（V3.3.62より前）：V3.3.62以降へ更新します。", "SSA-392859の対応：\nSIMATIC S7-PLCSIM V17／SIMATIC S7-PLCSIM V18（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC STEP 7 Safety V17／SIMATIC STEP 7 V17／SIMATIC WinCC Unified V17／SIMATIC WinCC V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMATIC WinCC Unified PC Runtime V18／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)／TIA Portal Cloud V18／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC STEP 7 Safety V18／SIMATIC STEP 7 V18／SIMATIC WinCC Unified V18／SIMATIC WinCC V18（V18 Update 6より前）：V18 Update 6以降へ更新します。\nSIMATIC STEP 7 Safety V19／SIMATIC STEP 7 V19／SIMATIC WinCC Unified PC Runtime V19／SIMATIC WinCC Unified V19／SIMATIC WinCC V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMOTION SCOUT TIA V5.6（V5.6 SP1 HF7より前）：V5.6 SP1 HF7以降へ更新します。\nTIA Portal Cloud V19（V5.2.1.1より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-398330の対応：\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)（V3.1.0以降、V3.1.5より前）：V3.1.5以降へ更新します。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)（V3.1.0以降、V3.1.5より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-434797の対応：\nAI Lightweight Inference Server／SCALANCE LPE9413 (6GK5998-3GS01-2AC2)／SCALANCE LPE9433 (6GK5998-3GS11-2AC2)／SIMATIC Logon V2.0／SIMATIC PCS neo V6.0（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nConnector for Azure（V1.8.0より前）：V1.8.0以降へ更新します。\nDatabus／SIMOVE Fleetmanager V3.3（V3.3.2より前）：V3.3.2以降へ更新します。\nHiMed Cockpit／SCALANCE LPE9403 (6GK5998-3GS00-2AC2)／RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)／RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)／SCALANCE M804PB (6GK5804-0AP00-2AA2)／SCALANCE M812-1 ADSL-Router family／SCALANCE M816-1 ADSL-Router family／SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)／SCALANCE M874-2 (6GK5874-2AA00-2AA2)／SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2)／SCALANCE M874-3 (6GK5874-3AA00-2AA2)／SCALANCE M876-3 (6GK5876-3AA02-2BA2)／SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)／SCALANCE M876-4 (6GK5876-4AA10-2BA2)／SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)／SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)／SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1)／SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1)／SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1)／SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1)／SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)／SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1)／SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1)／SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1)／SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)／SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)／SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2)／SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)／SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)／SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)／SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0)／SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0)／SCALANCE WAM766-1 (6GK5766-1GE00-7DA0)／SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0)／SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)／SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0)／SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0)／SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)／SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0)／SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0)／SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)／SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)／SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0)／SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0)／SCALANCE WUM766-1 (6GK5766-1GE00-3DA0)／SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0)／SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)／SCALANCE XC316-8 (6GK5324-8TS00-2AC2)／SCALANCE XC324-4 (6GK5328-4TS00-2AC2)／SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2)／SCALANCE XC332 (6GK5332-0GA00-2AC2)／SCALANCE XC416-8 (6GK5424-8TR00-2AC2)／SCALANCE XC424-4 (6GK5428-4TR00-2AC2)／SCALANCE XC432 (6GK5432-0GR00-2AC2)／SCALANCE XR302-32 (6GK5334-5TS00-2AR3)／SCALANCE XR302-32 (6GK5334-5TS00-3AR3)／SCALANCE XR302-32 (6GK5334-5TS00-4AR3)／SCALANCE XR322-12 (6GK5334-3TS00-2AR3)／SCALANCE XR322-12 (6GK5334-3TS00-3AR3)／SCALANCE XR322-12 (6GK5334-3TS00-4AR3)／SCALANCE XR326-8 (6GK5334-2TS00-2AR3)／SCALANCE XR326-8 (6GK5334-2TS00-3AR3)／SCALANCE XR326-8 (6GK5334-2TS00-4AR3)／SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3)／SCALANCE XR502-32 (6GK5534-5TR00-2AR3)／SCALANCE XR502-32 (6GK5534-5TR00-3AR3)／SCALANCE XR502-32 (6GK5534-5TR00-4AR3)／SCALANCE XR522-12 (6GK5534-3TR00-2AR3)／SCALANCE XR522-12 (6GK5534-3TR00-3AR3)／SCALANCE XR522-12 (6GK5534-3TR00-4AR3)／SCALANCE XR526-8 (6GK5534-2TR00-2AR3)／SCALANCE XR526-8 (6GK5534-2TR00-3AR3)／SCALANCE XR526-8 (6GK5534-2TR00-4AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-2AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-2RR3)／SCALANCE XR524-8WG (6GK5532-2SR00-3AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-3RR3)／Shopfloor IT Suite／Siemens OPC UA Modelling Editor (SiOME)／SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)／SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)／SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)／SIMATIC IPC BX-21A／SIMATIC IPC MD-57A／SIMATIC IPC ORCLA／SIMATIC MV530 H (6GF3530-0GE10)／SIMATIC MV530 S (6GF3530-0CD10)／SIMATIC MV540 H (6GF3540-0GE10)／SIMATIC MV540 H CRANES (6GF3540-0GE30)／SIMATIC MV540 S (6GF3540-0CD10)／SIMATIC MV550 H (6GF3550-0GE10)／SIMATIC MV550 S (6GF3550-0CD10)／SIMATIC MV560 U (6GF3560-0LE10)／SIMATIC MV560 X (6GF3560-0HE10)／SIMATIC RTLS Locating Manager (6GT2780-0DA00)／SIMATIC RTLS Locating Manager (6GT2780-0DA10)／SIMATIC RTLS Locating Manager (6GT2780-0DA20)／SIMATIC RTLS Locating Manager (6GT2780-0DA30)／SIMATIC RTLS Locating Manager (6GT2780-1EA10)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMOVE Fleetmanager V3.1（V3.1.13より前）：V3.1.13以降へ更新します。\nSIMOVE Fleetmanager V3.2（V3.2.4より前）：V3.2.4以降へ更新します。\nSIPLANT（掲載されたこの製品系列のすべての版）：Siemensの顧客サポートへ、該当製品のパッチと更新・対応方法を依頼します。\nSIDIS Prime（V4.0.700以降）：Siemensの顧客サポートへ、該当製品のパッチと更新・対応方法を依頼します。\nSIMATIC Logon V1.6（V1.6 Upd12より前）：V1.6 Upd12以降へ更新します。\nSIMATIC PDM V9.3（V9.3 SP2より前）：V9.3 SP2以降へ更新します。", "SSA-457936の対応：\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)（V3.1.7以降）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)（V3.1.7以降）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-493396の対応：\nSIMATIC S7-PLCSIM V17（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC STEP 7 V17／SIMATIC WinCC V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)／TIA Portal Cloud V18／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)／SIMOCODE ES V20／SIMOTION SCOUT TIA V5.7／SINAMICS Startdrive V20／SIRIUS Safety ES V20 (TIA Portal)／SIRIUS Soft Starter ES V20 (TIA Portal)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC STEP 7 V18／SIMATIC WinCC V18（V18 Update 6より前）：V18 Update 6以降へ更新します。\nSIMATIC STEP 7 V19／SIMATIC WinCC V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMOTION SCOUT TIA V5.6（V5.6 SP1 HF7より前）：V5.6 SP1 HF7以降へ更新します。\nTIA Portal Cloud V19（V5.2.1.1より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。\nSIMATIC STEP 7 V20／SIMATIC WinCC V20（V20 Update 4より前）：V20 Update 4以降へ更新します。\nTIA Portal Cloud V20（V5.2.2.2より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-508506の対応：\nRUGGEDCOM CROSSBOW（V6.0より前）：V6.0以降へ更新します。", "SSA-545643の対応：\nblueplanet 3.0 TL3-60.0 TL3（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nblueplanet 87.0 TL3／blueplanet 92.0 TL3／blueplanet 105 TL3／blueplanet 110 TL3／blueplanet 125 TL3／blueplanet 137 TL3／blueplanet 150 TL3／blueplanet 155 TL3／blueplanet 165 TL3（V3.92より前）：V3.92以降へ更新します。\nblueplanet 87.0 TL3 GEN2／blueplanet 92.0 TL3 GEN2／blueplanet 100 TL3 GEN2／blueplanet 105 TL3 GEN2／blueplanet 125 TL3 GEN2／blueplanet 150 TL3 GEN2／blueplanet 155 TL3 GEN2／blueplanet 165 TL3 GEN2（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nblueplanet 87.0 TL3 GEN2／blueplanet 92.0 TL3 GEN2／blueplanet 100 TL3 GEN2／blueplanet 105 TL3 GEN2／blueplanet 125 TL3 GEN2／blueplanet 150 TL3 GEN2／blueplanet 155 TL3 GEN2／blueplanet 165 TL3 GEN2（V6.1.4.9より前）：V6.1.4.9以降へ更新します。\nblueplanet 100 NX3 M8／blueplanet 125 NX3 M10（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nblueplanet gridsave 92.0 TL3-S／blueplanet gridsave 110 TL3-S／blueplanet gridsave 137 TL3-S（V3.92より前）：V3.92以降へ更新します。\nblueplanet gridsave 92.0 TL3-S／blueplanet gridsave 110 TL3-S／blueplanet gridsave 137 TL3-S（V3.91より前）：V3.91以降へ更新します。\nblueplanet 3.0 NX3-20.0 NX3／blueplanet 3.0-5.0 NX1／blueplanet 25.0 NX3-33.0 NX3／blueplanet 50.0 NX3-60.0 NX3／blueplanet 360 NX3 M6／blueplanet hybrid 6.0 NH3-12.0 NH3／blueplanet hybrid 10.0 TL3（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-550198の対応：\nSIMATIC WinCC V7.5（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC WinCC V8.0（V8.0 Update 11より前）：V8.0 Update 11以降へ更新します。\nSIMATIC WinCC V8.1（V8.1 Update 7より前）：V8.1 Update 7以降へ更新します。", "SSA-563922の対応：\nSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)（V1.3.1より前）：V1.3.1以降へ更新します。\nSIMOTION OA MIIF (6AU1820-3DA20-0AB0)／SIMOTION OACAMGEN (6AU1820-3EA20-0AB0)／SIMOTION OALECO (6AU1820-3HA20-0AB0)／SIMOTION OAVIBX (6AU1820-3CA20-0AB0)（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。", "SSA-580366の対応：\nSiemens Software Center（V4.0.9.8より前）：V4.0.9.8以降へ更新します。次回起動時に自動更新されるとされています。", "SSA-591731の対応：\nSIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0)／SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0)／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs／SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)／SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0)／SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0)／SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0)／SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0)／SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0)／SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0)／SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0)／SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0)／SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0)／SIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0)／SIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0)／SIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0)／SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0)／SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0)／SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0)／SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0)／SIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0)／SIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0)／SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0)／SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0)／SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0)／SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0)／SIMATIC S7-1500 CPU 1516pro F-2 PN (6ES7516-2GP03-0AB0)／SIMATIC S7-1500 CPU 1516pro-2 PN (6ES7516-2PP03-0AB0)／SIMATIC S7-1500 CPU 1516T-3 PN (6ES7516-3TP10-0AB0)／SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0)／SIMATIC S7-1500 CPU 1516TF-3 PN (6ES7516-3UP10-0AB0)／SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0)／SIMATIC S7-1500 CPU 1517-3 PN (6ES7517-3AQ10-0AB0)／SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN (6ES7517-3FQ10-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP01-0AB0)／SIMATIC S7-1500 CPU 1517T-3 PN (6ES7517-3TQ10-0AB0)／SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0)／SIMATIC S7-1500 CPU 1517TF-3 PN (6ES7517-3UQ10-0AB0)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0)（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-628843の対応：\nSIMATIC CN 4100（ハードウェアがFS 05より前の製品）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC Field PG M5／SIMATIC IPC227E／SIMATIC IPC277E／SIMATIC ITP1000（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC Field PG M6（V26.01.14より前）：V26.01.14以降へ更新します。\nSIMATIC IPC427E／SIMATIC IPC477E／SIMATIC IPC477E PRO／SIPLUS IPC427E（V21.01.20より前）：V21.01.20以降へ更新します。\nSIMATIC IPC627E／SIMATIC IPC647E／SIMATIC IPC677E／SIMATIC IPC847E（V25.02.16より前）：V25.02.16以降へ更新します。\nSIMATIC IPC BX-32A／SIMATIC IPC BX-39A／SIMATIC IPC PX-39A／SIMATIC IPC PX-39A PRO／SIMATIC IPC PX-32A（V29.01.09より前）：V29.01.09以降へ更新します。\nSIMATIC IPC BX-56A／SIMATIC IPC BX-59A（V32.01.09より前）：V32.01.09以降へ更新します。\nSIMATIC IPC RW-528A／SIMATIC IPC RW-548A（V34.01.02より前）：V34.01.02以降へ更新します。\nSIMATIC IPC MD-57A（V30.01.10より前）：V30.01.10以降へ更新します。", "SSA-693808の対応：\nSIMATIC PCS neo V4.1／SIMATIC PCS neo V5.0／SIMATIC S7-PLCSIM V17（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC PCS neo V6.0（V6.0 SP1 Update 1より前）：V6.0 SP1 Update 1以降へ更新します。\nSIMATIC STEP 7 V17／SIMATIC WinCC V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMOCODE ES V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)／SIMOCODE ES V20／SIMOTION SCOUT TIA V5.7／SINAMICS Startdrive V20／SIRIUS Safety ES V20 (TIA Portal)／SIRIUS Soft Starter ES V20 (TIA Portal)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。\nSIMATIC STEP 7 V18／SIMATIC WinCC V18（V18 Update 6より前）：V18 Update 6以降へ更新します。\nTIA Portal Cloud V18（V6.3.0.2より前）：V6.3.0.2以降へ更新します。\nSIMATIC STEP 7 V19／SIMATIC WinCC V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMOTION SCOUT TIA V5.6（V5.6 SP1 HF7より前）：V5.6 SP1 HF7以降へ更新します。\nTIA Portal Cloud V19（V5.2.1.1より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。\nSIMATIC STEP 7 V20／SIMATIC WinCC V20／TIA Portal Test Suite V20（V20 Update 4より前）：V20 Update 4以降へ更新します。\nTIA Portal Cloud V20（V5.2.2.2より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-765416の対応：\nRUGGEDCOM CROSSBOW Station Access Controller (SAC)（V6.0より前）：V6.0以降へ更新します。", "SSA-784472の対応：\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。", "SSA-794185の対応：\nCPC80 Central Processing/Communication（V16.51より前）：V16.51以降へ更新します。\nCPCI85 Central Processing/Communication（V6.20より前）：V6.20以降へ更新します。\nPOWER METER SICAM Q100 family（V2.70より前）：V2.70以降へ更新します。\nPOWER METER SICAM Q200 family（V2.83より前）：V2.83以降へ更新します。\nPowerlink IP（V4.23より前）：V4.23以降へ更新します。\nSICAM GridPass（V2.50より前）：V2.50以降へ更新します。\nSICORE Base system（V2.20.0より前）：V2.20.0以降へ更新します。\nSIPROTEC 5 7SA82 (CP100)／SIPROTEC 5 7SD82 (CP100)／SIPROTEC 5 7SJ81 (CP100)／SIPROTEC 5 7SJ82 (CP100)／SIPROTEC 5 7SK82 (CP100)／SIPROTEC 5 7SL82 (CP100)／SIPROTEC 5 7UT82 (CP100)（V7.80以降、V8.90より前）：V8.90以降のV8.xx系列へ更新します。\nSIPROTEC 5 7SA82 (CP150)／SIPROTEC 5 7SD82 (CP150)／SIPROTEC 5 7SJ81 (CP150)／SIPROTEC 5 7SJ82 (CP150)／SIPROTEC 5 7SK82 (CP150)／SIPROTEC 5 7SL82 (CP150)／SIPROTEC 5 7SX82 (CP150)／SIPROTEC 5 7SY82 (CP150)／SIPROTEC 5 7UT82 (CP150)／SIPROTEC 5 6MD84 (CP300)／SIPROTEC 5 6MU85 (CP300)／SIPROTEC 5 7ST86 (CP300)／SIPROTEC 5 7SX85 (CP300)／SIPROTEC 5 7VU85 (CP300)／SIPROTEC 5 Compact 7SX800 (CP050)（V10.0より前）：V10.0以降へ更新します。\nSIPROTEC 5 6MD85 (CP300)／SIPROTEC 5 6MD86 (CP300)／SIPROTEC 5 6MD89 (CP300)／SIPROTEC 5 7KE85 (CP300)／SIPROTEC 5 7SA86 (CP300)／SIPROTEC 5 7SA87 (CP300)／SIPROTEC 5 7SD86 (CP300)／SIPROTEC 5 7SD87 (CP300)／SIPROTEC 5 7SJ85 (CP300)／SIPROTEC 5 7SJ86 (CP300)／SIPROTEC 5 7SK85 (CP300)／SIPROTEC 5 7SL86 (CP300)／SIPROTEC 5 7SL87 (CP300)／SIPROTEC 5 7SS85 (CP300)／SIPROTEC 5 7ST85 (CP300)／SIPROTEC 5 7UM85 (CP300)／SIPROTEC 5 7UT85 (CP300)／SIPROTEC 5 7UT86 (CP300)／SIPROTEC 5 7UT87 (CP300)／SIPROTEC 5 7VE85 (CP300)／SIPROTEC 5 7VK87 (CP300)（V7.80以降、V10.0より前）：V10.0以降へ更新します。\nSIPROTEC 5 6MD89 (CP300) V9.6x／SIPROTEC 5 7ST85 (CP300) V9.6x（V9.68より前）：V9.68以降へ更新します。\nSIPROTEC 5 7ST86 (CP300) V9.8x（V9.83より前）：V9.83以降へ更新します。\nSICAM AK 3／SICAM BC／SICAM GridEdge (Classic)／SICAM GridEdge Applications for SICAM 8 Platform／SICAM TM／SIPROTEC 5 - CP200 Devices（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-794697の対応：\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem（V1.1より前）：V1.1以降へ更新します。", "SSA-800126の対応：\nSIMATIC S7-PLCSIM V16／SIMATIC S7-PLCSIM V17／SIMATIC STEP 7 Safety V16／SIMATIC STEP 7 V16／SIMATIC WinCC Unified V16／SIMATIC WinCC V16／SIMOCODE ES V16／SINAMICS Startdrive V16／TIA Portal Cloud V16（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC STEP 7 Safety V17／SIMATIC STEP 7 V17／SIMATIC WinCC Unified V17／SIMATIC WinCC V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Soft Starter ES V18 (TIA Portal)／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC STEP 7 Safety V18／SIMATIC STEP 7 V18／SIMATIC WinCC Unified V18／SIMATIC WinCC V18／SIRIUS Safety ES V18 (TIA Portal)（V18 Update 6より前）：V18 Update 6以降へ更新します。\nTIA Portal Cloud V18（V6.3.0.2より前）：V6.3.0.2以降へ更新します。\nSIMATIC STEP 7 Safety V19／SIMATIC STEP 7 V19／SIMATIC WinCC Unified V19／SIMATIC WinCC V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMOTION SCOUT TIA V5.6（V5.6 SP1 HF7より前）：V5.6 SP1 HF7以降へ更新します。\nTIA Portal Cloud V19（V5.2.1.1より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-832641の対応：\nIndustrial Edge Cloud Device (IECD)／Industrial Edge Own Device (IEOD)／Industrial Edge Virtual Device (IEVD)（V1.28.1より前）：V1.28.1以降へ更新します。\nSCALANCE LPE9413 (6GK5998-3GS01-2AC2)／SCALANCE LPE9433 (6GK5998-3GS11-2AC2)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0)／SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0)／SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0)／SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0)／SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0)／SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0)／SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0)／SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0)／SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0)／SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0)／SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0)／SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0)／SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0)／SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0)／SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0)／SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0)／SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0)／SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0)／SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0)／SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0)／SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0)／SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0)／SIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0)／SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0)／SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1)／SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1)／SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1)／SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1)／SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1)／SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1)／SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1)／SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1)／SIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1)／SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1)／SIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1)／SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1)／SIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1)／SIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1)／SIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2)／SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2)／SIMATIC IPC BX-21A Industrial Edge Device（V1.28.1-2より前）：V1.28.1-2以降へ更新します。\nSIMATIC IPC127E Industrial Edge Device／SIMATIC IPC227E Industrial Edge Device／SIMATIC IPC227G Industrial Edge Device／SIMATIC IPC427E Industrial Edge Device／SIMATIC IPC847E Industrial Edge Device／SIMATIC IPC BX-39A Industrial Edge Device／SIMATIC IPC BX-59A Industrial Edge Device（V3.2.0-17より前）：V3.2.0-17以降へ更新します。", "SSA-858251の対応：\nIndustrial Edge for Machine Tools (formerly known as \"SINUMERIK Edge\")／SIMATIC IPC DiagMonitor（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC Energy Manager PRO V7.2／SIMATIC Energy Manager PRO V7.3（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC Energy Manager PRO V7.4（V7.4 Update 0以降、V7.4 Update 7より前）：V7.4 Update 7以降へ更新します。\nSIMATIC Energy Manager PRO V7.5（V7.5 Update 0以降、V7.5 Update 2より前）：V7.5 Update 2以降へ更新します。\nSIMATIC WinCC V8.0（V8.0 Update 3より前）：V8.0 Update 3以降へ更新します。\nSIMIT V11（V11.3より前）：V11.3以降へ更新します。\nSIMATIC WinCC Unified V18（V18 Update 6より前）：V18 Update 6以降へ更新します。\nSIMATIC WinCC Unified V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMATIC BRAUMAT／SIMATIC SISTAR（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "SSA-864900の対応：\nRUGGEDCOM APE1808（Fortinet NGFWがV7.4.9より前の構成）：Fortigate NGFWをV7.4.9以降へ、Siemensの安全な更新手順に沿って更新します。手順の詳細は顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Fortinet NGFWがV7.6.6より前の構成）：Fortigate NGFWをV7.6.6以降へ、Siemensの安全な更新手順に沿って更新します。手順の詳細は顧客サポートへ依頼します。", "SSA-911336の対応：\nRUGGEDCOM APE1808（公式に示された構成条件：with Nozomi Guardian/CMC）：Siemensの顧客サポートへ、該当製品のパッチと更新・対応方法を依頼します。", "SSA-967325の対応：\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでUser-ID認証ポータルを設定し、管理プロファイルのResponse Pagesを有効にした構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWを搭載した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWのGlobalProtect portal/gatewayで認証上書きCookieを有効にし、特定の証明書設定を使う構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h7へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでIKEv2の拠点間VPNを設定した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでDNS Proxyを有効にし、network proxyを接続した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでCASを有効にした認証プロファイルをログイン画面に適用した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWを搭載した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h7へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでURL filteringを有効にし、応答ページを変更した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h7以降へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。", "SSA-968435の対応：\nIndustrial Edge App Publisher（V1.27.9より前）：V1.27.9以降へ更新します。", "SSB-091449のアクセス制限：S7-1500/ET200MPはマニュアル4.9・11.6、S7-1200 G2は2.9・6.5、SINUMERIK ONEは11.7.2・11.10の設定を担当者と確認します。PG/HMI接続の保護レベルと、OPC UA/Web APIの変数ごとの許可を別々に点検してください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU90141693/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-14T04:30:50.000Z", "modifiedAt": "2026-10-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "Siemensから各製品向けのアドバイザリが公表されました。", "sourceTitle": "Siemens製品に対するアップデート（2026年10月）", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVNVU90141693", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "fetchedAt": "2026-10-23T02:43:53.971Z", "publishedAt": "2026-10-13T15:00:00.000Z", "modifiedAt": "2026-10-15T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVNVU#90141693\n\nSiemens製品に対するアップデート（2026年10月）", "descriptions": [ { "lang": "ja", "value": "Siemensから各製品向けのアドバイザリが公表されました。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "新規：18件\n\nSSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic\n\nSSB-091449: SIMATIC S7 PLCs and Related Products: Per-Variable HMI/OPC UA/Web API Access Attributes Not Enforced on PG/HMI Communication\n\nSSA-099819: Denial of Service Vulnerability in SENTRON 3NA COM Fuse\n\nSSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL\n\nSSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs\n\nSSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products\n\nSSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit\n\nSSA-390352: Multiple Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API\n\nSSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7\n\nSSA-508506: Multiple Vulnerabilities in RUGGEDCOM CROSSBOW\n\nSSA-550198: Authenticated Remote Code Execution in WinCC\n\nSSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server\n\nSSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nSSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices\n\nSSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices\n\nSSA-968435: Multiple Vulnerabilities in Industrial Edge App Publisher\n\nSSA-580366: DLL Sideloading Vulnerability in Siemens Software Center\n\n更新：21件\n\nSSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6\n\nSSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5\n\nSSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices\n\nSSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices\n\nSSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1\n\nSSA-267056: Multiple Vulnerabilities in LOGO! 8 BM Devices\n\nSSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery\n\nSSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20\n\nSSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5\n\nSSA-434797: Buffer Overflow Vulnerability in OpenSSL affecting Siemens Products\n\nSSA-493396: Deserialization Vulnerability in Siemens Engineering Platforms\n\nSSA-545643: Multiple Vulnerabilities in KACO Blueplanet Inverters\n\nSSA-563922: Local Privilege Escalation Vulnerability in SIMOTION Tools\n\nSSA-628843: Out of Bound Read Vulnerability in TPM 2.0\n\nSSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms\n\nSSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products\n\nSSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1\n\nSSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20\n\nSSA-858251: Authentication Bypass Vulnerabilities in OPC UA\n\nSSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices\n\nSSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS before V11.2.10-h7 on RUGGEDCOM APE1808 Devices", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "Siemensのアドバイザリを参照してください。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "Siemensのアドバイザリを参照してください。", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "Siemensのアドバイザリを参照してください。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "Siemensから各製品向けのアドバイザリが公表されました。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "Siemensのアドバイザリを参照してください。", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "新規：18件\n\nSSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic\n\nSSB-091449: SIMATIC S7 PLCs and Related Products: Per-Variable HMI/OPC UA/Web API Access Attributes Not Enforced on PG/HMI Communication\n\nSSA-099819: Denial of Service Vulnerability in SENTRON 3NA COM Fuse\n\nSSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL\n\nSSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs\n\nSSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products\n\nSSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit\n\nSSA-390352: Multiple Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API\n\nSSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7\n\nSSA-508506: Multiple Vulnerabilities in RUGGEDCOM CROSSBOW\n\nSSA-550198: Authenticated Remote Code Execution in WinCC\n\nSSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server\n\nSSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nSSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices\n\nSSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices\n\nSSA-968435: Multiple Vulnerabilities in Industrial Edge App Publisher\n\nSSA-580366: DLL Sideloading Vulnerability in Siemens Software Center\n\n更新：21件\n\nSSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6\n\nSSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5\n\nSSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices\n\nSSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices\n\nSSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1\n\nSSA-267056: Multiple Vulnerabilities in LOGO! 8 BM Devices\n\nSSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery\n\nSSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20\n\nSSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5\n\nSSA-434797: Buffer Overflow Vulnerability in OpenSSL affecting Siemens Products\n\nSSA-493396: Deserialization Vulnerability in Siemens Engineering Platforms\n\nSSA-545643: Multiple Vulnerabilities in KACO Blueplanet Inverters\n\nSSA-563922: Local Privilege Escalation Vulnerability in SIMOTION Tools\n\nSSA-628843: Out of Bound Read Vulnerability in TPM 2.0\n\nSSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms\n\nSSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products\n\nSSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1\n\nSSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20\n\nSSA-858251: Authentication Bypass Vulnerabilities in OPC UA\n\nSSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices\n\nSSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS before V11.2.10-h7 on RUGGEDCOM APE1808 Devices", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "Siemensのアドバイザリを参照してください。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "Siemensのアドバイザリを参照してください。", "sourcePath": "section:対策方法" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourcePath": "section:概要", "text": "Siemensから各製品向けのアドバイザリが公表されました。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourcePath": "section:影響を受けるシステム", "text": "Siemensのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourcePath": "section:詳細情報", "text": "新規：18件\n\nSSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic\n\nSSB-091449: SIMATIC S7 PLCs and Related Products: Per-Variable HMI/OPC UA/Web API Access Attributes Not Enforced on PG/HMI Communication\n\nSSA-099819: Denial of Service Vulnerability in SENTRON 3NA COM Fuse\n\nSSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL\n\nSSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs\n\nSSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products\n\nSSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit\n\nSSA-390352: Multiple Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API\n\nSSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7\n\nSSA-508506: Multiple Vulnerabilities in RUGGEDCOM CROSSBOW\n\nSSA-550198: Authenticated Remote Code Execution in WinCC\n\nSSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server\n\nSSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nSSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices\n\nSSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices\n\nSSA-968435: Multiple Vulnerabilities in Industrial Edge App Publisher\n\nSSA-580366: DLL Sideloading Vulnerability in Siemens Software Center\n\n更新：21件\n\nSSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6\n\nSSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5\n\nSSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices\n\nSSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices\n\nSSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1\n\nSSA-267056: Multiple Vulnerabilities in LOGO! 8 BM Devices\n\nSSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery\n\nSSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20\n\nSSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5\n\nSSA-434797: Buffer Overflow Vulnerability in OpenSSL affecting Siemens Products\n\nSSA-493396: Deserialization Vulnerability in Siemens Engineering Platforms\n\nSSA-545643: Multiple Vulnerabilities in KACO Blueplanet Inverters\n\nSSA-563922: Local Privilege Escalation Vulnerability in SIMOTION Tools\n\nSSA-628843: Out of Bound Read Vulnerability in TPM 2.0\n\nSSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms\n\nSSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products\n\nSSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1\n\nSSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20\n\nSSA-858251: Authentication Bypass Vulnerabilities in OPC UA\n\nSSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices\n\nSSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS before V11.2.10-h7 on RUGGEDCOM APE1808 Devices", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourcePath": "section:想定される影響", "text": "Siemensのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourcePath": "section:対策方法", "text": "Siemensのアドバイザリを参照してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "related:CVE-2024-3596:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3596.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"IETF\",\"product\":\"RFC\",\"versions\":[{\"status\":\"affected\",\"version\":\"2865\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2024-3596" }, { "evidenceId": "related:CVE-2024-3596:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3596.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2024-3596" }, { "evidenceId": "related:CVE-2024-3596:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3596.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-328: Use of Weak Hash\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2024-3596" }, { "evidenceId": "related:CVE-2024-3596:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3596.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2024-3596" }, { "evidenceId": "related:CVE-2024-3596:/containers/cna/problemTypes/2/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3596.json", "sourcePath": "/containers/cna/problemTypes/2/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2024-3596" }, { "evidenceId": "related:CVE-2024-3596:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3596.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":9,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2024-3596" }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "sourcePath": "body:advisory", "text": "SSA-019113\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6\n\nPublication Date:\n\n2026-07-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nSIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1.6 only; for version V3.1.7 refer to SSA-457936 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-3497\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-46174\n\nCVE-2026-46333\n\nCVE-2023-53292\n\nCVE-2025-21863\n\nCVE-2025-40196\n\nCVE-2026-23255\n\nCVE-2026-23399\n\nCVE-2026-31449\n\nCVE-2026-31681\n\nCVE-2026-31700\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.6 < V3.1.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-31431\n\nCVE-2026-43284\n\nCVE-2026-46300\n\nUpdate to V3.1.7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-3497\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-46174\n\nCVE-2026-46333\n\nCVE-2023-53292\n\nCVE-2025-21863\n\nCVE-2025-40196\n\nCVE-2026-23255\n\nCVE-2026-23399\n\nCVE-2026-31449\n\nCVE-2026-31681\n\nCVE-2026-31700\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.6 < V3.1.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-31431\n\nCVE-2026-43284\n\nCVE-2026-46300\n\nUpdate to V3.1.7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-3497\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-46174\n\nCVE-2026-46333\n\nCVE-2023-53292\n\nCVE-2025-21863\n\nCVE-2025-40196\n\nCVE-2026-23255\n\nCVE-2026-23399\n\nCVE-2026-31449\n\nCVE-2026-31681\n\nCVE-2026-31700\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.6 < V3.1.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-31431\n\nCVE-2026-43284\n\nCVE-2026-46300\n\nUpdate to V3.1.7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-20", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-3497", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-46174", "CVE-2026-46333", "CVE-2023-53292", "CVE-2025-21863", "CVE-2025-40196", "CVE-2026-23255", "CVE-2026-23399", "CVE-2026-31449", "CVE-2026-31681", "CVE-2026-31700", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2026-31431", "CVE-2026-43284", "CVE-2026-46300", "CVE-2025-38617" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "sourcePath": "body:advisory", "text": "SSA-055299\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n5.3\n\nCVSS v4.0 Base Score:\n6.9\n\nSUMMARY\n\nThe products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service.\n\nSiemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nCapital Embedded AR Classic 431-422\n\nAll versions\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nCapital Embedded AR Classic R20-11\n\nAll versions < V2303\n\naffected by\n\nCVE-2026-89208\n\nUpdate to V2303 or later version\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nApply network segmentation and put the ECUs behind properly configured gateways/firewalls\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nCapital Embedded AR Classic (formerly called Capital VSTAR), is a scalable AUTOSAR Classic software platform that meets ISO 26262 use cases for up to ASIL D. Versions are available for several recent AUTOSAR Classic releases, including 4.3.1 and 20-11. Although not based on Nucleus RTOS, Embedded AR Classic includes its networking module, Nucleus NET.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-89208\n\nThe affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n\nCVSS v4.0 Base Score\n6.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-125: Out-of-bounds Read\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nStanislav Dashevskyi and Francesco La Spina from Forescout Technologies Inc. for coordinated disclosure\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-055299\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-89208" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "sourcePath": "body:advisory", "text": "SSA-082556\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5\n\nPublication Date:\n\n2025-06-10\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.7\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nSIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.5\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2025-21848\n\nCVE-2025-21712\n\nCVE-2025-21865\n\nCVE-2025-21862\n\nCVE-2025-21864\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-50246\n\nCVE-2024-57977\n\nCVE-2024-24855\n\nCVE-2024-26596\n\nCVE-2025-21701\n\nCVE-2025-21767\n\nCVE-2025-21728\n\nCVE-2025-21766\n\nCVE-2025-21795\n\nCVE-2025-21724\n\nCVE-2025-21765\n\nCVE-2024-57996\n\nCVE-2025-21796\n\nCVE-2025-21758\n\nCVE-2025-21745\n\nCVE-2023-4527\n\nCVE-2023-4806\n\nCVE-2023-4911\n\nCVE-2023-38545\n\nCVE-2023-38546\n\nCVE-2023-5363\n\nCVE-2023-44487\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-48795\n\nCVE-2023-51384\n\nCVE-2023-51385\n\nCVE-2023-46218\n\nCVE-2023-46219\n\nCVE-2023-6246\n\nCVE-2023-6779\n\nCVE-2023-6780\n\nCVE-2024-28085\n\nCVE-2024-2961\n\nCVE-2024-33599\n\nCVE-2024-33600\n\nCVE-2024-33601\n\nCVE-2024-33602\n\nCVE-2024-34397\n\nCVE-2024-6387\n\nCVE-2024-37370\n\nCVE-2024-37371\n\nCVE-2024-6119\n\nCVE-2024-45490\n\nCVE-2024-45491\n\nCVE-2024-45492\n\nCVE-2024-12133\n\nCVE-2024-12243\n\nCVE-2025-26465\n\nCVE-2025-31115\n\nCVE-2025-46836\n\nCVE-2025-4598\n\nCVE-2025-4373\n\nCVE-2025-6395\n\nCVE-2025-32988\n\nCVE-2025-32989\n\nCVE-2025-3198\n\nCVE-2025-5244\n\nCVE-2025-5245\n\nCVE-2025-7425\n\nCVE-2025-7545\n\nCVE-2025-7546\n\nCVE-2025-8224\n\nCVE-2025-9230\n\nCVE-2025-9232\n\nCVE-2025-11082\n\nCVE-2025-11083\n\nCVE-2025-11412\n\nCVE-2025-11413\n\nCVE-2025-11414\n\nCVE-2025-11494\n\nCVE-2025-11495\n\nCVE-2025-11839\n\nCVE-2025-11840\n\nCVE-2025-39929\n\nCVE-2025-39931\n\nCVE-2025-39977\n\nCVE-2025-40022\n\nCVE-2025-59375\n\nCVE-2025-66382\n\nCVE-2024-57924\n\nCVE-2025-38614\n\nCVE-2025-38685\n\nCVE-2025-38691\n\nCVE-2025-38701\n\nCVE-2025-38702\n\nCVE-2025-38708\n\nCVE-2025-38721\n\nCVE-2025-38724\n\nCVE-2025-38727\n\nCVE-2025-39683\n\nCVE-2025-39689\n\nCVE-2025-39697\n\nCVE-2025-39724\n\nCVE-2025-39756\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39783\n\nCVE-2025-39787\n\nCVE-2025-39795\n\nCVE-2025-39798\n\nCVE-2025-39866\n\nCVE-2025-38058\n\nCVE-2025-38063\n\nCVE-2025-38067\n\nCVE-2025-38071\n\nCVE-2025-38079\n\nCVE-2025-38083\n\nCVE-2025-38100\n\nCVE-2025-38111\n\nCVE-2025-38124\n\nCVE-2025-38167\n\nCVE-2025-38198\n\nCVE-2025-38212\n\nCVE-2025-38214\n\nCVE-2025-38215\n\nCVE-2025-38222\n\nCVE-2025-38231\n\nCVE-2025-38236\n\nCVE-2025-38280\n\nCVE-2025-38285\n\nCVE-2025-38312\n\nCVE-2025-38342\n\nCVE-2025-38350\n\nCVE-2025-38364\n\nCVE-2025-38393\n\nCVE-2025-38400\n\nCVE-2025-38430\n\nCVE-2025-38451\n\nCVE-2025-38457\n\nCVE-2025-38465\n\nCVE-2025-38466\n\nCVE-2025-38468\n\nCVE-2025-38470\n\nCVE-2025-38471\n\nCVE-2025-38477\n\nCVE-2025-38498\n\nCVE-2025-38499\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49998\n\nCVE-2024-50298\n\nCVE-2024-56719\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-37945\n\nCVE-2025-37980\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38704\n\nCVE-2025-39748\n\nCVE-2025-39764\n\nCVE-2025-40135\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-68206\n\nCVE-2025-68265\n\nCVE-2025-71161\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-23100\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31431\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43284\n\nCVE-2026-46174\n\nCVE-2026-46300\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.5 < V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-32776\n\nCVE-2026-32777\n\nCVE-2026-32778\n\nCVE-2026-3904\n\nCVE-2026-4046\n\nCVE-2026-41080\n\nCVE-2026-4437\n\nCVE-2026-4438\n\nCVE-2026-45186\n\nCVE-2026-5435\n\nCVE-2026-5450\n\nCVE-2026-5928\n\nCVE-2026-6238\n\nUpdate to V3.1.6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.5\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2025-21848\n\nCVE-2025-21712\n\nCVE-2025-21865\n\nCVE-2025-21862\n\nCVE-2025-21864\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-50246\n\nCVE-2024-57977\n\nCVE-2024-24855\n\nCVE-2024-26596\n\nCVE-2025-21701\n\nCVE-2025-21767\n\nCVE-2025-21728\n\nCVE-2025-21766\n\nCVE-2025-21795\n\nCVE-2025-21724\n\nCVE-2025-21765\n\nCVE-2024-57996\n\nCVE-2025-21796\n\nCVE-2025-21758\n\nCVE-2025-21745\n\nCVE-2023-4527\n\nCVE-2023-4806\n\nCVE-2023-4911\n\nCVE-2023-38545\n\nCVE-2023-38546\n\nCVE-2023-5363\n\nCVE-2023-44487\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-48795\n\nCVE-2023-51384\n\nCVE-2023-51385\n\nCVE-2023-46218\n\nCVE-2023-46219\n\nCVE-2023-6246\n\nCVE-2023-6779\n\nCVE-2023-6780\n\nCVE-2024-28085\n\nCVE-2024-2961\n\nCVE-2024-33599\n\nCVE-2024-33600\n\nCVE-2024-33601\n\nCVE-2024-33602\n\nCVE-2024-34397\n\nCVE-2024-6387\n\nCVE-2024-37370\n\nCVE-2024-37371\n\nCVE-2024-6119\n\nCVE-2024-45490\n\nCVE-2024-45491\n\nCVE-2024-45492\n\nCVE-2024-12133\n\nCVE-2024-12243\n\nCVE-2025-26465\n\nCVE-2025-31115\n\nCVE-2025-46836\n\nCVE-2025-4598\n\nCVE-2025-4373\n\nCVE-2025-6395\n\nCVE-2025-32988\n\nCVE-2025-32989\n\nCVE-2025-3198\n\nCVE-2025-5244\n\nCVE-2025-5245\n\nCVE-2025-7425\n\nCVE-2025-7545\n\nCVE-2025-7546\n\nCVE-2025-8224\n\nCVE-2025-9230\n\nCVE-2025-9232\n\nCVE-2025-11082\n\nCVE-2025-11083\n\nCVE-2025-11412\n\nCVE-2025-11413\n\nCVE-2025-11414\n\nCVE-2025-11494\n\nCVE-2025-11495\n\nCVE-2025-11839\n\nCVE-2025-11840\n\nCVE-2025-39929\n\nCVE-2025-39931\n\nCVE-2025-39977\n\nCVE-2025-40022\n\nCVE-2025-59375\n\nCVE-2025-66382\n\nCVE-2024-57924\n\nCVE-2025-38614\n\nCVE-2025-38685\n\nCVE-2025-38691\n\nCVE-2025-38701\n\nCVE-2025-38702\n\nCVE-2025-38708\n\nCVE-2025-38721\n\nCVE-2025-38724\n\nCVE-2025-38727\n\nCVE-2025-39683\n\nCVE-2025-39689\n\nCVE-2025-39697\n\nCVE-2025-39724\n\nCVE-2025-39756\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39783\n\nCVE-2025-39787\n\nCVE-2025-39795\n\nCVE-2025-39798\n\nCVE-2025-39866\n\nCVE-2025-38058\n\nCVE-2025-38063\n\nCVE-2025-38067\n\nCVE-2025-38071\n\nCVE-2025-38079\n\nCVE-2025-38083\n\nCVE-2025-38100\n\nCVE-2025-38111\n\nCVE-2025-38124\n\nCVE-2025-38167\n\nCVE-2025-38198\n\nCVE-2025-38212\n\nCVE-2025-38214\n\nCVE-2025-38215\n\nCVE-2025-38222\n\nCVE-2025-38231\n\nCVE-2025-38236\n\nCVE-2025-38280\n\nCVE-2025-38285\n\nCVE-2025-38312\n\nCVE-2025-38342\n\nCVE-2025-38350\n\nCVE-2025-38364\n\nCVE-2025-38393\n\nCVE-2025-38400\n\nCVE-2025-38430\n\nCVE-2025-38451\n\nCVE-2025-38457\n\nCVE-2025-38465\n\nCVE-2025-38466\n\nCVE-2025-38468\n\nCVE-2025-38470\n\nCVE-2025-38471\n\nCVE-2025-38477\n\nCVE-2025-38498\n\nCVE-2025-38499\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49998\n\nCVE-2024-50298\n\nCVE-2024-56719\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-37945\n\nCVE-2025-37980\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38704\n\nCVE-2025-39748\n\nCVE-2025-39764\n\nCVE-2025-40135\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-68206\n\nCVE-2025-68265\n\nCVE-2025-71161\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-23100\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31431\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43284\n\nCVE-2026-46174\n\nCVE-2026-46300\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.5 < V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-32776\n\nCVE-2026-32777\n\nCVE-2026-32778\n\nCVE-2026-3904\n\nCVE-2026-4046\n\nCVE-2026-41080\n\nCVE-2026-4437\n\nCVE-2026-4438\n\nCVE-2026-45186\n\nCVE-2026-5435\n\nCVE-2026-5450\n\nCVE-2026-5928\n\nCVE-2026-6238\n\nUpdate to V3.1.6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.5\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2025-21848\n\nCVE-2025-21712\n\nCVE-2025-21865\n\nCVE-2025-21862\n\nCVE-2025-21864\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-50246\n\nCVE-2024-57977\n\nCVE-2024-24855\n\nCVE-2024-26596\n\nCVE-2025-21701\n\nCVE-2025-21767\n\nCVE-2025-21728\n\nCVE-2025-21766\n\nCVE-2025-21795\n\nCVE-2025-21724\n\nCVE-2025-21765\n\nCVE-2024-57996\n\nCVE-2025-21796\n\nCVE-2025-21758\n\nCVE-2025-21745\n\nCVE-2023-4527\n\nCVE-2023-4806\n\nCVE-2023-4911\n\nCVE-2023-38545\n\nCVE-2023-38546\n\nCVE-2023-5363\n\nCVE-2023-44487\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-48795\n\nCVE-2023-51384\n\nCVE-2023-51385\n\nCVE-2023-46218\n\nCVE-2023-46219\n\nCVE-2023-6246\n\nCVE-2023-6779\n\nCVE-2023-6780\n\nCVE-2024-28085\n\nCVE-2024-2961\n\nCVE-2024-33599\n\nCVE-2024-33600\n\nCVE-2024-33601\n\nCVE-2024-33602\n\nCVE-2024-34397\n\nCVE-2024-6387\n\nCVE-2024-37370\n\nCVE-2024-37371\n\nCVE-2024-6119\n\nCVE-2024-45490\n\nCVE-2024-45491\n\nCVE-2024-45492\n\nCVE-2024-12133\n\nCVE-2024-12243\n\nCVE-2025-26465\n\nCVE-2025-31115\n\nCVE-2025-46836\n\nCVE-2025-4598\n\nCVE-2025-4373\n\nCVE-2025-6395\n\nCVE-2025-32988\n\nCVE-2025-32989\n\nCVE-2025-3198\n\nCVE-2025-5244\n\nCVE-2025-5245\n\nCVE-2025-7425\n\nCVE-2025-7545\n\nCVE-2025-7546\n\nCVE-2025-8224\n\nCVE-2025-9230\n\nCVE-2025-9232\n\nCVE-2025-11082\n\nCVE-2025-11083\n\nCVE-2025-11412\n\nCVE-2025-11413\n\nCVE-2025-11414\n\nCVE-2025-11494\n\nCVE-2025-11495\n\nCVE-2025-11839\n\nCVE-2025-11840\n\nCVE-2025-39929\n\nCVE-2025-39931\n\nCVE-2025-39977\n\nCVE-2025-40022\n\nCVE-2025-59375\n\nCVE-2025-66382\n\nCVE-2024-57924\n\nCVE-2025-38614\n\nCVE-2025-38685\n\nCVE-2025-38691\n\nCVE-2025-38701\n\nCVE-2025-38702\n\nCVE-2025-38708\n\nCVE-2025-38721\n\nCVE-2025-38724\n\nCVE-2025-38727\n\nCVE-2025-39683\n\nCVE-2025-39689\n\nCVE-2025-39697\n\nCVE-2025-39724\n\nCVE-2025-39756\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39783\n\nCVE-2025-39787\n\nCVE-2025-39795\n\nCVE-2025-39798\n\nCVE-2025-39866\n\nCVE-2025-38058\n\nCVE-2025-38063\n\nCVE-2025-38067\n\nCVE-2025-38071\n\nCVE-2025-38079\n\nCVE-2025-38083\n\nCVE-2025-38100\n\nCVE-2025-38111\n\nCVE-2025-38124\n\nCVE-2025-38167\n\nCVE-2025-38198\n\nCVE-2025-38212\n\nCVE-2025-38214\n\nCVE-2025-38215\n\nCVE-2025-38222\n\nCVE-2025-38231\n\nCVE-2025-38236\n\nCVE-2025-38280\n\nCVE-2025-38285\n\nCVE-2025-38312\n\nCVE-2025-38342\n\nCVE-2025-38350\n\nCVE-2025-38364\n\nCVE-2025-38393\n\nCVE-2025-38400\n\nCVE-2025-38430\n\nCVE-2025-38451\n\nCVE-2025-38457\n\nCVE-2025-38465\n\nCVE-2025-38466\n\nCVE-2025-38468\n\nCVE-2025-38470\n\nCVE-2025-38471\n\nCVE-2025-38477\n\nCVE-2025-38498\n\nCVE-2025-38499\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49998\n\nCVE-2024-50298\n\nCVE-2024-56719\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-37945\n\nCVE-2025-37980\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38704\n\nCVE-2025-39748\n\nCVE-2025-39764\n\nCVE-2025-40135\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-68206\n\nCVE-2025-68265\n\nCVE-2025-71161\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-23100\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31431\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43284\n\nCVE-2026-46174\n\nCVE-2026-46300\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.5 < V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-32776\n\nCVE-2026-32777\n\nCVE-2026-32778\n\nCVE-2026-3904\n\nCVE-2026-4046\n\nCVE-2026-41080\n\nCVE-2026-4437\n\nCVE-2026-4438\n\nCVE-2026-45186\n\nCVE-2026-5435\n\nCVE-2026-5450\n\nCVE-2026-5928\n\nCVE-2026-6238\n\nUpdate to V3.1.6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nAll versions >= V3.1.5\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2025-21848\n\nCVE-2025-21712\n\nCVE-2025-21865\n\nCVE-2025-21862\n\nCVE-2025-21864\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-50246\n\nCVE-2024-57977\n\nCVE-2024-24855\n\nCVE-2024-26596\n\nCVE-2025-21701\n\nCVE-2025-21767\n\nCVE-2025-21728\n\nCVE-2025-21766\n\nCVE-2025-21795\n\nCVE-2025-21724\n\nCVE-2025-21765\n\nCVE-2024-57996\n\nCVE-2025-21796\n\nCVE-2025-21758\n\nCVE-2025-21745\n\nCVE-2023-4527\n\nCVE-2023-4806\n\nCVE-2023-4911\n\nCVE-2023-38545\n\nCVE-2023-38546\n\nCVE-2023-5363\n\nCVE-2023-44487\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-48795\n\nCVE-2023-51384\n\nCVE-2023-51385\n\nCVE-2023-46218\n\nCVE-2023-46219\n\nCVE-2023-6246\n\nCVE-2023-6779\n\nCVE-2023-6780\n\nCVE-2024-28085\n\nCVE-2024-2961\n\nCVE-2024-33599\n\nCVE-2024-33600\n\nCVE-2024-33601\n\nCVE-2024-33602\n\nCVE-2024-34397\n\nCVE-2024-6387\n\nCVE-2024-37370\n\nCVE-2024-37371\n\nCVE-2024-6119\n\nCVE-2024-45490\n\nCVE-2024-45491\n\nCVE-2024-45492\n\nCVE-2024-12133\n\nCVE-2024-12243\n\nCVE-2025-26465\n\nCVE-2025-31115\n\nCVE-2025-46836\n\nCVE-2025-4598\n\nCVE-2025-4373\n\nCVE-2025-6395\n\nCVE-2025-32988\n\nCVE-2025-32989\n\nCVE-2025-3198\n\nCVE-2025-5244\n\nCVE-2025-5245\n\nCVE-2025-7425\n\nCVE-2025-7545\n\nCVE-2025-7546\n\nCVE-2025-8224\n\nCVE-2025-9230\n\nCVE-2025-9232\n\nCVE-2025-11082\n\nCVE-2025-11083\n\nCVE-2025-11412\n\nCVE-2025-11413\n\nCVE-2025-11414\n\nCVE-2025-11494\n\nCVE-2025-11495\n\nCVE-2025-11839\n\nCVE-2025-11840\n\nCVE-2025-39929\n\nCVE-2025-39931\n\nCVE-2025-39977\n\nCVE-2025-40022\n\nCVE-2025-59375\n\nCVE-2025-66382\n\nCVE-2024-57924\n\nCVE-2025-38614\n\nCVE-2025-38685\n\nCVE-2025-38691\n\nCVE-2025-38701\n\nCVE-2025-38702\n\nCVE-2025-38708\n\nCVE-2025-38721\n\nCVE-2025-38724\n\nCVE-2025-38727\n\nCVE-2025-39683\n\nCVE-2025-39689\n\nCVE-2025-39697\n\nCVE-2025-39724\n\nCVE-2025-39756\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39783\n\nCVE-2025-39787\n\nCVE-2025-39795\n\nCVE-2025-39798\n\nCVE-2025-39866\n\nCVE-2025-38058\n\nCVE-2025-38063\n\nCVE-2025-38067\n\nCVE-2025-38071\n\nCVE-2025-38079\n\nCVE-2025-38083\n\nCVE-2025-38100\n\nCVE-2025-38111\n\nCVE-2025-38124\n\nCVE-2025-38167\n\nCVE-2025-38198\n\nCVE-2025-38212\n\nCVE-2025-38214\n\nCVE-2025-38215\n\nCVE-2025-38222\n\nCVE-2025-38231\n\nCVE-2025-38236\n\nCVE-2025-38280\n\nCVE-2025-38285\n\nCVE-2025-38312\n\nCVE-2025-38342\n\nCVE-2025-38350\n\nCVE-2025-38364\n\nCVE-2025-38393\n\nCVE-2025-38400\n\nCVE-2025-38430\n\nCVE-2025-38451\n\nCVE-2025-38457\n\nCVE-2025-38465\n\nCVE-2025-38466\n\nCVE-2025-38468\n\nCVE-2025-38470\n\nCVE-2025-38471\n\nCVE-2025-38477\n\nCVE-2025-38498\n\nCVE-2025-38499\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49998\n\nCVE-2024-50298\n\nCVE-2024-56719\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-37945\n\nCVE-2025-37980\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38704\n\nCVE-2025-39748\n\nCVE-2025-39764\n\nCVE-2025-40135\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-68206\n\nCVE-2025-68265\n\nCVE-2025-71161\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-23100\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31431\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43284\n\nCVE-2026-46174\n\nCVE-2026-46300\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nAll versions >= V3.1.5 < V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-32776\n\nCVE-2026-32777\n\nCVE-2026-32778\n\nCVE-2026-3904\n\nCVE-2026-4046\n\nCVE-2026-41080\n\nCVE-2026-4437\n\nCVE-2026-4438\n\nCVE-2026-45186\n\nCVE-2026-5435\n\nCVE-2026-5450\n\nCVE-2026-5928\n\nCVE-2026-6238\n\nUpdate to V3.1.6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)\n\nShow more details\n\nSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)\n\nAll versions >= V3.1.5\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2025-21848\n\nCVE-2025-21712\n\nCVE-2025-21865\n\nCVE-2025-21862\n\nCVE-2025-21864\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-50246\n\nCVE-2024-57977\n\nCVE-2024-24855\n\nCVE-2", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2025-21848", "CVE-2025-21712", "CVE-2025-21865", "CVE-2025-21862", "CVE-2025-21864", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-50246", "CVE-2024-57977", "CVE-2024-24855", "CVE-2024-26596", "CVE-2025-21701", "CVE-2025-21767", "CVE-2025-21728", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21724", "CVE-2025-21765", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21745", "CVE-2023-4527", "CVE-2023-4806", "CVE-2023-4911", "CVE-2023-38545", "CVE-2023-38546", "CVE-2023-5363", "CVE-2023-44487", "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-48795", "CVE-2023-51384", "CVE-2023-51385", "CVE-2023-46218", "CVE-2023-46219", "CVE-2023-6246", "CVE-2023-6779", "CVE-2023-6780", "CVE-2024-28085", "CVE-2024-2961", "CVE-2024-33599", "CVE-2024-33600", "CVE-2024-33601", "CVE-2024-33602", "CVE-2024-34397", "CVE-2024-6387", "CVE-2024-37370", "CVE-2024-37371", "CVE-2024-6119", "CVE-2024-45490", "CVE-2024-45491", "CVE-2024-45492", "CVE-2024-12133", "CVE-2024-12243", "CVE-2025-26465", "CVE-2025-31115", "CVE-2025-46836", "CVE-2025-4598", "CVE-2025-4373", "CVE-2025-6395", "CVE-2025-32988", "CVE-2025-32989", "CVE-2025-3198", "CVE-2025-5244", "CVE-2025-5245", "CVE-2025-7425", "CVE-2025-7545", "CVE-2025-7546", "CVE-2025-8224", "CVE-2025-9230", "CVE-2025-9232", "CVE-2025-11082", "CVE-2025-11083", "CVE-2025-11412", "CVE-2025-11413", "CVE-2025-11414", "CVE-2025-11494", "CVE-2025-11495", "CVE-2025-11839", "CVE-2025-11840", "CVE-2025-39929", "CVE-2025-39931", "CVE-2025-39977", "CVE-2025-40022", "CVE-2025-59375", "CVE-2025-66382", "CVE-2024-57924", "CVE-2025-38614", "CVE-2025-38685", "CVE-2025-38691", "CVE-2025-38701", "CVE-2025-38702", "CVE-2025-38708", "CVE-2025-38721", "CVE-2025-38724", "CVE-2025-38727", "CVE-2025-39683", "CVE-2025-39689", "CVE-2025-39697", "CVE-2025-39724", "CVE-2025-39756", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39783", "CVE-2025-39787", "CVE-2025-39795", "CVE-2025-39798", "CVE-2025-39866", "CVE-2025-38058", "CVE-2025-38063", "CVE-2025-38067", "CVE-2025-38071", "CVE-2025-38079", "CVE-2025-38083", "CVE-2025-38100", "CVE-2025-38111", "CVE-2025-38124", "CVE-2025-38167", "CVE-2025-38198", "CVE-2025-38212", "CVE-2025-38214", "CVE-2025-38215", "CVE-2025-38222", "CVE-2025-38231", "CVE-2025-38236", "CVE-2025-38280", "CVE-2025-38285", "CVE-2025-38312", "CVE-2025-38342", "CVE-2025-38350", "CVE-2025-38364", "CVE-2025-38393", "CVE-2025-38400", "CVE-2025-38430", "CVE-2025-38451", "CVE-2025-38457", "CVE-2025-38465", "CVE-2025-38466", "CVE-2025-38468", "CVE-2025-38470", "CVE-2025-38471", "CVE-2025-38477", "CVE-2025-38498", "CVE-2025-38499", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49998", "CVE-2024-50298", "CVE-2024-56719", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-37945", "CVE-2025-37980", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38704", "CVE-2025-39748", "CVE-2025-39764", "CVE-2025-40135", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-68206", "CVE-2025-68265", "CVE-2025-71161", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-23100", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31431", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43284", "CVE-2026-46174", "CVE-2026-46300", "CVE-2026-32776", "CVE-2026-32777", "CVE-2026-32778", "CVE-2026-3904", "CVE-2026-4046", "CVE-2026-41080", "CVE-2026-4437", "CVE-2026-4438", "CVE-2026-45186", "CVE-2026-5435", "CVE-2026-5450", "CVE-2026-5928", "CVE-2026-6238", "CVE-2006-5051", "CVE-2025-38617", "CVE-2025-32990" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "sourcePath": "body:advisory", "text": "SSA-099819\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-099819: Denial of Service Vulnerability in SENTRON 3NA COM Fuse\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n5.8\n\nSUMMARY\n\nSENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSENTRON 3NA COM Fuse\n\nAll versions < V5.2\n\naffected by\n\nCVE-2024-7322\n\nUpdate to V5.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109797242/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSENTRON 3NA COM, the first NH fuse with current direction detection, delivers overload protection and measurement data for grid stability and faster fault diagnosis.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-7322\n\nA ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes Denial of Service (DoS). To recover from this DoS, the network must be re-established\n\nCVSS v3.1 Base Score\n5.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H\n\nCWE\nCWE-940: Improper Verification of Source of a Communication Channel\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-099819\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-7322" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "sourcePath": "body:advisory", "text": "SSA-104023\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-07-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n9.2\n\nSUMMARY\n\nPalo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nCustomers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications.\n\n[1] https://security.paloaltonetworks.com/\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW\n\naffected by\n\nall CVEs\n\nCVE-2026-0266\n\nCVE-2026-0272\n\nCVE-2026-0273\n\nCVE-2026-0279\n\nCVE-2026-0280\n\nCVE-2026-0281\n\nCVE-2026-0282\n\nCVE-2026-0283\n\nCVE-2026-0284\n\nCVE-2026-0285\n\nCVE-2026-0286\n\nCVE-2026-0287\n\nCVE-2026-0288\n\nCVE-2026-0308\n\nCVE-2026-0309\n\nCVE-2026-0310\n\nContact customer support to receive patch and update information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-0266\n\nA cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCVSS v3.1 Base Score\n2.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N\n\nCVSS v4.0 Base Score\n4.8\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nVulnerability CVE-2026-0272\n\nA privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges.\n\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\n\nCVSS v4.0 Base Score\n8.5\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-862: Missing Authorization\n\nVulnerability CVE-2026-0273\n\nA command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI.\n\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCVSS v3.1 Base Score\n7.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.6\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\nVulnerability CVE-2026-0279\n\nMultiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload.\n\nThe security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCVSS v3.1 Base Score\n5.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\n\nCVSS v4.0 Base Score\n5.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nVulnerability CVE-2026-0280\n\nAn IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services.\n\nCVSS v3.1 Base Score\n5.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N\n\nCVSS v4.0 Base Score\n6.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N\n\nCWE\nCWE-131: Incorrect Calculation of Buffer Size\n\nVulnerability CVE-2026-0281\n\nAn information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker.\n\nThe security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCVSS v3.1 Base Score\n5.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N\n\nCVSS v4.0 Base Score\n5.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-524: Use of Cache Containing Sensitive Information\n\nVulnerability CVE-2026-0282\n\nA file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.\n\nThe security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\n\nCVSS v4.0 Base Score\n6.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2026-0283\n\nAn authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection.\n\nCVSS v3.1 Base Score\n9.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L\n\nCVSS v4.0 Base Score\n7.8\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:N\n\nCWE\nCWE-306: Missing Authentication for Critical Function\n\nVulnerability CVE-2026-0284\n\nAn XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data.\n\nCVSS v3.1 Base Score\n9.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L\n\nCVSS v4.0 Base Score\n7.8\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:L\n\nCWE\nCWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')\n\nVulnerability CVE-2026-0285\n\nA server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services.\n\nThe security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N\n\nCVSS v4.0 Base Score\n7.0\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-918: Server-Side Request Forgery (SSRF)\n\nVulnerability CVE-2026-0286\n\nA command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root.\n\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\n\nCVSS v4.0 Base Score\n8.5\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\nVulnerability CVE-2026-0287\n\nMultiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-754: Improper Check for Unusual or Exceptional Conditions\n\nVulnerability CVE-2026-0288\n\nMultiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.\n\nCVSS v3.1 Base Score\n10.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n9.2\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2026-0308\n\nA stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface.\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCVSS v3.1 Base Score\n3.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N\n\nCVSS v4.0 Base Score\n4.8\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nVulnerability CVE-2026-0309\n\nA command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM).\n\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n7.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\nVulnerability CVE-2026-0310\n\nA buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.\n\nThe security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nCVSS v3.1 Base Score\n9.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n9.2\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N\n\nCWE\nCWE-787: Out-of-bounds Write\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-07-14):\n\nPublication Date\n\nV1.1 (2026-08-11):\n\nAdded CVE-2026-0279, CVE-2026-0280, CVE-2026-0281, CVE-2026-0282, CVE-2026-0283, CVE-2026-0284, CVE-2026-0285, CVE-2026-0286, CVE-2026-0287 and CVE-2026-0288\n\nV1.2 (2026-10-13):\n\nAdded CVE-2026-0308, CVE-2026-0309 and CVE-2026-0310\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-104023\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-0266", "CVE-2026-0272", "CVE-2026-0273", "CVE-2026-0279", "CVE-2026-0280", "CVE-2026-0281", "CVE-2026-0282", "CVE-2026-0283", "CVE-2026-0284", "CVE-2026-0285", "CVE-2026-0286", "CVE-2026-0287", "CVE-2026-0288", "CVE-2026-0308", "CVE-2026-0309", "CVE-2026-0310" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "sourcePath": "body:advisory", "text": "SSA-127084\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-08-11\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.1\n\nCVSS v3.1 Base Score:\n8.1\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigation measures.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW\n\naffected by\n\nall CVEs\n\nCVE-2026-23573\n\nCVE-2026-59839\n\nCVE-2026-71408\n\nCVE-2026-71407\n\nCVE-2026-84393\n\nUpdate Fortigate NGFW to V7.6.7 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-23573\n\nAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS, FortiProxy, FortiPAM and FortiSwitch-Manager Agentless SSL-VPN may allow an authenticated remote user to execute code or commands via crafted requests\n\nCVSS v3.1 Base Score\n6.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nVulnerability CVE-2026-59839\n\nAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiOS, FortiPAM, FortiProxy and FortiSwitch Manager may allow a privileged authenticated attacker with physical access to the device to delete the file system via crafted CLI commands\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H\n\nCWE\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\n\nVulnerability CVE-2026-71407\n\nA Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.\n\nCVSS v3.1 Base Score\n5.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2026-71408\n\nAn Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in FortiOS may allow an unauthenticated attacker to perform a slow HTTP DoS attack on the web interface via crafted HTTP requests\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-770: Allocation of Resources Without Limits or Throttling\n\nVulnerability CVE-2026-84393\n\nAn improper certificate validation vulnerability [CWE-295] in FortiOS and FortiProxy Agentless ZTNA portal may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the ZTNA portal and the backend destination website\n\nCVSS v3.1 Base Score\n8.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-297: Improper Validation of Certificate with Host Mismatch\n\nADDITIONAL INFORMATION\n\nSiemens recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications .\nFortinet provides a public RSS feed for their security alerts to which customers can also subscribe [1].\n\n[1] https://filestore.fortinet.com/fortiguard/rss/ir.xml\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-08-11):\n\nPublication Date\n\nV1.1 (2026-10-13):\n\nAdded CVE-2026-71408, CVE-2026-71407 and CVE-2026-84393\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-127084\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-23573", "CVE-2026-59839", "CVE-2026-71408", "CVE-2026-71407", "CVE-2026-84393" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "sourcePath": "body:advisory", "text": "SSA-148322\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n7.0\n\nSUMMARY\n\nPSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type.\n\nSiemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nPSS(R)SINCAL V21.5\n\nAll versions\n\naffected by\n\nCVE-2026-84854\n\nCurrently no fix is available\n\nInstall WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems.\n\nPSS(R)SINCAL V22.0\n\nAll versions\n\naffected by\n\nCVE-2026-84854\n\nCurrently no fix is available\n\nInstall WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems.\n\nPSS(R)SINCAL V22.5\n\nAll versions < V22.5 Update 5\n\naffected by\n\nCVE-2026-84854\n\nUpdate to V22.5 Update 5 or later version\n\nhttps://www.simtec.cc/en/updates.aspx\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nOperators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nPRODUCT DESCRIPTION\n\nPSS(R)SINCAL is a simulation software for electric and pipe networks.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-84854\n\nIn the WibuKey driver, insufficient validation of user input when calculating the size of a kernel buffer could cause\nsmall amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under\nunfavorable circumstances, adjacent kernel memory may be modified.\n\nCVSS v3.1 Base Score\n7.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-787: Out-of-bounds Write\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-148322\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-84854" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "sourcePath": "body:advisory", "text": "SSA-159454\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n7.7\n\nCVSS v4.0 Base Score:\n8.4\n\nSUMMARY\n\nThe products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC IPC family\n\nShow more details\n\nSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G\n\nAll versions < V28.01.15\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V28.01.15 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC BX-21A\n\nAll versions < V31.01.13\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V31.01.13 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC RW-543A\n\nAll versions < V1.1.4\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V1.1.4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nAs a temporary mitigation, users can manually remove the test key from the database (e.g., \"DO NOT TRUST - AMI Test PK\" for RW-543A or \"insyde-ElkhartLake\" for IPC227G/277G/327G/377G and BX-21A). Note: Loading default settings will restore the test key, so upgrading remains recommended.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC IPC (Industrial PC) is the hardware platform for PC-based automation from Siemens.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-72895\n\nA BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.\n\nCVSS v3.1 Base Score\n7.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.4\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-1394: Use of Default Cryptographic Key\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-159454\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-72895" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "sourcePath": "body:advisory", "text": "SSA-265688\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1\n\nPublication Date:\n\n2024-04-09\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.3\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.2\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.\n\nSiemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nSIMATIC S7-1500 TM MFP V1.1 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V1.1 only; for version V1.1.1 refer to SSA-784472 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nShow more details\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions < V1.1.1\n\naffected by\n\nmultiple CVEs\n\nCVE-2023-5678\n\nCVE-2024-0727\n\nCVE-2023-6121\n\nCVE-2023-45898\n\nCVE-2023-6932\n\nCVE-2023-6931\n\nCVE-2023-6817\n\nCVE-2024-2511\n\nCVE-2024-5535\n\nCVE-2024-9143\n\nCVE-2024-36484\n\nCVE-2024-36902\n\nCVE-2024-36904\n\nCVE-2024-36905\n\nCVE-2024-36916\n\nCVE-2024-36929\n\nCVE-2024-36939\n\nCVE-2024-36940\n\nCVE-2024-36959\n\nCVE-2024-44987\n\nCVE-2024-44989\n\nCVE-2024-44990\n\nCVE-2024-45016\n\nCVE-2024-45018\n\nCVE-2024-46679\n\nCVE-2024-46743\n\nCVE-2024-46744\n\nCVE-2024-46745\n\nCVE-2024-46750\n\nCVE-2024-46759\n\nCVE-2024-46783\n\nCVE-2024-47660\n\nCVE-2024-50299\n\nCVE-2024-50301\n\nCVE-2024-53101\n\nCVE-2024-50302\n\nCVE-2023-52447\n\nCVE-2024-22099\n\nCVE-2024-26651\n\nCVE-2024-26659\n\nCVE-2024-26787\n\nCVE-2024-26816\n\nCVE-2024-26820\n\nCVE-2024-26851\n\nCVE-2024-26852\n\nCVE-2024-26855\n\nCVE-2024-26859\n\nCVE-2024-26861\n\nCVE-2024-26863\n\nCVE-2024-26870\n\nCVE-2024-26872\n\nCVE-2024-26875\n\nCVE-2024-26877\n\nCVE-2024-26878\n\nCVE-2024-26880\n\nCVE-2024-26882\n\nCVE-2024-26883\n\nCVE-2024-26884\n\nCVE-2024-26889\n\nCVE-2024-26891\n\nCVE-2024-26894\n\nCVE-2024-26895\n\nCVE-2024-26897\n\nCVE-2024-26898\n\nCVE-2024-26901\n\nCVE-2024-26903\n\nCVE-2024-26906\n\nCVE-2024-26907\n\nCVE-2024-27024\n\nCVE-2024-27025\n\nCVE-2024-27038\n\nCVE-2024-27047\n\nCVE-2024-27052\n\nCVE-2024-27053\n\nCVE-2024-27065\n\nCVE-2024-27076\n\nCVE-2024-27077\n\nCVE-2024-27078\n\nCVE-2024-27419\n\nCVE-2024-27431\n\nCVE-2024-27436\n\nCVE-2024-35828\n\nCVE-2024-35845\n\nCVE-2024-35902\n\nCVE-2024-40961\n\nCVE-2022-48829\n\nCVE-2024-40934\n\nCVE-2024-36286\n\nCVE-2021-47107\n\nCVE-2024-38619\n\nCVE-2024-33847\n\nCVE-2024-39509\n\nCVE-2022-48827\n\nCVE-2024-40941\n\nCVE-2024-38596\n\nCVE-2024-38599\n\nCVE-2024-38565\n\nCVE-2024-42093\n\nCVE-2024-42097\n\nCVE-2024-39502\n\nCVE-2024-40995\n\nCVE-2024-40942\n\nCVE-2024-40960\n\nCVE-2024-38598\n\nCVE-2024-41004\n\nCVE-2024-26629\n\nCVE-2024-41006\n\nCVE-2024-36489\n\nCVE-2024-41005\n\nCVE-2024-39468\n\nCVE-2024-40984\n\nCVE-2024-38567\n\nCVE-2024-39489\n\nCVE-2024-38662\n\nCVE-2021-47316\n\nCVE-2024-39482\n\nCVE-2024-38552\n\nCVE-2024-42094\n\nCVE-2024-40958\n\nCVE-2024-38780\n\nCVE-2024-36894\n\nCVE-2024-40912\n\nCVE-2024-40905\n\nCVE-2024-36974\n\nCVE-2024-40971\n\nCVE-2021-47002\n\nCVE-2024-38558\n\nCVE-2024-38659\n\nCVE-2024-36270\n\nCVE-2024-38612\n\nCVE-2024-41000\n\nCVE-2024-42070\n\nCVE-2024-38547\n\nCVE-2024-38578\n\nCVE-2024-42090\n\nCVE-2024-42082\n\nCVE-2024-37356\n\nCVE-2024-33621\n\nCVE-2024-38615\n\nCVE-2024-38381\n\nCVE-2024-42096\n\nCVE-2024-40959\n\nCVE-2024-38589\n\nCVE-2024-38579\n\nCVE-2024-38560\n\nCVE-2024-34027\n\nCVE-2022-48828\n\nCVE-2024-40978\n\nCVE-2024-40993\n\nCVE-2024-40980\n\nCVE-2024-39503\n\nCVE-2024-38635\n\nCVE-2024-36978\n\nCVE-2021-4090\n\nCVE-2024-23848\n\nCVE-2024-50121\n\nCVE-2023-1652\n\nCVE-2024-42272\n\nCVE-2024-36288\n\nCVE-2021-38202\n\nCVE-2024-49977\n\nCVE-2022-43945\n\nCVE-2024-38559\n\nCVE-2024-50251\n\nCVE-2024-50262\n\nCVE-2024-53042\n\nCVE-2024-53057\n\nCVE-2024-53059\n\nCVE-2024-26885\n\nCVE-2024-27072\n\nCVE-2024-35965\n\nCVE-2024-41016\n\nCVE-2024-46854\n\nCVE-2024-46865\n\nCVE-2024-47684\n\nCVE-2024-47685\n\nCVE-2024-47692\n\nCVE-2024-47696\n\nCVE-2024-47697\n\nCVE-2024-47699\n\nCVE-2024-47701\n\nCVE-2024-47705\n\nCVE-2024-47706\n\nCVE-2024-47709\n\nCVE-2024-47710\n\nCVE-2024-47713\n\nCVE-2024-47718\n\nCVE-2024-47723\n\nCVE-2024-47735\n\nCVE-2024-47737\n\nCVE-2024-47747\n\nCVE-2024-49851\n\nCVE-2024-49889\n\nCVE-2024-49890\n\nCVE-2024-49892\n\nCVE-2024-49894\n\nCVE-2024-49900\n\nCVE-2024-49902\n\nCVE-2024-49903\n\nCVE-2024-49930\n\nCVE-2024-49938\n\nCVE-2024-49944\n\nCVE-2024-49948\n\nCVE-2024-49949\n\nCVE-2024-49952\n\nCVE-2024-49955\n\nCVE-2024-49973\n\nCVE-2024-49997\n\nCVE-2024-50001\n\nCVE-2024-50006\n\nCVE-2024-50008\n\nCVE-2024-50010\n\nCVE-2024-50015\n\nCVE-2024-50033\n\nCVE-2024-50035\n\nCVE-2024-50039\n\nCVE-2024-50040\n\nCVE-2024-50044\n\nCVE-2024-50045\n\nCVE-2024-50046\n\nCVE-2024-50058\n\nCVE-2024-50095\n\nCVE-2024-50127\n\nCVE-2024-50131\n\nCVE-2024-50134\n\nCVE-2024-50142\n\nCVE-2024-50148\n\nCVE-2024-50150\n\nCVE-2024-50151\n\nCVE-2024-50153\n\nCVE-2024-50188\n\nCVE-2024-50205\n\nCVE-2024-50210\n\nCVE-2022-38096\n\nCVE-2023-28746\n\nCVE-2023-47233\n\nCVE-2023-52458\n\nCVE-2023-52614\n\nCVE-2023-52620\n\nCVE-2024-23307\n\nCVE-2024-24857\n\nCVE-2024-24858\n\nCVE-2024-24859\n\nCVE-2024-25739\n\nCVE-2024-26642\n\nCVE-2024-26643\n\nCVE-2024-26810\n\nCVE-2024-26812\n\nCVE-2024-26920\n\nCVE-2024-26923\n\nCVE-2024-26925\n\nCVE-2024-26934\n\nCVE-2024-26935\n\nCVE-2024-26937\n\nCVE-2024-26950\n\nCVE-2024-26951\n\nCVE-2024-26958\n\nCVE-2024-26960\n\nCVE-2024-26961\n\nCVE-2024-26973\n\nCVE-2024-26974\n\nCVE-2024-26988\n\nCVE-2024-26993\n\nCVE-2024-27004\n\nCVE-2024-27013\n\nCVE-2024-27020\n\nCVE-2024-27059\n\nCVE-2024-27395\n\nCVE-2024-27396\n\nCVE-2024-27397\n\nCVE-2024-27437\n\nCVE-2024-35789\n\nCVE-2024-35805\n\nCVE-2024-35807\n\nCVE-2024-35811\n\nCVE-2024-35813\n\nCVE-2024-35815\n\nCVE-2024-35823\n\nCVE-2024-35849\n\nCVE-2024-35877\n\nCVE-2024-35884\n\nCVE-2024-35886\n\nCVE-2024-35888\n\nCVE-2024-35893\n\nCVE-2024-35895\n\nCVE-2024-35896\n\nCVE-2024-35897\n\nCVE-2024-35898\n\nCVE-2024-35899\n\nCVE-2024-35900\n\nCVE-2024-35905\n\nCVE-2024-35910\n\nCVE-2024-35915\n\nCVE-2024-35922\n\nCVE-2024-35925\n\nCVE-2024-35930\n\nCVE-2024-35933\n\nCVE-2024-35934\n\nCVE-2024-35935\n\nCVE-2024-35936\n\nCVE-2024-35940\n\nCVE-2024-35944\n\nCVE-2024-35950\n\nCVE-2024-35955\n\nCVE-2024-35958\n\nCVE-2024-35960\n\nCVE-2024-35962\n\nCVE-2024-35966\n\nCVE-2024-35967\n\nCVE-2024-35969\n\nCVE-2024-35973\n\nCVE-2024-35976\n\nCVE-2024-35978\n\nCVE-2024-35982\n\nCVE-2024-35983\n\nCVE-2024-35984\n\nCVE-2024-35988\n\nCVE-2024-35990\n\nCVE-2024-35996\n\nCVE-2024-35997\n\nCVE-2024-36004\n\nCVE-2024-36005\n\nCVE-2024-36006\n\nCVE-2024-36007\n\nCVE-2024-36008\n\nCVE-2024-36020\n\nCVE-2024-36899\n\nCVE-2024-38587\n\nCVE-2024-39493\n\nCVE-2024-40916\n\nCVE-2024-42114\n\nCVE-2024-42259\n\nCVE-2024-42265\n\nCVE-2024-42276\n\nCVE-2024-42281\n\nCVE-2024-42283\n\nCVE-2024-42292\n\nCVE-2024-42302\n\nCVE-2024-42304\n\nCVE-2024-42305\n\nCVE-2024-42306\n\nCVE-2024-42312\n\nCVE-2024-43828\n\nCVE-2024-43830\n\nCVE-2024-43834\n\nCVE-2024-43856\n\nCVE-2024-43858\n\nCVE-2024-43871\n\nCVE-2024-43879\n\nCVE-2024-43882\n\nCVE-2024-43889\n\nCVE-2024-43890\n\nCVE-2024-43893\n\nCVE-2024-44935\n\nCVE-2024-44944\n\nCVE-2024-44948\n\nCVE-2024-44960\n\nCVE-2024-47707\n\nCVE-2024-53124\n\nCVE-2024-56631\n\nCVE-2024-56672\n\nCVE-2024-57901\n\nCVE-2024-57902\n\nCVE-2024-57913\n\nCVE-2024-57929\n\nCVE-2024-57940\n\nCVE-2024-57948\n\nCVE-2024-57951\n\nCVE-2024-58016\n\nCVE-2024-58051\n\nCVE-2024-58085\n\nCVE-2024-41996\n\nCVE-2023-6237\n\nCVE-2023-6129\n\nCVE-2025-9230\n\nCVE-2023-50781\n\nCVE-2025-3198\n\nCVE-2025-5244\n\nCVE-2025-5245\n\nCVE-2025-7425\n\nCVE-2025-7545\n\nCVE-2025-7546\n\nCVE-2025-8224\n\nUpdate to V1.1.1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109827684/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-40945\n\nCVE-2025-21638\n\nCVE-2025-21639\n\nCVE-2025-21640\n\nCVE-2025-21648\n\nCVE-2025-21653\n\nCVE-2025-21664\n\nCVE-2025-21666\n\nCVE-2025-21669\n\nCVE-2025-21678\n\nCVE-2025-21683\n\nCVE-2025-21692\n\nCVE-2025-21694\n\nCVE-2024-26982\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-57981\n\nCVE-2024-57986\n\nCVE-2024-58005\n\nCVE-2024-58009\n\nCVE-2024-58014\n\nCVE-2024-58017\n\nCVE-2024-58020\n\nCVE-2024-58058\n\nCVE-2024-58063\n\nCVE-2024-58071\n\nCVE-2024-58072\n\nCVE-2025-21647\n\nCVE-2025-21704\n\nCVE-2025-21711\n\nCVE-2025-21719\n\nCVE-2025-21726\n\nCVE-2025-21727\n\nCVE-2025-21728\n\nCVE-2025-21735\n\nCVE-2025-21744\n\nCVE-2025-21745\n\nCVE-2025-21753\n\nCVE-2025-21756\n\nCVE-2025-21760\n\nCVE-2025-21761\n\nCVE-2025-21762\n\nCVE-2025-21763\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21772\n\nCVE-2025-21776\n\nCVE-2025-21787\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21806\n\nCVE-2025-21814\n\nCVE-2025-21826\n\nCVE-2025-21835\n\nCVE-2025-21844\n\nCVE-2025-21846\n\nCVE-2025-21858\n\nCVE-2025-21859\n\nCVE-2025-21862\n\nCVE-2025-21865\n\nCVE-2025-68160\n\nCVE-2025-69418\n\nCVE-2025-69419\n\nCVE-2025-69420\n\nCVE-2025-69421\n\nCVE-2026-22795\n\nCVE-2026-22796\n\nCVE-2026-28387\n\nCVE-2026-28388\n\nCVE-2026-28389\n\nCVE-2026-28390\n\nCVE-2026-31431\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly build and run applications from trusted sources.\n\nLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-1500 TM MFP is a Technology module Multi functional platform for SIMATIC S7-1500 PLCs based on SIMATIC Industrial OS\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2021-4090\n\nAn out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2021-38202\n\nfs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2021-47002\n\nSUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free().\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2021-47107\n\nNFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request.\n\nCVSS v3.1 Base Score\n6.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2021-47316\n\nnfsd: NULL dereference in nfs3svc_encode_getaclres.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2022-38096\n\nA NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).\n\nCVSS v3.1 Base Score\n6.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2022-43945\n\nThe Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-131: Incorrect Calculation of Buffer Size\n\nVulnerability CVE-2022-48827\n\nNFSD: vulnerability caused by loff_t overflow on the server when a client reads near the maximum offset, causing the server to return an EINVAL error, which the client retries indefinitely, instead of handling out-of-range READ requests by returning a short result with an EOF flag.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2022-48828\n\nNFSD: Vulnerability caused by an underflow in ia_size due to a mismatch between signed and unsigned 64-bit file size values, which can cause issues when handling large file sizes from NFS clients.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2022-48829\n\nNFSD: Vulnerability handling large file sizes for NFSv3 improperly capping client size values larger than s64_max, leading to unexpected behavior and potential data corruption.\n\nCVSS v3.1 Base Score\n7.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\n\nCWE\nCWE-253: Incorrect Check of Function Return Value\n\nVulnerability CVE-2023-1652\n\nA use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem.\n\nCVSS v3.1 Base Score\n6.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2023-5678\n\nIssue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the \"-pubcheck\" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-606: Unchecked Input for Loop Condition\n\nVulnerability CVE-2023-6121\n\nAn out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2023-6129\n\nThe POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions.\n\nIf an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions.\n\nThe consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However\nwe are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2023-6237\n\nChecking excessively long invalid RSA public keys may take a long time. Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time. An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the '-pubin' and '-check' options on untrusted data. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.\n\nCVSS v3.1 Base Score\n5.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-400: Uncontrolled Resource Consumption\n\nVulnerability CVE-2023-6817\n\nA use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\nThe function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.\n\nWe recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2023-6931\n\nA heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.\n\nA perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().\n\nWe recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2023-6932\n\nA use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.\n\nA race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.\n\nWe recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2023-28746\n\nInformation exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n\nCWE\nCWE-1342: Information Exposure through Microarchitectural State after Transient Execution\n\nVulnerability CVE-2023-45898\n\nThe Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2023-47233\n\nThe brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this \"could be exploited in a real world scenario.\" This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2023-50781\n\nA flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\n", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2023-5678", "CVE-2024-0727", "CVE-2023-6121", "CVE-2023-45898", "CVE-2023-6932", "CVE-2023-6931", "CVE-2023-6817", "CVE-2024-2511", "CVE-2024-5535", "CVE-2024-9143", "CVE-2024-36484", "CVE-2024-36902", "CVE-2024-36904", "CVE-2024-36905", "CVE-2024-36916", "CVE-2024-36929", "CVE-2024-36939", "CVE-2024-36940", "CVE-2024-36959", "CVE-2024-44987", "CVE-2024-44989", "CVE-2024-44990", "CVE-2024-45016", "CVE-2024-45018", "CVE-2024-46679", "CVE-2024-46743", "CVE-2024-46744", "CVE-2024-46745", "CVE-2024-46750", "CVE-2024-46759", "CVE-2024-46783", "CVE-2024-47660", "CVE-2024-50299", "CVE-2024-50301", "CVE-2024-53101", "CVE-2024-50302", "CVE-2023-52447", "CVE-2024-22099", "CVE-2024-26651", "CVE-2024-26659", "CVE-2024-26787", "CVE-2024-26816", "CVE-2024-26820", "CVE-2024-26851", "CVE-2024-26852", "CVE-2024-26855", "CVE-2024-26859", "CVE-2024-26861", "CVE-2024-26863", "CVE-2024-26870", "CVE-2024-26872", "CVE-2024-26875", "CVE-2024-26877", "CVE-2024-26878", "CVE-2024-26880", "CVE-2024-26882", "CVE-2024-26883", "CVE-2024-26884", "CVE-2024-26889", "CVE-2024-26891", "CVE-2024-26894", "CVE-2024-26895", "CVE-2024-26897", "CVE-2024-26898", "CVE-2024-26901", "CVE-2024-26903", "CVE-2024-26906", "CVE-2024-26907", "CVE-2024-27024", "CVE-2024-27025", "CVE-2024-27038", "CVE-2024-27047", "CVE-2024-27052", "CVE-2024-27053", "CVE-2024-27065", "CVE-2024-27076", "CVE-2024-27077", "CVE-2024-27078", "CVE-2024-27419", "CVE-2024-27431", "CVE-2024-27436", "CVE-2024-35828", "CVE-2024-35845", "CVE-2024-35902", "CVE-2024-40961", "CVE-2022-48829", "CVE-2024-40934", "CVE-2024-36286", "CVE-2021-47107", "CVE-2024-38619", "CVE-2024-33847", "CVE-2024-39509", "CVE-2022-48827", "CVE-2024-40941", "CVE-2024-38596", "CVE-2024-38599", "CVE-2024-38565", "CVE-2024-42093", "CVE-2024-42097", "CVE-2024-39502", "CVE-2024-40995", "CVE-2024-40942", "CVE-2024-40960", "CVE-2024-38598", "CVE-2024-41004", "CVE-2024-26629", "CVE-2024-41006", "CVE-2024-36489", "CVE-2024-41005", "CVE-2024-39468", "CVE-2024-40984", "CVE-2024-38567", "CVE-2024-39489", "CVE-2024-38662", "CVE-2021-47316", "CVE-2024-39482", "CVE-2024-38552", "CVE-2024-42094", "CVE-2024-40958", "CVE-2024-38780", "CVE-2024-36894", "CVE-2024-40912", "CVE-2024-40905", "CVE-2024-36974", "CVE-2024-40971", "CVE-2021-47002", "CVE-2024-38558", "CVE-2024-38659", "CVE-2024-36270", "CVE-2024-38612", "CVE-2024-41000", "CVE-2024-42070", "CVE-2024-38547", "CVE-2024-38578", "CVE-2024-42090", "CVE-2024-42082", "CVE-2024-37356", "CVE-2024-33621", "CVE-2024-38615", "CVE-2024-38381", "CVE-2024-42096", "CVE-2024-40959", "CVE-2024-38589", "CVE-2024-38579", "CVE-2024-38560", "CVE-2024-34027", "CVE-2022-48828", "CVE-2024-40978", "CVE-2024-40993", "CVE-2024-40980", "CVE-2024-39503", "CVE-2024-38635", "CVE-2024-36978", "CVE-2021-4090", "CVE-2024-23848", "CVE-2024-50121", "CVE-2023-1652", "CVE-2024-42272", "CVE-2024-36288", "CVE-2021-38202", "CVE-2024-49977", "CVE-2022-43945", "CVE-2024-38559", "CVE-2024-50251", "CVE-2024-50262", "CVE-2024-53042", "CVE-2024-53057", "CVE-2024-53059", "CVE-2024-26885", "CVE-2024-27072", "CVE-2024-35965", "CVE-2024-41016", "CVE-2024-46854", "CVE-2024-46865", "CVE-2024-47684", "CVE-2024-47685", "CVE-2024-47692", "CVE-2024-47696", "CVE-2024-47697", "CVE-2024-47699", "CVE-2024-47701", "CVE-2024-47705", "CVE-2024-47706", "CVE-2024-47709", "CVE-2024-47710", "CVE-2024-47713", "CVE-2024-47718", "CVE-2024-47723", "CVE-2024-47735", "CVE-2024-47737", "CVE-2024-47747", "CVE-2024-49851", "CVE-2024-49889", "CVE-2024-49890", "CVE-2024-49892", "CVE-2024-49894", "CVE-2024-49900", "CVE-2024-49902", "CVE-2024-49903", "CVE-2024-49930", "CVE-2024-49938", "CVE-2024-49944", "CVE-2024-49948", "CVE-2024-49949", "CVE-2024-49952", "CVE-2024-49955", "CVE-2024-49973", "CVE-2024-49997", "CVE-2024-50001", "CVE-2024-50006", "CVE-2024-50008", "CVE-2024-50010", "CVE-2024-50015", "CVE-2024-50033", "CVE-2024-50035", "CVE-2024-50039", "CVE-2024-50040", "CVE-2024-50044", "CVE-2024-50045", "CVE-2024-50046", "CVE-2024-50058", "CVE-2024-50095", "CVE-2024-50127", "CVE-2024-50131", "CVE-2024-50134", "CVE-2024-50142", "CVE-2024-50148", "CVE-2024-50150", "CVE-2024-50151", "CVE-2024-50153", "CVE-2024-50188", "CVE-2024-50205", "CVE-2024-50210", "CVE-2022-38096", "CVE-2023-28746", "CVE-2023-47233", "CVE-2023-52458", "CVE-2023-52614", "CVE-2023-52620", "CVE-2024-23307", "CVE-2024-24857", "CVE-2024-24858", "CVE-2024-24859", "CVE-2024-25739", "CVE-2024-26642", "CVE-2024-26643", "CVE-2024-26810", "CVE-2024-26812", "CVE-2024-26920", "CVE-2024-26923", "CVE-2024-26925", "CVE-2024-26934", "CVE-2024-26935", "CVE-2024-26937", "CVE-2024-26950", "CVE-2024-26951", "CVE-2024-26958", "CVE-2024-26960", "CVE-2024-26961", "CVE-2024-26973", "CVE-2024-26974", "CVE-2024-26988", "CVE-2024-26993", "CVE-2024-27004", "CVE-2024-27013", "CVE-2024-27020", "CVE-2024-27059", "CVE-2024-27395", "CVE-2024-27396", "CVE-2024-27397", "CVE-2024-27437", "CVE-2024-35789", "CVE-2024-35805", "CVE-2024-35807", "CVE-2024-35811", "CVE-2024-35813", "CVE-2024-35815", "CVE-2024-35823", "CVE-2024-35849", "CVE-2024-35877", "CVE-2024-35884", "CVE-2024-35886", "CVE-2024-35888", "CVE-2024-35893", "CVE-2024-35895", "CVE-2024-35896", "CVE-2024-35897", "CVE-2024-35898", "CVE-2024-35899", "CVE-2024-35900", "CVE-2024-35905", "CVE-2024-35910", "CVE-2024-35915", "CVE-2024-35922", "CVE-2024-35925", "CVE-2024-35930", "CVE-2024-35933", "CVE-2024-35934", "CVE-2024-35935", "CVE-2024-35936", "CVE-2024-35940", "CVE-2024-35944", "CVE-2024-35950", "CVE-2024-35955", "CVE-2024-35958", "CVE-2024-35960", "CVE-2024-35962", "CVE-2024-35966", "CVE-2024-35967", "CVE-2024-35969", "CVE-2024-35973", "CVE-2024-35976", "CVE-2024-35978", "CVE-2024-35982", "CVE-2024-35983", "CVE-2024-35984", "CVE-2024-35988", "CVE-2024-35990", "CVE-2024-35996", "CVE-2024-35997", "CVE-2024-36004", "CVE-2024-36005", "CVE-2024-36006", "CVE-2024-36007", "CVE-2024-36008", "CVE-2024-36020", "CVE-2024-36899", "CVE-2024-38587", "CVE-2024-39493", "CVE-2024-40916", "CVE-2024-42114", "CVE-2024-42259", "CVE-2024-42265", "CVE-2024-42276", "CVE-2024-42281", "CVE-2024-42283", "CVE-2024-42292", "CVE-2024-42302", "CVE-2024-42304", "CVE-2024-42305", "CVE-2024-42306", "CVE-2024-42312", "CVE-2024-43828", "CVE-2024-43830", "CVE-2024-43834", "CVE-2024-43856", "CVE-2024-43858", "CVE-2024-43871", "CVE-2024-43879", "CVE-2024-43882", "CVE-2024-43889", "CVE-2024-43890", "CVE-2024-43893", "CVE-2024-44935", "CVE-2024-44944", "CVE-2024-44948", "CVE-2024-44960", "CVE-2024-47707", "CVE-2024-53124", "CVE-2024-56631", "CVE-2024-56672", "CVE-2024-57901", "CVE-2024-57902", "CVE-2024-57913", "CVE-2024-57929", "CVE-2024-57940", "CVE-2024-57948", "CVE-2024-57951", "CVE-2024-58016", "CVE-2024-58051", "CVE-2024-58085", "CVE-2024-41996", "CVE-2023-6237", "CVE-2023-6129", "CVE-2025-9230", "CVE-2023-50781", "CVE-2025-3198", "CVE-2025-5244", "CVE-2025-5245", "CVE-2025-7425", "CVE-2025-7545", "CVE-2025-7546", "CVE-2025-8224", "CVE-2024-40945", "CVE-2025-21638", "CVE-2025-21639", "CVE-2025-21640", "CVE-2025-21648", "CVE-2025-21653", "CVE-2025-21664", "CVE-2025-21666", "CVE-2025-21669", "CVE-2025-21678", "CVE-2025-21683", "CVE-2025-21692", "CVE-2025-21694", "CVE-2024-26982", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-57981", "CVE-2024-57986", "CVE-2024-58005", "CVE-2024-58009", "CVE-2024-58014", "CVE-2024-58017", "CVE-2024-58020", "CVE-2024-58058", "CVE-2024-58063", "CVE-2024-58071", "CVE-2024-58072", "CVE-2025-21647", "CVE-2025-21704", "CVE-2025-21711", "CVE-2025-21719", "CVE-2025-21726", "CVE-2025-21727", "CVE-2025-21728", "CVE-2025-21735", "CVE-2025-21744", "CVE-2025-21745", "CVE-2025-21753", "CVE-2025-21756", "CVE-2025-21760", "CVE-2025-21761", "CVE-2025-21762", "CVE-2025-21763", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21772", "CVE-2025-21776", "CVE-2025-21787", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21806", "CVE-2025-21814", "CVE-2025-21826", "CVE-2025-21835", "CVE-2025-21844", "CVE-2025-21846", "CVE-2025-21858", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21865", "CVE-2025-68160", "CVE-2025-69418", "CVE-2025-69419", "CVE-2025-69420", "CVE-2025-69421", "CVE-2026-22795", "CVE-2026-22796", "CVE-2026-28387", "CVE-2026-28388", "CVE-2026-28389", "CVE-2026-28390", "CVE-2026-31431", "CVE-2023-3817", "CVE-2024-0584", "CVE-2024-47672" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "sourcePath": "body:advisory", "text": "SSA-267056\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-267056: Multiple Vulnerabilities in LOGO! 8 BM Devices\n\nPublication Date:\n\n2025-11-11\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.1\n\nCVSS v3.1 Base Score:\n7.6\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nLOGO! 8 BM (incl. SIPLUS variants) contains multiple vulnerabilities. These could allow an attacker to execute code remotely, put the device into a denial of service state, or change the behavior of the device.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nLOGO! V8.4 BM\n\nShow more details\n\nLOGO! 12/24RCE (6ED1052-1MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 12/24RCEo (6ED1052-2MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 24CE (6ED1052-1CC08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 24CEo (6ED1052-2CC08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 24RCE (6ED1052-1HB08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 24RCEo (6ED1052-2HB08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 230RCE (6ED1052-1FB08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 230RCEo (6ED1052-2FB08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIPLUS LOGO! V8.4 BM\n\nShow more details\n\nSIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nSIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nSIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nSIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nSIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nSIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nSIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nSIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2025-40815\n\nProtect the LSC access to the device with a strong password.\n\nCVE-2025-40816\n\nRestrict network access to port 10006/udp to trusted IP addresses.\n\nCVE-2025-40817\n\nRestrict network access to port 10006/udp to trusted IP addresses.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSiemens LOGO! BM (Base Module) devices are used for basic small-scale automation tasks.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-40815\n\nAffected devices do not properly validate the structure of TCP packets in several methods. This could allow an attacker to cause buffer overflows, get control over the instruction counter and run custom code.\n\nCVSS v3.1 Base Score\n7.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.6\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\n\nVulnerability CVE-2025-40816\n\nAffected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable.\n\nCVSS v3.1 Base Score\n7.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n\nCVSS v4.0 Base Score\n7.2\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-306: Missing Authentication for Critical Function\n\nVulnerability CVE-2025-40817\n\nAffected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to change time of the device, which means the device could behave differently.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n\nCVSS v4.0 Base Score\n7.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-306: Missing Authentication for Critical Function\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nSecurity Research Team - Thales Cybersecurity Services Australia for reporting the vulnerabilities\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2025-11-11):\n\nPublication Date\n\nV1.1 (2026-10-13):\n\nAdded fix for SIPLUS LOGO! V8.4 BM and LOGO! V8.4 BM families\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-267056\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2025-40815", "CVE-2025-40816", "CVE-2025-40817" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourcePath": "body:advisory", "text": "SSA-282044\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery\n\nPublication Date:\n\n2025-08-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.0\n\nCVSS v3.1 Base Score:\n7.8\n\nCVSS v4.0 Base Score:\n8.5\n\nSUMMARY\n\nThe installers used to install several Siemens products are affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected installer component. This vulnerability poses a risk only during setup and installation phase of the affected applications downloaded e.g. via OSD (Online Software Delivery).\n\nSiemens has released new versions for several affected products and recommends using the latest versions during setup and installation. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nAutomation License Manager\n\nShow more details\n\nAutomation License Manager V6.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAutomation License Manager V6.2\n\nAll versions < V6.2 Upd3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.2 Upd3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/114358/\n\nSee further recommendations from section\nMitigations\n\nCEMAT V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nCP PtP Param configuring interface\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nCreate MyConfig (CMC)\n\nAll versions < V6.9\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109955311/\n\nSee further recommendations from section\nMitigations\n\nEnergy Support Library (EnSL)\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nFM Configuration Package\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nModular PID CTRL Tool\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nMultiFieldbus Configuration Tool (MFCT)\n\nAll versions < V1.5.5.0\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V1.5.5.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109773881/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nOpenPCS 7\n\nShow more details\n\nOpenPCS 7 V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nOpenPCS 7 V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSiemens Network Planner (SINETPLAN)\n\nAll versions < V2.0 SP2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.0 SP2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110002597/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Automation Tool\n\nAll versions < V5.0 SP4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V5.0 SP4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110004631/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Automation Tool SDK Windows\n\nAll versions < V5.0 SP4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V5.0 SP4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110004631/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC BATCH\n\nShow more details\n\nSIMATIC BATCH V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC BATCH V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC eaSie Document Skills\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC eaSie Workflow Skills\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC Logon\n\nShow more details\n\nSIMATIC Logon V1.6\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Logon V2.0\n\nAll versions < V2.0 Upd3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.0 Upd3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109983445/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Management Agent\n\nAll versions < V9.1 SP1 Upd8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP1 Upd8 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Management Console\n\nAll versions < V9.1 SP1 Upd8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP1 Upd8 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC NET PC Software\n\nShow more details\n\nSIMATIC NET PC Software V16\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC NET PC Software V17\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC NET PC Software V18\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC NET PC Software V19\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC NET PC Software V20\n\nAll versions < V20.0 Update 1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V20.0 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987675/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ODK 1500S\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7\n\nShow more details\n\nSIMATIC PCS 7 V9.1\n\nAll versions < V9.1 SP1 UC08\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP1 UC08 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 V10.0\n\nAll versions < V10.0 SP1 UC01\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V10.0 SP1 UC01 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109983445/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Advanced Process Faceplates V9.1\n\nAll versions < V9.1 SP2 Upd4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP2 Upd4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7 Advanced Process Functions\n\nShow more details\n\nSIMATIC PCS 7 Advanced Process Functions V2.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Advanced Process Functions V2.2\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7 Advanced Process Graphics\n\nShow more details\n\nSIMATIC PCS 7 Advanced Process Graphics V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Advanced Process Graphics V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Advanced Process Library incl. Faceplates V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Advanced Process Library V9.1\n\nAll versions < V9.1 SP2 Upd6\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP2 Upd6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Basis Faceplates V9.1\n\nAll versions < V9.1 SP2 Upd2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP2 Upd2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7 Basis Library\n\nShow more details\n\nSIMATIC PCS 7 Basis Library V9.1\n\nAll versions < V9.1 SP2 Upd8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP2 Upd8 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Basis Library V10.0\n\nAll versions < V10.0 SP1 Upd2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V10.0 SP1 Upd2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109983445/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7 Industry Library\n\nShow more details\n\nSIMATIC PCS 7 Industry Library V9.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Industry Library V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Industry Library V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7 Logic Matrix\n\nShow more details\n\nSIMATIC PCS 7 Logic Matrix V9.1\n\nAll versions < V9.1 Upd8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 Upd8 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Logic Matrix V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 MPC Configurator\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 PowerControl V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7 Standard Chemical Library\n\nShow more details\n\nSIMATIC PCS 7 Standard Chemical Library V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Standard Chemical Library V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 TeleControl V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7/OPEN OS V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS neo\n\nShow more details\n\nSIMATIC PCS neo V5.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V6.0\n\nAll versions < V6.0 SP1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.0 SP1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109991149/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PDM\n\nShow more details\n\nSIMATIC PDM V9.2\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PDM V9.3\n\nAll versions < V9.3 SP1 Upd2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.3 SP1 Upd2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109983445/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PDM Maintenance Station V5.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Process Function Library (PFL) V4.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC Process Historian\n\nShow more details\n\nSIMATIC Process Historian 2020\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Process Historian 2022\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Process Historian 2024\n\nAll versions < V2024 SP1 Upd2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2024 SP1 Upd2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109983445/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC ProSave\n\nShow more details\n\nSIMATIC ProSave V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ProSave V18\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ProSave V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V19 Update 4 or later version\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ProSave V20\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC Route Control\n\nShow more details\n\nSIMATIC Route Control V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Route Control V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7 F Systems\n\nShow more details\n\nSIMATIC S7 F Systems V6.3\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7 F Systems V6.4\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 Software Controller\n\nShow more details\n\nSIMATIC S7-1500 Software Controller V2\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 Software Controller V3\n\nAll versions < V31.1.5\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V31.1.5 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478528/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-Fail-safe Configuration Tool (S7-FCT)\n\nAll versions < V4.0.1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V4.0.1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109762827/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PCT\n\nAll versions < V3.5 SP4 Update 1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V3.5 SP4 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/32469496/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-PLCSIM\n\nShow more details\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PLCSIM V18\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PLCSIM V19\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PLCSIM V20\n\nAll versions < V20 Update 1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V20 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109963851/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PLCSIM Advanced\n\nAll versions < V7.0 Update 1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V7.0 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109988436/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Safety Matrix V6.3\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC STEP 7 CFC\n\nShow more details\n\nSIMATIC STEP 7 CFC V19\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC STEP 7 CFC V20\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC STEP 7 V5.7\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Target\n\nAll versions < V6.0 SP3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.0 SP3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109997133/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC WinCC\n\nShow more details\n\nSIMATIC WinCC V7.5\n\nAll versions < V7.5 SP2 Update 20\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V7.5 SP2 Update 20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109793460/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V8.0 Update 8 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V8.1\n\nAll versions < V8.1 Update 3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V8.1 Update 3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109977191/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC flexible ES\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Runtime Advanced\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109800912/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Runtime Professional\n\nAll versions < V21\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V21 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109991139/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Runtime Professional V20\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC TeleControl\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Unified Line Coordination\n\nAll versions < V20\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987448/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Unified Sequence\n\nAll versions < V20\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987448/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC D7-SYS\n\nAll versions < V10.0 SP1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V10.0 SP1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110003221/\n\nSee further recommendations from section\nMitigations\n\nSIMIT Rapid Tester\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMIT Simulation Platform\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINEC NMS\n\nAll versions < V4.0\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V4.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989514/\n\nSee further recommendations from section\nMitigations\n\nSINEMA Remote Connect Client\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSITRANS\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nStandard PID CTRL Tool\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTeleControl Server Basic V3.1\n\nAll versions < V3.1.2.2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V3.1.2.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987362/\n\nSee further recommendations from section\nMitigations\n\nTIA Administrator\n\nAll versions < V3.0.6\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V3.0.6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109825038/\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud Connector\n\nAll versions < V2.3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109780755/\n\nSee further recommendations from section\nMitigations\n\nTIA Project-Server\n\nAll versions < V2.2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109810588/\n\nSee further recommendations from section\nMitigations\n\nTIA Project-Server V17\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V17\n\nShow more details\n\nTotally Integrated Automation Portal (TIA Portal) V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Control Function Library (CFL) V1.x\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Energy Suite V17\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MTP CREATOR V2.x\n\nAll versions < V2.1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109982993/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Visualization Architect (SiVArc) V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109792356/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Test Suite V17\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommen", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2025-30033" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourcePath": "body:advisory", "text": "SSA-333035\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n8.2\n\nCVSS v4.0 Base Score:\n8.8\n\nSUMMARY\n\nThe products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nAPOGEE MBC (PPC) (BACnet)\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102074\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE MBC (PPC) (P2 Ethernet)\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE MEC (PPC) (BACnet)\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE MEC (PPC) (P2 Ethernet)\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE PXC Compact (BACnet)\n\nAll versions < V3.5.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nUpdate to V3.5.7 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nAPOGEE PXC Compact (P2 Ethernet)\n\nAll versions < V2.8.21\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nUpdate to V2.8.21 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nAPOGEE PXC Modular (BACnet)\n\nAll versions < V3.5.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nUpdate to V3.5.7 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nAPOGEE PXC Modular (P2 Ethernet)\n\nAll versions < V2.8.21\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nUpdate to V2.8.21 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC00-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC00-U\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC001-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC12-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC22-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC22.1-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC36.1-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC50-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC64-U\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC100-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC128-U\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC200-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXM20-E\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nTALON TC Compact (BACnet)\n\nAll versions < V3.5.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nUpdate to V3.5.7 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nTALON TC Modular (BACnet)\n\nAll versions < V3.5.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nUpdate to V3.5.7 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2026-102073\n\nDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)\n\nCVE-2026-102074\n\nDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)\n\nCVE-2026-102075\n\nDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)\n\nCVE-2026-102076\n\nDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)\n\nCVE-2026-89208\n\nApply network segmentation and put the controllers behind properly configured gateways/firewalls.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.\n\nPRODUCT DESCRIPTION\n\nAPOGEE MEC (Modular Equipement Controller), MBC (Modular Building Controller), and PXC devices are Direct Digital Control (DDC) devices and an integral part of the APOGEE Automation System. These are legacy devices, replaced by the APOGEE PXC Modular and Compact Series.\n\nAPOGEE PXC Modular and Compact Series devices are high-performance Direct Digital Control (DDC) devices and an integral part of the APOGEE Automation System.\n\nDesigo PXC00-E.D: System controller BACnet/IP. Article No: BPZ:PXC00-E.D\n\nDesigo PXC00/64/128-U are automation stations with P-bus and PPS2 connections.\n\nDesigo PXC001-E.D: System controller for the integration of KNX, M-Bus, Modbus or SCL over BACnet/IP. Article No: S55372-C114\n\nDesigo PXC100-E.D: Automation station BACnet/IP, with up to 200 data points. Article No: BPZ:PXC100-E.D\n\nDesigo PXC12-E.D: Automation station with 12 data points and BACnet on IP. Article No: BPZ:PXC12-E.D\n\nDesigo PXC200-E.D: Automation station BACnet/IP, with more than 200 data points. Article No: BPZ:PXC200-E.D\n\nDesigo PXC22-E.D: Automation station with 22 data points and BACnet on IP. Article No: BPZ:PXC22-E.D\n\nDesigo PXC22.1-E.D: Automation station with 22 data points, extendable and BACnet on IP. Article No: S55372-C119\n\nDesigo PXC36.1-E.D: Automation station with 36 data points, extendable and BACnet on IP. Article No: S55372-C121\n\nDesigo PXC50-E.D: Automation station BACnet/IP, with up to 80 data points. Article No: S55372-C110\n\nDesigo PXM20-E: Operator unit with BACnet on IP. Article No: BPZ:PXM20-E\n\nTALON TC Modular and Compact Series devices are high-performance Direct Digital Control (DDC) devices and an integral part of the TALON Automation System.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-89208\n\nThe affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n\nCVSS v4.0 Base Score\n6.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2026-102073\n\nThe affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.\n\nCVSS v3.1 Base Score\n8.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L\n\nCVSS v4.0 Base Score\n8.8\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N\n\nCWE\nCWE-191: Integer Underflow (Wrap or Wraparound)\n\nVulnerability CVE-2026-102074\n\nThe affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2026-102075\n\nThe affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2026-102076\n\nThe affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nStanislav Dashevskyi and Francesco La Spina from Forescout Technologies Inc. for coordinated disclosure\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-333035\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-102075", "CVE-2026-102076", "CVE-2026-102074", "CVE-2026-102073", "CVE-2026-89208" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "sourcePath": "body:advisory", "text": "SSA-377139\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.1\n\nCVSS v4.0 Base Score:\n8.9\n\nSUMMARY\n\nUsers of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information).\n\nIndustrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge Device Kit - arm64 V1.5\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.6\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.7\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.8\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.9\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.10\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.11\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.12\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.13\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.14\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.15\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.16\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.17\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.18\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.19\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.20\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.21\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.22\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.23\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.24\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.25\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.26\n\nAll versions < V1.26.2-1\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.26.2-1 or later version\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.27\n\nAll versions < V1.27.1-1\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.27.1-1 or later version\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.28\n\nAll versions < V1.28.0-6\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.28.0-6 or later version\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.5\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.6\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.7\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.8\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.9\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.10\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.11\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.12\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.13\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.14\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.15\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.16\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.17\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.18\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.19\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.20\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.21\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.22\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.23\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.24\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.25\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.26\n\nAll versions < V1.26.2-1\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.26.2-1 or later version\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.27\n\nAll versions < V1.27.1-1\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.27.1-1 or later version\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.28\n\nAll versions < V1.28.0-6\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.28.0-6 or later version\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nEnsure network access to affected products is limited to trusted parties only\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nThe Industrial Edge Device Kit allows Industrial Edge Device Builders to extend the Industrial Edge Ecosystem with their devices. It provides the components needed on the device, as well as the necessary interfaces in the Industrial Edge Management and Industrial Edge Hub to customize the device management processes according to their needs.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-44414\n\nAffected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system.\n\nCVSS v3.1 Base Score\n6.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\n\nCVSS v4.0 Base Score\n6.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N\n\nCWE\nCWE-35: Path Traversal: '.../...//'\n\nVulnerability CVE-2026-44415\n\nAffected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.\n\nCVSS v3.1 Base Score\n9.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n\nCWE\nCWE-35: Path Traversal: '.../...//'\n\nADDITIONAL INFORMATION\n\nDownstream information about Industrial Edge Devices built on an affected device kit:\n\nFor devices built by Siemens: https://cert-portal.siemens.com/productcert/html/ssa-832641.html\n\nIndustrial Edge Device Kit version lines that are not maintained anymore can be updated to newer version lines that either have received an update or were released including the fix already.\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-377139\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-44414", "CVE-2026-44415" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "sourcePath": "body:advisory", "text": "SSA-390352\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-390352: Multiple Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n7.5\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\n.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory.\n\nSiemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nShow more details\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nAll versions < V3.3.61\n\naffected by\n\nCVE-2026-85114\n\nUpdate to V3.3.61 or later version\n\nhttps://github.com/siemens/simatic-s7-webserver-api/releases/tag/v3.3.61\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nAll versions < V3.3.62\n\naffected by\n\nCVE-2026-85115\n\nUpdate to V3.3.62 or later version\n\nhttps://github.com/siemens/simatic-s7-webserver-api/releases/tag/v3.3.62\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-85114\n\nAffected applications do not properly validate filenames received from remote servers during ticket downloads.\n\nThis could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\n\nVulnerability CVE-2026-85115\n\nAffected applications do not properly redact PLC restore passwords from HTTP error exception messages.\n\nThis could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\n\nCVSS v4.0 Base Score\n6.8\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-209: Generation of Error Message Containing Sensitive Information\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-390352\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-85114", "CVE-2026-85115" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourcePath": "body:advisory", "text": "SSA-392859\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20\n\nPublication Date:\n\n2024-12-10\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n7.3\n\nCVSS v4.0 Base Score:\n7.0\n\nSUMMARY\n\nAffected products contain a local arbitrary code execution vulnerability that could allow an attacker to perform actions against the operation system of that environment.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.\n\nSiemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-52051. See the chapter \"Additional Information\" below for more details.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-PLCSIM\n\nShow more details\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is planned\n\nSIMATIC S7-PLCSIM V18\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is planned\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V17\n\nShow more details\n\nSIMATIC STEP 7 Safety V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSIMATIC STEP 7 V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSIMATIC WinCC Unified V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSIMATIC WinCC V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSIMOCODE ES V17\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIMOTION SCOUT TIA V5.4\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Safety ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Soft Starter ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nTIA Portal Cloud V17\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V18\n\nShow more details\n\nSIMATIC STEP 7 Safety V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSIMATIC STEP 7 V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSIMATIC WinCC Unified PC Runtime V18\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIMATIC WinCC Unified V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSIMATIC WinCC V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSIMOCODE ES V18\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIMOTION SCOUT TIA V5.5\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSINAMICS Startdrive V18\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Safety ES V18 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Soft Starter ES V18 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nTIA Portal Cloud V18\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V19\n\nShow more details\n\nSIMATIC STEP 7 Safety V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSIMATIC STEP 7 V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSIMATIC WinCC Unified PC Runtime V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSIMATIC WinCC Unified V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSIMATIC WinCC V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSIMOCODE ES V19\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIMOTION SCOUT TIA V5.6\n\nAll versions < V5.6 SP1 HF7\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V5.6 SP1 HF7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989067/\n\nSINAMICS Startdrive V19\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Safety ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Soft Starter ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2024-52051\n\nTIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMATIC STEP 7 Safety Basic / Advanced is the high-performance add-on package for programming of fail-safe S7 controllers for the Totally Integrated Automation Portal\n\nSIMATIC WinCC Unified PC Runtime is the new visualization runtime platform used for operator control and monitoring of machines and plants.\n\nSIMOCODE ES is the central software package for the configuration, commissioning, operation, and diagnosis of SIMOCODE pro.\r\nThe software is based on the Totally Integrated Automation Portal (TIA Portal) central engineering framework and can be seamlessly integrated if additional TIA Portal-based software such as STEP 7 and WinCC is present.\n\nSIMOTION SCOUT TIA is the add-in for TIA Portal for commissioning of SIMOTION devices.\n\nSINAMICS Startdrive commissioning software is the engineering tool for integration of SINAMICS drives in TIA Portal.\n\nSIRIUS Safety ES is the central software package for the configuration, commissioning, operation, and diagnosis of 3SK2 safety relays. The software is based on the Totally Integrated Automation Portal (TIA Portal) central engineering framework and can be seamlessly integrated if additional TIA Portal-based software such as STEP 7 and WinCC is present, thus providing the user with a consistent, efficient, and intuitive solution to all automation tasks. Those using SIRIUS Safety ES as standalone software will also enjoy its benefits.\n\nTIA Portal Cloud makes it possible to use the main packages as well as the main option packages of TIA Portal in a virtualized environment. Local projects can be transferred to the cloud and loaded back again via a file share service.\n\nTotally Integrated Automation Portal (TIA Portal) is a PC software that provides access to the complete range of Siemens digitalized automation services, from digital planning and integrated engineering to transparent operation.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-52051\n\nThe affected devices do not properly sanitize user-controllable input when parsing user settings. This could allow an attacker to locally execute arbitrary commands in the host operating system with the privileges of the user.\n\nCVSS v3.1 Base Score\n7.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCVSS v4.0 Base Score\n7.0\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-20: Improper Input Validation\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nPeter Cheng from Elex Feigong Research Institute for coordinated disclosure\n\nADDITIONAL INFORMATION\n\nProducts based on the Totally Integrated Automation Portal (TIA Portal) V20 [1] are not affected by CVE-2024-52051.\n\n[1] https://support.industry.siemens.com/cs/document/109963850\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2024-12-10):\n\nPublication Date\n\nV1.1 (2025-08-12):\n\nAdded fix for Totally Integrated Automation Portal (TIA Portal) V19; Name of SIMOTION SCOUT TIA V5.6 SP1 was updated to SIMOTION SCOUT TIA V5.6 and Name of SIMOTION SCOUT TIA V5.5 SP1 was updated to SIMOTION SCOUT TIA V5.5 and Name of SIMOTION SCOUT TIA V5.4 SP3 was updated to SIMOTION SCOUT TIA V5.4\n\nV1.2 (2025-12-09):\n\nAdded fix for Totally Integrated Automation Portal (TIA Portal) V17\n\nV1.3 (2026-10-13):\n\nAdded no fix expected for PLCSIM, SIMATIC STEP 7 Safety V18, SIMATIC STEP 7 V18, SIMATIC WinCC Unified V18, SIMATIC WinCC V18\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-392859\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-52051" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "sourcePath": "body:advisory", "text": "SSA-398330\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5\n\nPublication Date:\n\n2023-12-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.8\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.8\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nThese GNU/Linux vulnerabilities have been externally identified.\nSiemens has released new versions for the affected products and recommends to update to the latest versions.\n\nSIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 are no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 ( https://cert-portal.siemens.com/productcert/html/ssb-439005.html ).\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.0 < V3.1.5\n\naffected by\n\nall CVEs\n\nCVE-2023-45871\n\nCVE-2023-45853\n\nCVE-2023-45322\n\nCVE-2013-0340\n\nCVE-2013-4235\n\nCVE-2014-7209\n\nCVE-2015-20107\n\nCVE-2022-37454\n\nCVE-2022-43680\n\nCVE-2022-45061\n\nCVE-2019-19242\n\nCVE-2019-19244\n\nCVE-2019-19317\n\nCVE-2019-19603\n\nCVE-2019-19645\n\nCVE-2019-19646\n\nCVE-2019-19880\n\nCVE-2019-19923\n\nCVE-2019-19924\n\nCVE-2019-19925\n\nCVE-2019-19926\n\nCVE-2019-19959\n\nCVE-2019-20218\n\nCVE-2016-10228\n\nCVE-2020-10029\n\nCVE-2020-1752\n\nCVE-2020-6096\n\nCVE-2016-10739\n\nCVE-2019-6488\n\nCVE-2016-3189\n\nCVE-2019-12900\n\nCVE-2021-28363\n\nCVE-2021-45960\n\nCVE-2022-0778\n\nCVE-2022-25235\n\nCVE-2022-25236\n\nCVE-2022-25313\n\nCVE-2022-25314\n\nCVE-2022-25315\n\nCVE-2022-26488\n\nCVE-2016-3709\n\nCVE-2022-29824\n\nCVE-2016-4658\n\nCVE-2016-5131\n\nCVE-2016-9318\n\nCVE-2017-0663\n\nCVE-2017-9047\n\nCVE-2017-9048\n\nCVE-2017-9049\n\nCVE-2017-9050\n\nCVE-2017-16931\n\nCVE-2017-16932\n\nCVE-2017-17512\n\nCVE-2017-18258\n\nCVE-2017-7375\n\nCVE-2017-7376\n\nCVE-2018-0495\n\nCVE-2019-12904\n\nCVE-2019-13627\n\nCVE-2018-12886\n\nCVE-2018-14404\n\nCVE-2018-14567\n\nCVE-2018-19591\n\nCVE-2018-20482\n\nCVE-2018-20843\n\nCVE-2018-25032\n\nCVE-2019-1010022\n\nCVE-2019-1010023\n\nCVE-2019-1010024\n\nCVE-2019-1010025\n\nCVE-2019-1010180\n\nCVE-2019-10160\n\nCVE-2019-9636\n\nCVE-2019-9740\n\nCVE-2019-9947\n\nCVE-2019-9948\n\nCVE-2019-11360\n\nCVE-2019-12290\n\nCVE-2019-13057\n\nCVE-2019-13565\n\nCVE-2019-15847\n\nCVE-2019-15903\n\nCVE-2019-16056\n\nCVE-2019-16168\n\nCVE-2019-16905\n\nCVE-2019-17498\n\nCVE-2020-22218\n\nCVE-2019-17543\n\nCVE-2019-17594\n\nCVE-2019-17595\n\nCVE-2019-18224\n\nCVE-2019-18276\n\nCVE-2019-18348\n\nCVE-2020-8492\n\nCVE-2019-19126\n\nCVE-2020-1751\n\nCVE-2019-19906\n\nCVE-2019-19956\n\nCVE-2019-20367\n\nCVE-2019-20388\n\nCVE-2020-24977\n\nCVE-2020-7595\n\nCVE-2021-3516\n\nCVE-2021-3517\n\nCVE-2021-3518\n\nCVE-2021-3537\n\nCVE-2021-3541\n\nCVE-2019-20795\n\nCVE-2019-20907\n\nCVE-2020-14422\n\nCVE-2020-15523\n\nCVE-2020-15801\n\nCVE-2020-26116\n\nCVE-2019-25013\n\nCVE-2020-27618\n\nCVE-2020-29562\n\nCVE-2020-29573\n\nCVE-2021-27645\n\nCVE-2021-3326\n\nCVE-2019-3855\n\nCVE-2019-3856\n\nCVE-2019-3857\n\nCVE-2019-3858\n\nCVE-2019-3859\n\nCVE-2019-3860\n\nCVE-2019-3861\n\nCVE-2019-3862\n\nCVE-2019-3863\n\nCVE-2019-5018\n\nCVE-2019-8457\n\nCVE-2019-9936\n\nCVE-2019-9937\n\nCVE-2019-5094\n\nCVE-2019-5188\n\nCVE-2019-5435\n\nCVE-2019-5436\n\nCVE-2019-5443\n\nCVE-2019-5481\n\nCVE-2019-5482\n\nCVE-2020-19909\n\nCVE-2019-6109\n\nCVE-2019-6110\n\nCVE-2019-6111\n\nCVE-2019-7309\n\nCVE-2019-9169\n\nCVE-2019-9674\n\nCVE-2019-9923\n\nCVE-2020-10531\n\nCVE-2020-21913\n\nCVE-2020-10543\n\nCVE-2020-10878\n\nCVE-2020-12723\n\nCVE-2020-10735\n\nCVE-2021-28861\n\nCVE-2020-11501\n\nCVE-2020-11655\n\nCVE-2020-11656\n\nCVE-2020-13630\n\nCVE-2020-13631\n\nCVE-2020-13632\n\nCVE-2020-35525\n\nCVE-2020-35527\n\nCVE-2020-9327\n\nCVE-2020-12062\n\nCVE-2020-12243\n\nCVE-2020-12762\n\nCVE-2020-13434\n\nCVE-2020-13435\n\nCVE-2020-13529\n\nCVE-2023-26604\n\nCVE-2020-13776\n\nCVE-2020-13777\n\nCVE-2020-13871\n\nCVE-2020-15358\n\nCVE-2020-14145\n\nCVE-2021-28041\n\nCVE-2020-15778\n\nCVE-2020-1712\n\nCVE-2020-19185\n\nCVE-2020-19186\n\nCVE-2020-19187\n\nCVE-2020-19188\n\nCVE-2020-19189\n\nCVE-2020-19190\n\nCVE-2023-29491\n\nCVE-2020-21047\n\nCVE-2021-33294\n\nCVE-2020-24659\n\nCVE-2020-25692\n\nCVE-2020-25709\n\nCVE-2020-25710\n\nCVE-2020-28196\n\nCVE-2020-29361\n\nCVE-2020-29362\n\nCVE-2020-29363\n\nCVE-2020-36221\n\nCVE-2020-36222\n\nCVE-2020-36223\n\nCVE-2020-36224\n\nCVE-2020-36225\n\nCVE-2020-36226\n\nCVE-2020-36227\n\nCVE-2020-36228\n\nCVE-2020-36229\n\nCVE-2020-36230\n\nCVE-2020-8169\n\nCVE-2020-8177\n\nCVE-2020-8231\n\nCVE-2020-8284\n\nCVE-2020-8285\n\nCVE-2020-8286\n\nCVE-2020-8315\n\nCVE-2022-48560\n\nCVE-2021-20193\n\nCVE-2021-20227\n\nCVE-2021-20231\n\nCVE-2021-20232\n\nCVE-2021-20305\n\nCVE-2021-3580\n\nCVE-2021-22876\n\nCVE-2021-22890\n\nCVE-2021-22897\n\nCVE-2021-22898\n\nCVE-2021-22901\n\nCVE-2021-22922\n\nCVE-2021-22923\n\nCVE-2021-22924\n\nCVE-2021-22925\n\nCVE-2021-22926\n\nCVE-2021-22945\n\nCVE-2021-22946\n\nCVE-2021-22947\n\nCVE-2021-23336\n\nCVE-2021-3177\n\nCVE-2021-27212\n\nCVE-2021-27218\n\nCVE-2021-27219\n\nCVE-2021-28153\n\nCVE-2021-31239\n\nCVE-2021-32292\n\nCVE-2021-33560\n\nCVE-2021-33574\n\nCVE-2021-35942\n\nCVE-2021-33910\n\nCVE-2021-3426\n\nCVE-2021-3733\n\nCVE-2021-3737\n\nCVE-2021-4189\n\nCVE-2022-0391\n\nCVE-2021-3520\n\nCVE-2021-36084\n\nCVE-2021-36085\n\nCVE-2021-36086\n\nCVE-2021-36087\n\nCVE-2021-36222\n\nCVE-2021-36690\n\nCVE-2021-37600\n\nCVE-2021-37750\n\nCVE-2021-3826\n\nCVE-2021-46195\n\nCVE-2021-38604\n\nCVE-2021-3998\n\nCVE-2021-3999\n\nCVE-2021-43396\n\nCVE-2022-23218\n\nCVE-2022-23219\n\nCVE-2021-3997\n\nCVE-2021-4122\n\nCVE-2021-4209\n\nCVE-2021-43618\n\nCVE-2021-46143\n\nCVE-2022-22822\n\nCVE-2022-22823\n\nCVE-2022-22824\n\nCVE-2022-22825\n\nCVE-2022-22826\n\nCVE-2022-22827\n\nCVE-2021-46828\n\nCVE-2021-46848\n\nCVE-2022-0563\n\nCVE-2022-1271\n\nCVE-2022-1292\n\nCVE-2022-1343\n\nCVE-2022-1434\n\nCVE-2022-1473\n\nCVE-2022-1304\n\nCVE-2022-2068\n\nCVE-2022-2097\n\nCVE-2022-2274\n\nCVE-2022-22576\n\nCVE-2022-27774\n\nCVE-2022-27775\n\nCVE-2022-27776\n\nCVE-2022-23308\n\nCVE-2022-23852\n\nCVE-2022-23990\n\nCVE-2022-24407\n\nCVE-2022-2509\n\nCVE-2022-27778\n\nCVE-2022-27779\n\nCVE-2022-27780\n\nCVE-2022-27781\n\nCVE-2022-27782\n\nCVE-2022-30115\n\nCVE-2022-27943\n\nCVE-2022-28321\n\nCVE-2022-29155\n\nCVE-2022-32205\n\nCVE-2022-32206\n\nCVE-2022-32207\n\nCVE-2022-32208\n\nCVE-2022-32221\n\nCVE-2022-35260\n\nCVE-2022-42915\n\nCVE-2022-42916\n\nCVE-2022-35252\n\nCVE-2022-35737\n\nCVE-2022-3715\n\nCVE-2022-37434\n\nCVE-2022-3821\n\nCVE-2022-45873\n\nCVE-2022-40303\n\nCVE-2022-40304\n\nCVE-2022-40674\n\nCVE-2022-42898\n\nCVE-2022-4304\n\nCVE-2022-4450\n\nCVE-2023-0215\n\nCVE-2023-0286\n\nCVE-2022-43551\n\nCVE-2022-43552\n\nCVE-2022-46908\n\nCVE-2022-48303\n\nCVE-2022-48522\n\nCVE-2023-0464\n\nCVE-2023-24329\n\nCVE-2023-0361\n\nCVE-2023-0465\n\nCVE-2023-0466\n\nCVE-2023-2650\n\nCVE-2023-0687\n\nCVE-2023-25139\n\nCVE-2023-1077\n\nCVE-2023-1206\n\nCVE-2023-3212\n\nCVE-2023-34319\n\nCVE-2023-35001\n\nCVE-2023-3609\n\nCVE-2023-3611\n\nCVE-2023-3772\n\nCVE-2023-39189\n\nCVE-2023-39192\n\nCVE-2023-39193\n\nCVE-2023-39194\n\nCVE-2023-40283\n\nCVE-2023-42755\n\nCVE-2023-4623\n\nCVE-2023-4921\n\nCVE-2023-23914\n\nCVE-2023-23915\n\nCVE-2023-23916\n\nCVE-2023-29499\n\nCVE-2023-32611\n\nCVE-2023-32636\n\nCVE-2023-32643\n\nCVE-2023-32665\n\nCVE-2023-25136\n\nCVE-2023-27371\n\nCVE-2023-27533\n\nCVE-2023-27534\n\nCVE-2023-27535\n\nCVE-2023-27536\n\nCVE-2023-27537\n\nCVE-2023-27538\n\nCVE-2023-28484\n\nCVE-2023-29469\n\nCVE-2023-29383\n\nCVE-2023-2953\n\nCVE-2023-31085\n\nCVE-2023-42754\n\nCVE-2023-5717\n\nCVE-2023-3446\n\nCVE-2023-3817\n\nCVE-2023-34969\n\nCVE-2023-35945\n\nCVE-2023-38408\n\nCVE-2023-39128\n\nCVE-2023-39615\n\nCVE-2023-4016\n\nCVE-2023-4039\n\nCVE-2023-4813\n\nCVE-2023-5156\n\nCVE-2023-4807\n\nCVE-2023-5678\n\nCVE-2023-5981\n\nCVE-2021-44879\n\nCVE-2023-45898\n\nCVE-2023-46862\n\nCVE-2023-6121\n\nCVE-2023-6817\n\nCVE-2023-6931\n\nCVE-2023-6932\n\nCVE-2024-0584\n\nCVE-2023-45918\n\nCVE-2023-52425\n\nCVE-2023-52426\n\nCVE-2024-28757\n\nCVE-2024-2004\n\nCVE-2024-2379\n\nCVE-2024-2398\n\nCVE-2024-2466\n\nCVE-2024-2511\n\nCVE-2024-28182\n\nCVE-2024-28834\n\nCVE-2024-28835\n\nCVE-2024-34459\n\nCVE-2024-5535\n\nCVE-2024-5742\n\nCVE-2024-7264\n\nCVE-2024-6409\n\nCVE-2024-8096\n\nCVE-2024-9143\n\nCVE-2024-2236\n\nCVE-2024-50602\n\nCVE-2024-52533\n\nCVE-2024-11053\n\nCVE-2023-52444\n\nCVE-2023-52464\n\nCVE-2023-52612\n\nCVE-2023-52675\n\nCVE-2024-35809\n\nCVE-2024-35944\n\nCVE-2024-56433\n\nCVE-2024-26880\n\nCVE-2024-35807\n\nCVE-2024-26878\n\nCVE-2024-27074\n\nCVE-2023-52699\n\nCVE-2024-26898\n\nCVE-2024-26901\n\nCVE-2024-49982\n\nCVE-2024-38780\n\nCVE-2024-40959\n\nCVE-2024-33621\n\nCVE-2024-39292\n\nCVE-2024-39469\n\nCVE-2024-39489\n\nCVE-2024-40901\n\nCVE-2024-42070\n\nCVE-2024-26835\n\nCVE-2024-27065\n\nCVE-2024-38598\n\nCVE-2024-36286\n\nCVE-2024-38596\n\nCVE-2024-42096\n\nCVE-2024-38621\n\nCVE-2024-37356\n\nCVE-2024-38612\n\nCVE-2024-26973\n\nCVE-2024-35888\n\nCVE-2024-26957\n\nCVE-2024-35910\n\nCVE-2024-35925\n\nCVE-2024-26863\n\nCVE-2024-35830\n\nCVE-2017-15422\n\nCVE-2018-18928\n\nCVE-2023-52622\n\nCVE-2024-27020\n\nCVE-2024-27032\n\nCVE-2024-36017\n\nCVE-2024-36484\n\nCVE-2024-36904\n\nCVE-2024-26645\n\nCVE-2024-36905\n\nCVE-2024-26671\n\nCVE-2024-36934\n\nCVE-2024-26679\n\nCVE-2024-39487\n\nCVE-2024-26772\n\nCVE-2024-41046\n\nCVE-2024-26773\n\nCVE-2024-42106\n\nCVE-2024-26777\n\nCVE-2024-42131\n\nCVE-2024-26805\n\nCVE-2024-42154\n\nCVE-2024-26923\n\nCVE-2024-43871\n\nCVE-2024-44944\n\nCVE-2024-44965\n\nCVE-2024-46743\n\nCVE-2024-46745\n\nCVE-2024-46750\n\nCVE-2024-47684\n\nCVE-2024-47701\n\nCVE-2024-47737\n\nCVE-2024-49881\n\nCVE-2024-49884\n\nCVE-2024-49948\n\nCVE-2024-49949\n\nCVE-2024-49952\n\nCVE-2024-49997\n\nCVE-2024-50006\n\nCVE-2024-50040\n\nCVE-2024-50045\n\nCVE-2024-50251\n\nCVE-2024-50262\n\nCVE-2024-50299\n\nCVE-2024-50301\n\nCVE-2024-53057\n\nCVE-2024-53140\n\nCVE-2024-53165\n\nCVE-2024-53217\n\nCVE-2025-0167\n\nCVE-2025-0395\n\nCVE-2025-0665\n\nCVE-2025-0725\n\nCVE-2025-26466\n\nCVE-2024-8176\n\nCVE-2024-47707\n\nCVE-2024-53124\n\nCVE-2024-56569\n\nCVE-2024-56600\n\nCVE-2024-56770\n\nCVE-2024-57901\n\nCVE-2025-1390\n\nCVE-2025-21694\n\nCVE-2024-56780\n\nCVE-2024-56606\n\nCVE-2024-56779\n\nCVE-2024-57884\n\nCVE-2024-48881\n\nCVE-2024-52332\n\nCVE-2024-56650\n\nCVE-2024-56570\n\nCVE-2024-56601\n\nCVE-2024-53164\n\nCVE-2024-56644\n\nCVE-2025-29087\n\nCVE-2025-29088\n\nCVE-2025-3277\n\nCVE-2025-3360\n\nCVE-2025-32728\n\nUpdate to V3.1.5 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.0 < V3.1.5\n\naffected by\n\nall CVEs\n\nCVE-2023-45871\n\nCVE-2023-45853\n\nCVE-2023-45322\n\nCVE-2013-0340\n\nCVE-2013-4235\n\nCVE-2014-7209\n\nCVE-2015-20107\n\nCVE-2022-37454\n\nCVE-2022-43680\n\nCVE-2022-45061\n\nCVE-2019-19242\n\nCVE-2019-19244\n\nCVE-2019-19317\n\nCVE-2019-19603\n\nCVE-2019-19645\n\nCVE-2019-19646\n\nCVE-2019-19880\n\nCVE-2019-19923\n\nCVE-2019-19924\n\nCVE-2019-19925\n\nCVE-2019-19926\n\nCVE-2019-19959\n\nCVE-2019-20218\n\nCVE-2016-10228\n\nCVE-2020-10029\n\nCVE-2020-1752\n\nCVE-2020-6096\n\nCVE-2016-10739\n\nCVE-2019-6488\n\nCVE-2016-3189\n\nCVE-2019-12900\n\nCVE-2021-28363\n\nCVE-2021-45960\n\nCVE-2022-0778\n\nCVE-2022-25235\n\nCVE-2022-25236\n\nCVE-2022-25313\n\nCVE-2022-25314\n\nCVE-2022-25315\n\nCVE-2022-26488\n\nCVE-2016-3709\n\nCVE-2022-29824\n\nCVE-2016-4658\n\nCVE-2016-5131\n\nCVE-2016-9318\n\nCVE-2017-0663\n\nCVE-2017-9047\n\nCVE-2017-9048\n\nCVE-2017-9049\n\nCVE-2017-9050\n\nCVE-2017-16931\n\nCVE-2017-16932\n\nCVE-2017-17512\n\nCVE-2017-18258\n\nCVE-2017-7375\n\nCVE-2017-7376\n\nCVE-2018-0495\n\nCVE-2019-12904\n\nCVE-2019-13627\n\nCVE-2018-12886\n\nCVE-2018-14404\n\nCVE-2018-14567\n\nCVE-2018-19591\n\nCVE-2018-20482\n\nCVE-2018-20843\n\nCVE-2018-25032\n\nCVE-2019-1010022\n\nCVE-2019-1010023\n\nCVE-2019-1010024\n\nCVE-2019-1010025\n\nCVE-2019-1010180\n\nCVE-2019-10160\n\nCVE-2019-9636\n\nCVE-2019-9740\n\nCVE-2019-9947\n\nCVE-2019-9948\n\nCVE-2019-11360\n\nCVE-2019-12290\n\nCVE-2019-13057\n\nCVE-2019-13565\n\nCVE-2019-15847\n\nCVE-2019-15903\n\nCVE-2019-16056\n\nCVE-2019-16168\n\nCVE-2019-16905\n\nCVE-2019-17498\n\nCVE-2020-22218\n\nCVE-2019-17543\n\nCVE-2019-17594\n\nCVE-2019-17595\n\nCVE-2019-18224\n\nCVE-2019-18276\n\nCVE-2019-18348\n\nCVE-2020-8492\n\nCVE-2019-19126\n\nCVE-2020-1751\n\nCVE-2019-19906\n\nCVE-2019-19956\n\nCVE-2019-20367\n\nCVE-2019-20388\n\nCVE-2020-24977\n\nCVE-2020-7595\n\nCVE-2021-3516\n\nCVE-2021-3517\n\nCVE-2021-3518\n\nCVE-2021-3537\n\nCVE-2021-3541\n\nCVE-2019-20795\n\nCVE-2019-20907\n\nCVE-2020-14422\n\nCVE-2020-15523\n\nCVE-2020-15801\n\nCVE-2020-26116\n\nCVE-2019-25013\n\nCVE-2020-27618\n\nCVE-2020-29562\n\nCVE-2020-29573\n\nCVE-2021-27645\n\nCVE-2021-3326\n\nCVE-2019-3855\n\nCVE-2019-3856\n\nCVE-2019-3857\n\nCVE-2019-3858\n\nCVE-2019-3859\n\nCVE-2019-3860\n\nCVE-2019-3861\n\nCVE-2019-3862\n\nCVE-2019-3863\n\nCVE-2019-5018\n\nCVE-2019-8457\n\nCVE-2019-9936\n\nCVE-2019-9937\n\nCVE-2019-5094\n\nCVE-2019-5188\n\nCVE-2019-5435\n\nCVE-2019-5436\n\nCVE-2019-5443\n\nCVE-2019-5481\n\nCVE-2019-5482\n\nCVE-2020-19909\n\nCVE-2019-6109\n\nCVE-2019-6110\n\nCVE-2019-6111\n\nCVE-2019-7309\n\nCVE-2019-9169\n\nCVE-2019-9674\n\nCVE-2019-9923\n\nCVE-2020-10531\n\nCVE-2020-21913\n\nCVE-2020-10543\n\nCVE-2020-10878\n\nCVE-2020-12723\n\nCVE-2020-10735\n\nCVE-2021-28861\n\nCVE-2020-11501\n\nCVE-2020-11655\n\nCVE-2020-11656\n\nCVE-2020-13630\n\nCVE-2020-13631\n\nCVE-2020-13632\n\nCVE-2020-35525\n\nCVE-2020-35527\n\nCVE-2020-9327\n\nCVE-2020-12062\n\nCVE-2020-12243\n\nCVE-2020-12762\n\nCVE-2020-13434\n\nCVE-2020-13435\n\nCVE-2020-13529\n\nCVE-2023-26604\n\nCVE-2020-13776\n\nCVE-2020-13777\n\nCVE-2020-13871\n\nCVE-2020-15358\n\nCVE-2020-14145\n\nCVE-2021-28041\n\nCVE-2020-15778\n\nCVE-2020-1712\n\nCVE-2020-19185\n\nCVE-2020-19186\n\nCVE-2020-19187\n\nCVE-2020-19188\n\nCVE-2020-19189\n\nCVE-2020-19190\n\nCVE-2023-29491\n\nCVE-2020-21047\n\nCVE-2021-33294\n\nCVE-2020-24659\n\nCVE-2020-25692\n\nCVE-2020-25709\n\nCVE-2020-25710\n\nCVE-2020-28196\n\nCVE-2020-29361\n\nCVE-2020-29362\n\nCVE-2020-29363\n\nCVE-2020-36221\n\nCVE-2020-36222\n\nCVE-2020-36223\n\nCVE-2020-36224\n\nCVE-2020-36225\n\nCVE-2020-36226\n\nCVE-2020-36227\n\nCVE-2020-36228\n\nCVE-2020-36229\n\nCVE-2020-36230\n\nCVE-2020-8169\n\nCVE-2020-8177\n\nCVE-2020-8231\n\nCVE-2020-8284\n\nCVE-2020-8285\n\nCVE-2020-8286\n\nCVE-2020-8315\n\nCVE-2022-48560\n\nCVE-2021-20193\n\nCVE-2021-20227\n\nCVE-2021-20231\n\nCVE-2021-20232\n\nCVE-2021-20305\n\nCVE-2021-3580\n\nCVE-2021-22876\n\nCVE-2021-22890\n\nCVE-2021-22897\n\nCVE-2021-22898\n\nCVE-2021-22901\n\nCVE-2021-22922\n\nCVE-2021-22923\n\nCVE-2021-22924\n\nCVE-2021-22925\n\nCVE-2021-22926\n\nCVE-2021-22945\n\nCVE-2021-22946\n\nCVE-2021-22947\n\nCVE-2021-23336\n\nCVE-2021-3177\n\nCVE-2021-27212\n\nCVE-2021-27218\n\nCVE-2021-27219\n\nCVE-2021-28153\n\nCVE-2021-31239\n\nCVE-2021-32292\n\nCVE-2021-33560\n\nCVE-2021-33574\n\nCVE-2021-35942\n\nCVE-2021-33910\n\nCVE-2021-3426\n\nCVE-2021-3733\n\nCVE-2021-3737\n\nCVE-2021-4189\n\nCVE-2022-0391\n\nCVE-2021-3520\n\nCVE-2021-36084\n\nCVE-2021-36085\n\nCVE-2021-36086\n\nCVE-2021-36087\n\nCVE-2021-36222\n\nCVE-2021-36690\n\nCVE-2021-37600\n\nCVE-2021-37750\n\nCVE-2021-3826\n\nCVE-2021-46195\n\nCVE-2021-38604\n\nCVE-2021-3998\n\nCVE-2021-3999\n\nCVE-2021-43396\n\nCVE-2022-23218\n\nCVE-2022-23219\n\nCVE-2021-3997\n\nCVE-2021-4122\n\nCVE-2021-4209\n\nCVE-2021-43618\n\nCVE-2021-46143\n\nCVE-2022-22822\n\nCVE-2022-22823\n\nCVE-2022-22824\n\nCVE-2022-22825\n\nCVE-2022-22826\n\nCVE-2022-22827\n\nCVE-2021-46828\n\nCVE-2021-46848\n\nCVE-2022-0563\n\nCVE-2022-1271\n\nCVE-2022-1292\n\nCVE-2022-1343\n\nCVE-2022-1434\n\nCVE-2022-1473\n\nCVE-2022-1304\n\nCVE-2022-2068\n\nCVE-2022-2097\n\nCVE-2022-2274\n\nCVE-2022-22576\n\nCVE-2022-27774\n\nCVE-2022-27775\n\nCVE-2022-27776\n\nCVE-2022-23308\n\nCVE-2022-23852\n\nCVE-2022-23990\n\nCVE-2022-24407\n\nCVE-2022-2509\n\nCVE-2022-27778\n\nCVE-2022-27779\n\nCVE-2022-27780\n\nCVE-2022-27781\n\nCVE-2022-27782\n\nCVE-2022-30115\n\nCVE-2022-27943\n\nCVE-2022-28321\n\nCVE-2022-29155\n\nCVE-2022-32205\n\nCVE-2022-32206\n\nCVE-2022-32207\n\nCVE-2022-32208\n\nCVE-2022-32221\n\nCVE-2022-35260\n\nCVE-2022-42915\n\nCVE-2022-42916\n\nCVE-2022-35252\n\nCVE-2022-35737\n\nCVE-2022-3715\n\nCVE-2022-37434\n\nCVE-2022-3821\n\nCVE-2022-45873\n\nCVE-2022-40303\n\nCVE-2022-40304\n\nCVE-2022-40674\n\nCVE-2022-42898\n\nCVE-2022-4304\n\nCVE-2022-4450\n\nCVE-2023-0215\n\nCVE-2023-0286\n\nCVE-2022-43551\n\nCVE-2022-43552\n\nCVE-2022-46908\n\nCVE-2022-48303\n\nCVE-2022-48522\n\nCVE-2023-0464\n\nCVE-2023-24329\n\nCVE-2023-0361\n\nCVE-2023-0465\n\nCVE-2023-0466\n\nCVE-2023-2650\n\nCVE-2023-0687\n\nCVE-2023-25139\n\nCVE-2023-1077\n\nCVE-2023-1206\n\nCVE-2023-3212\n\nCVE-2023-34319\n\nCVE-2023-35001\n\nCVE-2023-3609\n\nCVE-2023-3611\n\nCVE-2023-3772\n\nCVE-2023-39189\n\nCVE-2023-39192\n\nCVE-2023-39193\n\nCVE-2023-39194\n\nCVE-2023-40283\n\nCVE-2023-42755\n\nCVE-2023-4623\n\nCVE-2023-4921\n\nCVE-2023-23914\n\nCVE-2023-23915\n\nCVE-2023-23916\n\nCVE-2023-29499\n\nCVE-2023-32611\n\nCVE-2023-32636\n\nCVE-2023-32643\n\nCVE-2023-32665\n\nCVE-2023-25136\n\nCVE-2023-27371\n\nCVE-2023-27533\n\nCVE-2023-27534\n\nCVE-2023-27535\n\nCVE-2023-27536\n\nCVE-2023-27537\n\nCVE-2023-27538\n\nCVE-2023-28484\n\nCVE-2023-29469\n\nCVE-2023-29383\n\nCVE-2023-2953\n\nCVE-2023-31085\n\nCVE-2023-42754\n\nCVE-2023-5717\n\nCVE-2023-3446\n\nCVE-2023-3817\n\nCVE-2023-34969\n\nCVE-2023-35945\n\nCVE-2023-38408\n\nCVE-2023-39128\n\nCVE-2023-39615\n\nCVE-2023-4016\n\nCVE-2023-4039\n\nCVE-2023-4813\n\nCVE-2023-5156\n\nCVE-2023-4807\n\nCVE-2023-5678\n\nCVE-2023-5981\n\nCVE-2021-44879\n\nCVE-2023-45898\n\nCVE-2023-46862\n\nCVE-2023-6121\n\nCVE-2023-6817\n\nCVE-2023-6931\n\nCVE-2023-6932\n\nCVE-2024-0584\n\nCVE-2023-45918\n\nCVE-2023-52425\n\nCVE-2023-52426\n\nCVE-2024-28757\n\nCVE-2024-2004\n\nCVE-2024-2379\n\nCVE-2024-2398\n\nCVE-2024-2466\n\nCVE-2024-2511\n\nCVE-2024-28182\n\nCVE-2024-28834\n\nCVE-2024-28835\n\nCVE-2024-34459\n\nCVE-2024-5535\n\nCVE-2024-5742\n\nCVE-2024-7264\n\nCVE-2024-6409\n\nCVE-2024-8096\n\nCVE-2024-9143\n\nCVE-2024-2236\n\nCVE-2024-50602\n\nCVE-2024-52533\n\nCVE-2024-11053\n\nCVE-2023-52444\n\nCVE-2023-52464\n\nCVE-2023-52612\n\nCVE-2023-52675\n\nCVE-2024-35809\n\nCVE-2024-35944\n\nCVE-2024-56433\n\nCVE-2024-26880\n\nCVE-2024-35807\n\nCVE-2024-26878\n\nCVE-2024-27074\n\nCVE-2023-52699\n\nCVE-2024-26898\n\nCVE-2024-26901\n\nCVE-2024-49982\n\nCVE-2024-38780\n\nCVE-2024-40959\n\nCVE-2024-33621\n\nCVE-2024-39292\n\nCVE-2024-39469\n\nCVE-2024-39489\n\nCVE-2024-40901\n\nCVE-2024-42070\n\nCVE-2024-26835\n\nCVE-2024-27065\n\nCVE-2024-38598\n\nCVE-2024-36286\n\nCVE-2024-38596\n\nCVE-2024-42096\n\nCVE-2024-38621\n\nCVE-2024-37356\n\nCVE-2024-38612\n\nCVE-2024-26973\n\nCVE-2024-35888\n\nCVE-2024-26957\n\nCVE-2024-35910\n\nCVE-2024-35925\n\nCVE-2024-26863\n\nCVE-2024-35830\n\nCVE-2017-15422\n\nCVE-2018-18928\n\nCVE-2023-52622\n\nCVE-2024-27020\n\nCVE-2024-27032\n\nCVE-2024-36017\n\nCVE-2024-36484\n\nCVE-2024-36904\n\nCVE-2024-26645\n\nCVE-2024-36905\n\nCVE-2024-26671\n\nCVE-2024-36934\n\nCVE-2024-26679\n\nCVE-2024-39487\n\nCVE-2024-26772\n\nCVE-2024-41046\n\nCVE-2024-26773\n\nCVE-2024-42106\n\nCVE-2024-26777\n\nCVE-2024-42131\n\nCVE-2024-26805\n\nCVE-2024-42154\n\nCVE-2024-26923\n\nCVE-2024-43871\n\nCVE-2024-44944\n\nCVE-2024-44965\n\nCVE-2024-46743\n\nCVE-2024-46745\n\nCVE-2024-46750\n\nCVE-2024-47684\n\nCVE-2024-47701\n\nCVE-2024-47737\n\nCVE-2024-49881\n\nCVE-2024-49884\n\nCVE-2024-49948\n\nCVE-2024-49949\n\nCVE-2024-49952\n\nCVE-2024-49997\n\nCVE-2024-50006\n\nCVE-2024-50040\n\nCVE-2024-50045\n\nCVE-2024-50251\n\nCVE-2024-50262\n\nCVE-2024-50299\n\nCVE-2024-50301\n\nCVE-2024-53057\n\nCVE-2024-53140\n\nCVE-2024-53165\n\nCVE-2024-53217\n\nCVE-2025-0167\n\nCVE-2025-0395\n\nCVE-2025-0665\n\nCVE-2025-0725\n\nCVE-2025-26466\n\nCVE-2024-8176\n\nCVE-2024-47707\n\nCVE-2024-53124\n\nCVE-2024-56569\n\nCVE-2024-56600\n\nCVE-2024-56770\n\nCVE-2024-57901\n\nCVE-2025-1390\n\nCVE-2025-21694\n\nCVE-2024-56780\n\nCVE-2024-56606\n\nCVE-2024-56779\n\nCVE-2024-57884\n\nCVE-2024-48881\n\nCVE-2024-52332\n\nCVE-2024-56650\n\nCVE-2024-56570\n\nCVE-2024-56601\n\nCVE-2024-53164\n\nCVE-2024-56644\n\nCVE-2025-29087\n\nCVE-2025-29088\n\nCVE-2025-3277\n\nCVE-2025-3360\n\nCVE-2025-32728\n\nUpdate to V3.1.5 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.0 < V3.1.5\n\naffected by\n\nall CVEs\n\nCVE-2023-45871\n\nCVE-2023-45853\n\nCVE-2023-45322\n\nCVE-2013-0340\n\nCVE-2013-4235\n\nCVE-2014-7209\n\nCVE-2015-20107\n\nCVE-2022-37454\n\nCVE-2022-43680\n\nCVE-2022-45061\n\nCVE-2019-19242\n\nCVE-2019-19244\n\nCVE-2019-19317\n\nCVE-2019-19603\n\nCVE-2019-19645\n\nCVE-2019-19646\n\nCVE-2019-19880\n\nCVE-2019-19923\n\nCVE-2019-19924\n\nCVE-2019-19925\n\nCVE-2019-19926\n\nCVE-2019-19959\n\nCVE-2019-20218\n\nCVE-2016-10228\n\nCVE-2020-10029\n\nCVE-2020-1752\n\nCVE-2020-6096\n\nCVE-2016-10739\n\nCVE-2019-6488\n\nCVE-2016-3189\n\nCVE-2019-12900\n\nCVE-2021-28363\n\nCVE-2021-45960\n\nCVE-2022-0778\n\nCVE-2022-25235\n\nCVE-2022-25236\n\nCVE-2022-25313\n\nCVE-2022-25314\n\nCVE-2022-25315\n\nCVE-2022-26488\n\nCVE-2016-3709\n\nCVE-2022-29824\n\nCVE-2016-4658\n\nCVE-2016-5131\n\nCVE-2016-9318\n\nCVE-2017-0663\n\nCVE-2017-9047\n\nCVE-2017-9048\n\nCVE-2017-9049\n\nCVE-2017-9050\n\nCVE-2017-16931\n\nCVE-2017-16932\n\nCVE-2017-17512\n\nCVE-2017-18258\n\nCVE-2017-7375\n\nCVE-2017-7376\n\nCVE-2018-0495\n\nCVE-2019-12904\n\nCVE-2019-13627\n\nCVE-2018-12886\n\nCVE-2018-14404\n\nCVE-2018-14567\n\nCVE-2018-19591\n\nCVE-2018-20482\n\nCVE-2018-20843\n\nCVE-2018-25032\n\nCVE-2019-1010022\n\nCVE-2019-1010023\n\nCVE-2019-1010024\n\nCVE-2019-1010025\n\nCVE-2019-1010180\n\nCVE-2019-10160\n\nCVE-2019-9636\n\nCVE-2019-9740\n\nCVE-2019-9947\n\nCVE-2019-9948\n\nCVE-2019-11360\n\nCVE-2019-12290\n\nCVE-2019-13057\n\nCVE-2019-13565\n\nCVE-2019-15847\n\nCVE-2019-15903\n\nCVE-2019-16056\n\nCVE-2019-16168\n\nCVE-2019-16905\n\nCVE-2019-17498\n\nCVE-2020-22218\n\nCVE-2019-17543\n\nCVE-2019-17594\n\nCVE-2019-17595\n\nCVE-2019-18224\n\nCVE-2019-18276\n\nCVE-2019-18348\n\nCVE-2020-8492\n\nCVE-2019-19126\n\nCVE-2020-1751\n\nCVE-2019-19906\n\nCVE-2019-19956\n\nCVE-2019-20367\n\nCVE-2019-20388\n\nCVE-2020-24977\n\nCVE-2020-7595\n\nCVE-2021-3516\n\nCVE-2021-3517\n\nCVE-2021-3518\n\nCVE-2021-3537\n\nCVE-2021-3541\n\nCVE-2019-20795\n\nCVE-2019-20907\n\nCVE-2020-14422\n\nCVE-2020-15523\n\nCVE-2020-15801\n\nCVE-2020-26116\n\nCVE-2019-25013\n\nCVE-2020-27618\n\nCVE-2020-29562\n\nCVE-2020-29573\n\nCVE-2021-27645\n\nCVE-2021-3326\n\nCVE-2019-3855\n\nCVE-2019-3856\n\nCVE-2019-3857\n\nCVE-2019-3858\n\nCVE-2019-3859\n\nCVE-2019-3860\n\nCVE-2019-3861\n\nCVE-2019-3862\n\nCVE-2019-3863\n\nCVE-2019-5018\n\nCVE-2019-8457\n\nCVE-2019-9936\n\nCVE-2019-9937\n\nCVE-2019-5094\n\nCVE-2019-5188\n\nCVE-2019-5435\n\nCVE-2019-5436\n\nCVE-2019-5443\n\nCVE-2019-5481\n\nCVE-2019-5482\n\nCVE-2020-19909\n\nCVE-2019-6109\n\nCVE-2019-6110\n\nCVE-2019-6111\n\nCVE-2019-7309\n\nCVE-2019-9169\n\nCVE-2019-9674\n\nCVE-2019-9923\n\nCVE-2020-10531\n\nCVE-2020-21913\n\nCVE-2020-10543\n\nCVE-2020-10878\n\nCVE-2020-12723\n\nCVE-2020-10735\n\nCVE-2021-28861\n\nCVE-2020-11501\n\nCVE-2020-11655\n\nCVE-2020-11656\n\nCVE-2020-13630\n\nCVE-2020-13631\n\nCVE-2020-13632\n\nCVE-2020-35525\n\nCVE-2020-35527\n\nCVE-2020-9327\n\nCVE-2020-12062\n\nCVE-2020-12243\n\nCVE-2020-12762\n\nCVE-2020-13434\n\nCVE-2020-13435\n\nCVE-2020-13529\n\nCVE-2023-26604\n\nCVE-2020-13776\n\nCVE-2020-13777\n\nCVE-2020-13871\n\nCVE-2020-15358\n\nCVE-2020-14145\n\nCVE-2021-28041\n\nCVE-2020-15778\n\nCVE-2020-1712\n\nCVE-2020-19185\n\nCVE-2020-19186\n\nCVE-2020-19187\n\nCVE-2020-19188\n\nCVE-2020-19189\n\nCVE-2020-19190\n\nCVE-2023-29491\n\nCVE-2020-21047\n\nCVE-2021-33294\n\nCVE-2020-24659\n\nCVE-2020-25692\n\nCVE-2020-25709\n\nCVE-2020-25710\n\nCVE-2020-28196\n\nCVE-2020-29361\n\nCVE-2020-29362\n\nCVE-2020-29363\n\nCVE-2020-36221\n\nCVE-2020-36222\n\nCVE-2020-36223\n\nCVE-2020-36224\n\nCVE-2020-36225\n\nCVE-2020-36226\n\nCVE-2020-36227\n\nCVE-2020-36228\n\nCVE-2020-36229\n\nCVE-2020-36230\n\nCVE-2020-8169\n\nCVE-2020-8177\n\nCVE-2020-8231\n\nCVE-2020-8284\n\nCVE-2020-8285\n\nCVE-2020-8286\n\nCVE-2020-8315\n\nCVE-2022-48560\n\nCVE-2021-20193\n\nCVE-2021-20227\n\nCVE-2021-20231\n\nCVE-2021-20232\n\nCVE-2021-20305\n\nCVE-2021-3580\n\nCVE-2021-22876\n\nCVE-2021-22890\n\nCVE-2021-22897\n\nCVE-2021-22898\n\nCVE-2021-22901\n\nCVE-2021-22922\n\nCVE-2021-22923\n\nCVE-2021-22924\n\nCVE-2021-22925\n\nCVE-2021-22926\n\nCVE-2021-22945\n\nCVE-2021-22946\n\nCVE-2021-22947\n\nCVE-2021-23336\n\nCVE-2021-3177\n\nCVE-2021-27212\n\nCVE-2021-27218\n\nCVE-2021-27219\n\nCVE-2021-28153\n\nCVE-2021-31239\n\nCVE-2021-32292\n\nCVE-2021-33560\n\nCVE-2021-33574\n\nCVE-2021-35942\n\nCVE-2021-33910\n\nCVE-2021-3426\n\nCVE-2021-3733\n\nCVE-2021-3737\n\nCVE-2021-4189\n\nCVE-2022-0391\n\nCVE-2021-3520\n\nCVE-2021-36084\n\nCVE-2021-36085\n\nCVE-2021-36086\n\nCVE-2021-36087\n\nCVE-2021-36222\n\nCVE-2021-36690\n\nCVE-2021-37600\n\nCVE-2021-37750\n\nCVE-2021-3826\n\nCVE-2021-46195\n\nCVE-2021-38604\n\nCVE-2021-3998\n\nCVE-2021-3999\n\nCVE-2021-43396\n\nCVE-2022-23218\n\nCVE-2022-23219\n\nCVE-2021-3997\n\nCVE-2021-4122\n\nCVE-2021-4209\n\nCVE-2021-43618\n\nCVE-2021-46143\n\nCVE-2022-22822\n\nCVE-2022-22823\n\nCVE-2022-22824\n\nCVE-2022-22825\n\nCVE-2022-22826\n\nCVE-2022-22827\n\nCVE-2021-46828\n\nCVE-2021-46848\n\nCVE-2022-0563\n\nCVE-2022-1271\n\nCVE-2022-1292\n\nCVE-2022-1343\n\nCVE-2022-1434\n\nCVE-2022-1473\n\nCVE-2022-1304\n\nCVE-2022-2068\n\nCVE-2022-2097\n\nCVE-2022-2274\n\nCVE-2022-22576\n\nCVE-2022-27774\n\nCVE-2022-27775\n\nCVE-2022-27776\n\nCVE-2022-23308\n\nCVE-2022-23852\n\nCVE-2022-23990\n\nCVE-2022-24407\n\nCVE-2022-2509\n\nCVE-2022-27778\n\nCVE-2022-27779\n\nCVE-2022-27780\n\nCVE-2022-27781\n\nCVE-2022-27782\n\nCVE-2022-30115\n\nCVE-2022-27943\n\nCVE-2022-28321\n\nCVE-2022-29155\n\nCVE-2022-32205\n\nCVE-2022-32206\n\nCVE-2022-32207\n\nCVE-2022-32208\n\nCVE-2022-32221\n\nCVE-2022-35260\n\nC", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2023-45871", "CVE-2023-45853", "CVE-2023-45322", "CVE-2013-0340", "CVE-2013-4235", "CVE-2014-7209", "CVE-2015-20107", "CVE-2022-37454", "CVE-2022-43680", "CVE-2022-45061", "CVE-2019-19242", "CVE-2019-19244", "CVE-2019-19317", "CVE-2019-19603", "CVE-2019-19645", "CVE-2019-19646", "CVE-2019-19880", "CVE-2019-19923", "CVE-2019-19924", "CVE-2019-19925", "CVE-2019-19926", "CVE-2019-19959", "CVE-2019-20218", "CVE-2016-10228", "CVE-2020-10029", "CVE-2020-1752", "CVE-2020-6096", "CVE-2016-10739", "CVE-2019-6488", "CVE-2016-3189", "CVE-2019-12900", "CVE-2021-28363", "CVE-2021-45960", "CVE-2022-0778", "CVE-2022-25235", "CVE-2022-25236", "CVE-2022-25313", "CVE-2022-25314", "CVE-2022-25315", "CVE-2022-26488", "CVE-2016-3709", "CVE-2022-29824", "CVE-2016-4658", "CVE-2016-5131", "CVE-2016-9318", "CVE-2017-0663", "CVE-2017-9047", "CVE-2017-9048", "CVE-2017-9049", "CVE-2017-9050", "CVE-2017-16931", "CVE-2017-16932", "CVE-2017-17512", "CVE-2017-18258", "CVE-2017-7375", "CVE-2017-7376", "CVE-2018-0495", "CVE-2019-12904", "CVE-2019-13627", "CVE-2018-12886", "CVE-2018-14404", "CVE-2018-14567", "CVE-2018-19591", "CVE-2018-20482", "CVE-2018-20843", "CVE-2018-25032", "CVE-2019-1010022", "CVE-2019-1010023", "CVE-2019-1010024", "CVE-2019-1010025", "CVE-2019-1010180", "CVE-2019-10160", "CVE-2019-9636", "CVE-2019-9740", "CVE-2019-9947", "CVE-2019-9948", "CVE-2019-11360", "CVE-2019-12290", "CVE-2019-13057", "CVE-2019-13565", "CVE-2019-15847", "CVE-2019-15903", "CVE-2019-16056", "CVE-2019-16168", "CVE-2019-16905", "CVE-2019-17498", "CVE-2020-22218", "CVE-2019-17543", "CVE-2019-17594", "CVE-2019-17595", "CVE-2019-18224", "CVE-2019-18276", "CVE-2019-18348", "CVE-2020-8492", "CVE-2019-19126", "CVE-2020-1751", "CVE-2019-19906", "CVE-2019-19956", "CVE-2019-20367", "CVE-2019-20388", "CVE-2020-24977", "CVE-2020-7595", "CVE-2021-3516", "CVE-2021-3517", "CVE-2021-3518", "CVE-2021-3537", "CVE-2021-3541", "CVE-2019-20795", "CVE-2019-20907", "CVE-2020-14422", "CVE-2020-15523", "CVE-2020-15801", "CVE-2020-26116", "CVE-2019-25013", "CVE-2020-27618", "CVE-2020-29562", "CVE-2020-29573", "CVE-2021-27645", "CVE-2021-3326", "CVE-2019-3855", "CVE-2019-3856", "CVE-2019-3857", "CVE-2019-3858", "CVE-2019-3859", "CVE-2019-3860", "CVE-2019-3861", "CVE-2019-3862", "CVE-2019-3863", "CVE-2019-5018", "CVE-2019-8457", "CVE-2019-9936", "CVE-2019-9937", "CVE-2019-5094", "CVE-2019-5188", "CVE-2019-5435", "CVE-2019-5436", "CVE-2019-5443", "CVE-2019-5481", "CVE-2019-5482", "CVE-2020-19909", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111", "CVE-2019-7309", "CVE-2019-9169", "CVE-2019-9674", "CVE-2019-9923", "CVE-2020-10531", "CVE-2020-21913", "CVE-2020-10543", "CVE-2020-10878", "CVE-2020-12723", "CVE-2020-10735", "CVE-2021-28861", "CVE-2020-11501", "CVE-2020-11655", "CVE-2020-11656", "CVE-2020-13630", "CVE-2020-13631", "CVE-2020-13632", "CVE-2020-35525", "CVE-2020-35527", "CVE-2020-9327", "CVE-2020-12062", "CVE-2020-12243", "CVE-2020-12762", "CVE-2020-13434", "CVE-2020-13435", "CVE-2020-13529", "CVE-2023-26604", "CVE-2020-13776", "CVE-2020-13777", "CVE-2020-13871", "CVE-2020-15358", "CVE-2020-14145", "CVE-2021-28041", "CVE-2020-15778", "CVE-2020-1712", "CVE-2020-19185", "CVE-2020-19186", "CVE-2020-19187", "CVE-2020-19188", "CVE-2020-19189", "CVE-2020-19190", "CVE-2023-29491", "CVE-2020-21047", "CVE-2021-33294", "CVE-2020-24659", "CVE-2020-25692", "CVE-2020-25709", "CVE-2020-25710", "CVE-2020-28196", "CVE-2020-29361", "CVE-2020-29362", "CVE-2020-29363", "CVE-2020-36221", "CVE-2020-36222", "CVE-2020-36223", "CVE-2020-36224", "CVE-2020-36225", "CVE-2020-36226", "CVE-2020-36227", "CVE-2020-36228", "CVE-2020-36229", "CVE-2020-36230", "CVE-2020-8169", "CVE-2020-8177", "CVE-2020-8231", "CVE-2020-8284", "CVE-2020-8285", "CVE-2020-8286", "CVE-2020-8315", "CVE-2022-48560", "CVE-2021-20193", "CVE-2021-20227", "CVE-2021-20231", "CVE-2021-20232", "CVE-2021-20305", "CVE-2021-3580", "CVE-2021-22876", "CVE-2021-22890", "CVE-2021-22897", "CVE-2021-22898", "CVE-2021-22901", "CVE-2021-22922", "CVE-2021-22923", "CVE-2021-22924", "CVE-2021-22925", "CVE-2021-22926", "CVE-2021-22945", "CVE-2021-22946", "CVE-2021-22947", "CVE-2021-23336", "CVE-2021-3177", "CVE-2021-27212", "CVE-2021-27218", "CVE-2021-27219", "CVE-2021-28153", "CVE-2021-31239", "CVE-2021-32292", "CVE-2021-33560", "CVE-2021-33574", "CVE-2021-35942", "CVE-2021-33910", "CVE-2021-3426", "CVE-2021-3733", "CVE-2021-3737", "CVE-2021-4189", "CVE-2022-0391", "CVE-2021-3520", "CVE-2021-36084", "CVE-2021-36085", "CVE-2021-36086", "CVE-2021-36087", "CVE-2021-36222", "CVE-2021-36690", "CVE-2021-37600", "CVE-2021-37750", "CVE-2021-3826", "CVE-2021-46195", "CVE-2021-38604", "CVE-2021-3998", "CVE-2021-3999", "CVE-2021-43396", "CVE-2022-23218", "CVE-2022-23219", "CVE-2021-3997", "CVE-2021-4122", "CVE-2021-4209", "CVE-2021-43618", "CVE-2021-46143", "CVE-2022-22822", "CVE-2022-22823", "CVE-2022-22824", "CVE-2022-22825", "CVE-2022-22826", "CVE-2022-22827", "CVE-2021-46828", "CVE-2021-46848", "CVE-2022-0563", "CVE-2022-1271", "CVE-2022-1292", "CVE-2022-1343", "CVE-2022-1434", "CVE-2022-1473", "CVE-2022-1304", "CVE-2022-2068", "CVE-2022-2097", "CVE-2022-2274", "CVE-2022-22576", "CVE-2022-27774", "CVE-2022-27775", "CVE-2022-27776", "CVE-2022-23308", "CVE-2022-23852", "CVE-2022-23990", "CVE-2022-24407", "CVE-2022-2509", "CVE-2022-27778", "CVE-2022-27779", "CVE-2022-27780", "CVE-2022-27781", "CVE-2022-27782", "CVE-2022-30115", "CVE-2022-27943", "CVE-2022-28321", "CVE-2022-29155", "CVE-2022-32205", "CVE-2022-32206", "CVE-2022-32207", "CVE-2022-32208", "CVE-2022-32221", "CVE-2022-35260", "CVE-2022-42915", "CVE-2022-42916", "CVE-2022-35252", "CVE-2022-35737", "CVE-2022-3715", "CVE-2022-37434", "CVE-2022-3821", "CVE-2022-45873", "CVE-2022-40303", "CVE-2022-40304", "CVE-2022-40674", "CVE-2022-42898", "CVE-2022-4304", "CVE-2022-4450", "CVE-2023-0215", "CVE-2023-0286", "CVE-2022-43551", "CVE-2022-43552", "CVE-2022-46908", "CVE-2022-48303", "CVE-2022-48522", "CVE-2023-0464", "CVE-2023-24329", "CVE-2023-0361", "CVE-2023-0465", "CVE-2023-0466", "CVE-2023-2650", "CVE-2023-0687", "CVE-2023-25139", "CVE-2023-1077", "CVE-2023-1206", "CVE-2023-3212", "CVE-2023-34319", "CVE-2023-35001", "CVE-2023-3609", "CVE-2023-3611", "CVE-2023-3772", "CVE-2023-39189", "CVE-2023-39192", "CVE-2023-39193", "CVE-2023-39194", "CVE-2023-40283", "CVE-2023-42755", "CVE-2023-4623", "CVE-2023-4921", "CVE-2023-23914", "CVE-2023-23915", "CVE-2023-23916", "CVE-2023-29499", "CVE-2023-32611", "CVE-2023-32636", "CVE-2023-32643", "CVE-2023-32665", "CVE-2023-25136", "CVE-2023-27371", "CVE-2023-27533", "CVE-2023-27534", "CVE-2023-27535", "CVE-2023-27536", "CVE-2023-27537", "CVE-2023-27538", "CVE-2023-28484", "CVE-2023-29469", "CVE-2023-29383", "CVE-2023-2953", "CVE-2023-31085", "CVE-2023-42754", "CVE-2023-5717", "CVE-2023-3446", "CVE-2023-3817", "CVE-2023-34969", "CVE-2023-35945", "CVE-2023-38408", "CVE-2023-39128", "CVE-2023-39615", "CVE-2023-4016", "CVE-2023-4039", "CVE-2023-4813", "CVE-2023-5156", "CVE-2023-4807", "CVE-2023-5678", "CVE-2023-5981", "CVE-2021-44879", "CVE-2023-45898", "CVE-2023-46862", "CVE-2023-6121", "CVE-2023-6817", "CVE-2023-6931", "CVE-2023-6932", "CVE-2024-0584", "CVE-2023-45918", "CVE-2023-52425", "CVE-2023-52426", "CVE-2024-28757", "CVE-2024-2004", "CVE-2024-2379", "CVE-2024-2398", "CVE-2024-2466", "CVE-2024-2511", "CVE-2024-28182", "CVE-2024-28834", "CVE-2024-28835", "CVE-2024-34459", "CVE-2024-5535", "CVE-2024-5742", "CVE-2024-7264", "CVE-2024-6409", "CVE-2024-8096", "CVE-2024-9143", "CVE-2024-2236", "CVE-2024-50602", "CVE-2024-52533", "CVE-2024-11053", "CVE-2023-52444", "CVE-2023-52464", "CVE-2023-52612", "CVE-2023-52675", "CVE-2024-35809", "CVE-2024-35944", "CVE-2024-56433", "CVE-2024-26880", "CVE-2024-35807", "CVE-2024-26878", "CVE-2024-27074", "CVE-2023-52699", "CVE-2024-26898", "CVE-2024-26901", "CVE-2024-49982", "CVE-2024-38780", "CVE-2024-40959", "CVE-2024-33621", "CVE-2024-39292", "CVE-2024-39469", "CVE-2024-39489", "CVE-2024-40901", "CVE-2024-42070", "CVE-2024-26835", "CVE-2024-27065", "CVE-2024-38598", "CVE-2024-36286", "CVE-2024-38596", "CVE-2024-42096", "CVE-2024-38621", "CVE-2024-37356", "CVE-2024-38612", "CVE-2024-26973", "CVE-2024-35888", "CVE-2024-26957", "CVE-2024-35910", "CVE-2024-35925", "CVE-2024-26863", "CVE-2024-35830", "CVE-2017-15422", "CVE-2018-18928", "CVE-2023-52622", "CVE-2024-27020", "CVE-2024-27032", "CVE-2024-36017", "CVE-2024-36484", "CVE-2024-36904", "CVE-2024-26645", "CVE-2024-36905", "CVE-2024-26671", "CVE-2024-36934", "CVE-2024-26679", "CVE-2024-39487", "CVE-2024-26772", "CVE-2024-41046", "CVE-2024-26773", "CVE-2024-42106", "CVE-2024-26777", "CVE-2024-42131", "CVE-2024-26805", "CVE-2024-42154", "CVE-2024-26923", "CVE-2024-43871", "CVE-2024-44944", "CVE-2024-44965", "CVE-2024-46743", "CVE-2024-46745", "CVE-2024-46750", "CVE-2024-47684", "CVE-2024-47701", "CVE-2024-47737", "CVE-2024-49881", "CVE-2024-49884", "CVE-2024-49948", "CVE-2024-49949", "CVE-2024-49952", "CVE-2024-49997", "CVE-2024-50006", "CVE-2024-50040", "CVE-2024-50045", "CVE-2024-50251", "CVE-2024-50262", "CVE-2024-50299", "CVE-2024-50301", "CVE-2024-53057", "CVE-2024-53140", "CVE-2024-53165", "CVE-2024-53217", "CVE-2025-0167", "CVE-2025-0395", "CVE-2025-0665", "CVE-2025-0725", "CVE-2025-26466", "CVE-2024-8176", "CVE-2024-47707", "CVE-2024-53124", "CVE-2024-56569", "CVE-2024-56600", "CVE-2024-56770", "CVE-2024-57901", "CVE-2025-1390", "CVE-2025-21694", "CVE-2024-56780", "CVE-2024-56606", "CVE-2024-56779", "CVE-2024-57884", "CVE-2024-48881", "CVE-2024-52332", "CVE-2024-56650", "CVE-2024-56570", "CVE-2024-56601", "CVE-2024-53164", "CVE-2024-56644", "CVE-2025-29087", "CVE-2025-29088", "CVE-2025-3277", "CVE-2025-3360", "CVE-2025-32728", "CVE-2016-1839", "CVE-2015-8035", "CVE-2018-9251", "CVE-2019-11340", "CVE-2017-1000082", "CVE-2023-4806", "CVE-2016-10009", "CVE-2023-6270", "CVE-2023-46218", "CVE-2023-46219", "CVE-2023-48795", "CVE-2024-28085", "CVE-2024-2961", "CVE-2024-33599", "CVE-2024-33600", "CVE-2024-33601", "CVE-2024-33602", "CVE-2024-37370", "CVE-2024-37371", "CVE-2024-45490", "CVE-2024-45491", "CVE-2024-45492", "CVE-2024-12133", "CVE-2024-12243", "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-38545", "CVE-2023-38546", "CVE-2023-44487", "CVE-2023-4527", "CVE-2023-4911", "CVE-2025-26465", "CVE-2025-46836" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourcePath": "body:advisory", "text": "SSA-434797\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-434797: Buffer Overflow Vulnerability in OpenSSL affecting Siemens Products\n\nPublication Date:\n\n2026-06-09\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.4\n\nCVSS v3.1 Base Score:\n8.8\n\nSUMMARY\n\nOpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nAI Lightweight Inference Server\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nConnector for Azure\n\nAll versions < V1.8.0\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V1.8.0 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nDatabus\n\nAll versions < V3.3.2\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.3.2 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nHiMed Cockpit\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9403 (6GK5998-3GS00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9413 (6GK5998-3GS01-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9433 (6GK5998-3GS11-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE M-800 family (incl. S615, MUM-800 and RM1224)\n\nShow more details\n\nExpand children\n\nRUGGEDCOM RM1224 family (6GK6108-4AM00)\n\nShow more details\n\nRUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE M-800 family\n\nShow more details\n\nSCALANCE M804PB (6GK5804-0AP00-2AA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M812-1 ADSL-Router family\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M816-1 ADSL-Router family\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M874-2 (6GK5874-2AA00-2AA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M874-3 (6GK5874-3AA00-2AA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M876-3 (6GK5876-3AA02-2BA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M876-4 (6GK5876-4AA10-2BA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE MUM-800 family\n\nShow more details\n\nSCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE S615 family\n\nShow more details\n\nSCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE W-700 IEEE 802.11ax family\n\nShow more details\n\nSCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM763-1 (6GK5763-1AL00-7DA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM766-1 (6GK5766-1GE00-7DA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUB762-1 (6GK5762-1AJ00-1AA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUM763-1 (6GK5763-1AL00-3AA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUM763-1 (6GK5763-1AL00-3DA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUM766-1 (6GK5766-1GE00-3DA0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\n\nShow more details\n\nExpand children\n\nSCALANCE XC-300 family\n\nShow more details\n\nSCALANCE XC316-8 (6GK5324-8TS00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XC324-4 (6GK5328-4TS00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XC332 (6GK5332-0GA00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE XC-400 family\n\nShow more details\n\nSCALANCE XC416-8 (6GK5424-8TR00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XC424-4 (6GK5428-4TR00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XC432 (6GK5432-0GR00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE XR-300 (6GK5334-xTSxx) family\n\nShow more details\n\nSCALANCE XR302-32 (6GK5334-5TS00-2AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR302-32 (6GK5334-5TS00-3AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR302-32 (6GK5334-5TS00-4AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR322-12 (6GK5334-3TS00-2AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR322-12 (6GK5334-3TS00-3AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR322-12 (6GK5334-3TS00-4AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR326-8 (6GK5334-2TS00-2AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR326-8 (6GK5334-2TS00-3AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR326-8 (6GK5334-2TS00-4AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE XR-500 (6GK5534-xTRxx) family\n\nShow more details\n\nSCALANCE XR502-32 (6GK5534-5TR00-2AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR502-32 (6GK5534-5TR00-3AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR502-32 (6GK5534-5TR00-4AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR522-12 (6GK5534-3TR00-2AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR522-12 (6GK5534-3TR00-3AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR522-12 (6GK5534-3TR00-4AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR526-8 (6GK5534-2TR00-2AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR526-8 (6GK5534-2TR00-3AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR526-8 (6GK5534-2TR00-4AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE XR-500WG family\n\nShow more details\n\nSCALANCE XR524-8WG (6GK5532-2SR00-2AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR524-8WG (6GK5532-2SR00-2RR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR524-8WG (6GK5532-2SR00-3AR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE XR524-8WG (6GK5532-2SR00-3RR3)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nShopfloor IT Suite\n\nShow more details\n\nShopfloor IT Suite\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMOVE Fleetmanager\n\nShow more details\n\nSIMOVE Fleetmanager V3.1\n\nAll versions < V3.1.13\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.1.13 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109813191/\n\nSee further recommendations from section\nMitigations\n\nSIMOVE Fleetmanager V3.2\n\nAll versions < V3.2.4\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.2.4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109813191/\n\nSee further recommendations from section\nMitigations\n\nSIMOVE Fleetmanager V3.3\n\nAll versions < V3.3.2\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.3.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109813191/\n\nSee further recommendations from section\nMitigations\n\nSIPLANT\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nContact customer support siplant-support.de@siemens.com\n\nSee further recommendations from section\nMitigations\n\nSIDIS Prime\n\nAll versions >= V4.0.700\n\naffected by\n\nCVE-2025-15467\n\nContact customer support\n\nSee further recommendations from section\nMitigations\n\nSiemens OPC UA Modelling Editor (SiOME)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC BX-21A\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC MD-57A\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC ORCLA\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC Logon\n\nShow more details\n\nSIMATIC Logon V1.6\n\nAll versions < V1.6 Upd12\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V1.6 Upd12 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Logon V2.0\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC MV500 family\n\nShow more details\n\nSIMATIC MV530 H (6GF3530-0GE10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MV530 S (6GF3530-0CD10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MV540 H (6GF3540-0GE10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MV540 H CRANES (6GF3540-0GE30)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MV540 S (6GF3540-0CD10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MV550 H (6GF3550-0GE10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MV550 S (6GF3550-0CD10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MV560 U (6GF3560-0LE10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC MV560 X (6GF3560-0HE10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V6.0\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PDM V9.3\n\nAll versions < V9.3 SP2\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V9.3 SP2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110002130/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC RTLS Locating Manager\n\nShow more details\n\nSIMATIC RTLS Locating Manager (6GT2780-0DA00)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nRestrict the port at the host with the DeviceConnectionProxy to secure destinations\n\nSecuring the connected email server as follows:\n\n• Configure the email server to enforce encrypted communication (TLS/SSL) for all SMTP connections.\n\n• Restrict access to the email server to trusted systems only (e.g., by using firewall rules or IP allowlists).\n\n• Ensure strong authentication to access the email server.\n\n• Keep the email server software and underlying operating system up to date with the latest security patches.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC RTLS Locating Manager (6GT2780-0DA10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nRestrict the port at the host with the DeviceConnectionProxy to secure destinations\n\nSecuring the connected email server as follows:\n\n• Configure the email server to enforce encrypted communication (TLS/SSL) for all SMTP connections.\n\n• Restrict access to the email server to trusted systems only (e.g., by using firewall rules or IP allowlists).\n\n• Ensure strong authentication to access the email server.\n\n• Keep the email server software and underlying operating system up to date with the latest security patches.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC RTLS Locating Manager (6GT2780-0DA20)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nRestrict the port at the host with the DeviceConnectionProxy to secure destinations\n\nSecuring the connected email server as follows:\n\n• Configure the email server to enforce encrypted communication (TLS/SSL) for all SMTP connections.\n\n• Restrict access to the email server to trusted systems only (e.g., by using firewall rules or IP allowlists).\n\n• Ensure strong authentication to access the email server.\n\n• Keep the email server software and underlying operating system up to date with the latest security patches.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC RTLS Locating Manager (6GT2780-0DA30)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nRestrict the port at the host with the DeviceConnectionProxy to secure destinations\n\nSecuring the connected email server as follows:\n\n• Configure the email server to enforce encrypted communication (TLS/SSL) for all SMTP connections.\n\n• Restrict access to the email server to trusted systems only (e.g., by using firewall rules or IP allowlists).\n\n• Ensure strong authentication to access the email server.\n\n• Keep the email server software and underlying operating system up to date with the latest security patches.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC RTLS Locating Manager (6GT2780-1EA10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nRestrict the port at the host with the DeviceConnectionProxy to secure destinations\n\nSecuring the connected email server as follows:\n\n• Configure the email server to enforce encrypted communication (TLS/SSL) for all SMTP connections.\n\n• Restrict access to the email server to trusted systems only (e.g., by using firewall rules or IP allowlists).\n\n• Ensure strong authentication to access the email server.\n\n• Keep the email server software and underlying operating system up to date with the latest security patches.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC RTLS Locating Manager (6GT2780-1EA20)\n\nAll vers", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2025-15467" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "sourcePath": "body:advisory", "text": "SSA-457936\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40196\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-3497\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23255\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23399\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31449\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31681\n\nCVE-2026-31682\n\nCVE-2026-31700\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46174\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-46333\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40196\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-3497\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23255\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23399\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31449\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31681\n\nCVE-2026-31682\n\nCVE-2026-31700\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46174\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-46333\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40196\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-3497\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23255\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23399\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31449\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31681\n\nCVE-2026-31682\n\nCVE-2026-31700\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46174\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-46333\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2023-53292", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21863", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40196", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-3497", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23255", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23399", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31449", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31681", "CVE-2026-31682", "CVE-2026-31700", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46174", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-46333", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2025-38617" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourcePath": "body:advisory", "text": "SSA-493396\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-493396: Deserialization Vulnerability in Siemens Engineering Platforms\n\nPublication Date:\n\n2025-08-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n7.8\n\nCVSS v4.0 Base Score:\n8.5\n\nSUMMARY\n\nAffected products do not properly sanitize user-controllable input when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V17\n\nShow more details\n\nSIMATIC STEP 7 V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V17\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.4\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V17\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V18\n\nShow more details\n\nSIMATIC STEP 7 V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V18\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.5\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V18\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V18 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V18 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V18\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V19\n\nShow more details\n\nSIMATIC STEP 7 V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V19\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.6\n\nAll versions < V5.6 SP1 HF7\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V5.6 SP1 HF7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989067/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V19\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2025-40759\n\nFixed with V5.2.1.1, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V20\n\nShow more details\n\nSIMATIC STEP 7 V20\n\nAll versions < V20 Update 4\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V20 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109963851/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V20\n\nAll versions < V20 Update 4\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V20 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109963851/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V20\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.7\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V20\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V20 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V20 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V20\n\nAll versions < V5.2.2.2\n\naffected by\n\nCVE-2025-40759\n\nFixed with V5.2.2.2, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly open projects from trusted sources.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMOCODE ES is the central software package for the configuration, commissioning, operation, and diagnosis of SIMOCODE pro.\r\nThe software is based on the Totally Integrated Automation Portal (TIA Portal) central engineering framework and can be seamlessly integrated if additional TIA Portal-based software such as STEP 7 and WinCC is present.\n\nSIMOTION SCOUT TIA is the add-in for TIA Portal for commissioning of SIMOTION devices.\n\nSINAMICS Startdrive commissioning software is the engineering tool for integration of SINAMICS drives in TIA Portal.\n\nSIRIUS Safety ES is the central software package for the configuration, commissioning, operation, and diagnosis of 3SK2 safety relays. The software is based on the Totally Integrated Automation Portal (TIA Portal) central engineering framework and can be seamlessly integrated if additional TIA Portal-based software such as STEP 7 and WinCC is present, thus providing the user with a consistent, efficient, and intuitive solution to all automation tasks. Those using SIRIUS Safety ES as standalone software will also enjoy its benefits.\n\nSIRIUS Soft Starter ES is the central software for commissioning, operation, and diagnostics of the SIRIUS 3RW5 and 3RW44 soft starter series. It is integrated seamlessly if other TIA Portal-based software such as STEP 7 or WinCC is already installed, thus enabling users to achieve a consistent, efficient, and intuitive solution for all automation tasks. Those who use Soft Starter as standalone software will also benefit from its features.\n\nTIA Portal Cloud makes it possible to use the main packages as well as the main option packages of TIA Portal in a virtualized environment. Local projects can be transferred to the cloud and loaded back again via a file share service.\n\nTotally Integrated Automation Portal (TIA Portal) is a PC software that provides access to the complete range of Siemens digitalized automation services, from digital planning and integrated engineering to transparent operation.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-40759\n\nAffected products do not properly sanitize stored security properties when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.5\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-502: Deserialization of Untrusted Data\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nDr. Vincent Zhao from DNV SCPA for reporting the vulnerability\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2025-08-12):\n\nPublication Date\n\nV1.1 (2025-10-14):\n\nAdded fix for TIA Portal V20\n\nV1.2 (2025-12-09):\n\nAdded fix for Totally Integrated Automation Portal (TIA Portal) V17\n\nV1.3 (2026-10-13):\n\nAdded fix version for SIMATIC STEP 7 V18, and SIMATIC WinCC V18\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-493396\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2025-40759" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "sourcePath": "body:advisory", "text": "SSA-508506\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-508506: Multiple Vulnerabilities in RUGGEDCOM CROSSBOW\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n8.8\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nRUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service.\n\nSiemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM CROSSBOW\n\nAll versions < V6.0\n\naffected by\n\nall CVEs\n\nCVE-2026-89196\n\nCVE-2026-89197\n\nCVE-2026-89198\n\nCVE-2026-89199\n\nCVE-2026-89200\n\nCVE-2026-89201\n\nCVE-2026-89202\n\nCVE-2026-89203\n\nCVE-2026-89204\n\nCVE-2026-89205\n\nCVE-2026-89206\n\nUpdate to V6.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006651/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP compliant access to Intelligent Electronic Devices.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-89196\n\nAffected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\n\nVulnerability CVE-2026-89197\n\nAffected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\n\nVulnerability CVE-2026-89198\n\nAffected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\n\nVulnerability CVE-2026-89199\n\nAffected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-639: Authorization Bypass Through User-Controlled Key\n\nVulnerability CVE-2026-89200\n\nAffected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.4\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\n\nVulnerability CVE-2026-89201\n\nAffected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n7.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\n\nVulnerability CVE-2026-89202\n\nAffected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCVSS v4.0 Base Score\n7.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-639: Authorization Bypass Through User-Controlled Key\n\nVulnerability CVE-2026-89203\n\nAffected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n\nCVSS v4.0 Base Score\n5.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-201: Insertion of Sensitive Information Into Sent Data\n\nVulnerability CVE-2026-89204\n\nAffected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.\n\nCVSS v3.1 Base Score\n5.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\n\nCVSS v4.0 Base Score\n5.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-639: Authorization Bypass Through User-Controlled Key\n\nVulnerability CVE-2026-89205\n\nAffected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices.\n\nCVSS v3.1 Base Score\n6.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\n\nCVSS v4.0 Base Score\n5.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N\n\nCWE\nCWE-602: Client-Side Enforcement of Server-Side Security\n\nVulnerability CVE-2026-89206\n\nAffected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delete scheduled tasks without proper authorization.\n\nCVSS v3.1 Base Score\n6.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\n\nCVSS v4.0 Base Score\n5.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N\n\nCWE\nCWE-602: Client-Side Enforcement of Server-Side Security\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-508506\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-89196", "CVE-2026-89197", "CVE-2026-89198", "CVE-2026-89199", "CVE-2026-89200", "CVE-2026-89201", "CVE-2026-89202", "CVE-2026-89203", "CVE-2026-89204", "CVE-2026-89205", "CVE-2026-89206" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "sourcePath": "body:advisory", "text": "SSA-545643\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-545643: Multiple Vulnerabilities in KACO Blueplanet Inverters\n\nPublication Date:\n\n2026-05-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n8.3\n\nCVSS v4.0 Base Score:\n7.2\n\nSUMMARY\n\nKACO blueplanet Inverters contain multiple vulnerabilities that could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access.\n\nKACO new energy GmbH has released new versions for several affected products and recommends to update to the latest versions. KACO new energy GmbH is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nblueplanet 3.0 TL3-60.0 TL3\n\nAll versions\n\naffected by\n\nCVE-2025-40946\n\nCurrently no fix is planned\n\nblueplanet 87.0 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 87.0 TL3 GEN2\n\nShow more details\n\nblueplanet 87.0 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 87.0 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 92.0 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 92.0 TL3 GEN2\n\nShow more details\n\nblueplanet 92.0 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 92.0 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 100 NX3 M8\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nCurrently no fix is available\n\nExpand children\n\nblueplanet 100 TL3 GEN2\n\nShow more details\n\nblueplanet 100 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 100 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 105 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 105 TL3 GEN2\n\nShow more details\n\nblueplanet 105 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 105 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 110 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 125 NX3 M10\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nCurrently no fix is available\n\nblueplanet 125 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 125 TL3 GEN2\n\nShow more details\n\nblueplanet 125 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 125 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 137 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 150 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 150 TL3 GEN2\n\nShow more details\n\nblueplanet 150 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 150 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 155 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 155 TL3 GEN2\n\nShow more details\n\nblueplanet 155 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 155 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 165 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 165 TL3 GEN2\n\nShow more details\n\nblueplanet 165 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 165 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet gridsave 92.0 TL3-S\n\nShow more details\n\nblueplanet gridsave 92.0 TL3-S\n\nAll versions < V3.92\n\naffected by\n\nCVE-2026-41125\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet gridsave 92.0 TL3-S\n\nAll versions < V3.91\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V3.91 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet gridsave 110 TL3-S\n\nShow more details\n\nblueplanet gridsave 110 TL3-S\n\nAll versions < V3.91\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V3.91 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet gridsave 110 TL3-S\n\nAll versions < V3.92\n\naffected by\n\nCVE-2026-41125\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet gridsave 137 TL3-S\n\nShow more details\n\nblueplanet gridsave 137 TL3-S\n\nAll versions < V3.91\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V3.91 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet gridsave 137 TL3-S\n\nAll versions < V3.92\n\naffected by\n\nCVE-2026-41125\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nKNOWN NOT AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nKnown Not Affected Products\nReason\n\nblueplanet 3.0 NX3-20.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 3.0-5.0 NX1\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 25.0 NX3-33.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 50.0 NX3-60.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 360 NX3 M6\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet hybrid 6.0 NH3-12.0 NH3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet hybrid 10.0 TL3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nOperators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment.\nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\nhttps://www.siemens.com/gridsecurity\n\nPRODUCT DESCRIPTION\n\nThe KACO blueplanet gridsave 92.0 - 137 TL3-S series are the first battery inverter to incorporate silicon carbide (SiC) power modules. The advantages of SiC manifest themselves in superior efficiencies of up to 98.8 percent. Contrary to PV, the energy within a storage system has to flow through the inverter twice – charging and discharging the batteries. Hence, the better the inverter’s efficiency the more energy can be delivered out of the system.\n\nThe KACO blueprint inverter product line offers a comprehensive range of inverters for solar power applications, from residential to utility-scale, as well as for battery storage and hybrid systems. The inverters are designed for flexible design and installation featuring up to 10 MPPTs to adapt to complex roof architectures, varied string configurations, and challenging shading conditions.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-40946\n\nA CRC16-based algorithm for generating Technical Service credentials could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access.\n\nCVSS v3.1 Base Score\n8.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\n\nCVSS v4.0 Base Score\n7.2\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-321: Use of Hard-coded Cryptographic Key\n\nVulnerability CVE-2026-41125\n\nImproper neutralization of special elements used in an sql command ('sql injection') in KACO Meteor server allows an authorized attacker to elevate privileges over a local network.\n\nCVSS v3.1 Base Score\n6.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H\n\nCVSS v4.0 Base Score\n5.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nRuben Santamarta from Reversemode for coordinated disclosure of the vulnerabilities\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-05-12):\n\nPublication Date\n\nV1.1 (2026-05-29):\n\nName of blueplanet gridsave 92.0 TL3-S was updated to blueplanet gridsave 92.0 TL3-S, Name of blueplanet gridsave 137 TL3-S was updated to blueplanet gridsave 137 TL3-S, Name of blueplanet gridsave 110 TL3-S was updated to blueplanet gridsave 110 TL3-S and Name of blueplanet 125 NX3 M11 was updated to blueplanet 125 NX3 M10\n\nV1.2 (2026-10-13):\n\nAdded fix (v3.92) for blueplanet gridsave 92.0-137 TL3-S and for blueplanet 3.0 87.0 TL3 - 165 TL3\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-545643\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2025-40946", "CVE-2026-41125" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "sourcePath": "body:advisory", "text": "SSA-550198\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-550198: Authenticated Remote Code Execution in WinCC\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n8.8\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC WinCC\n\nShow more details\n\nSIMATIC WinCC V7.5\n\nAll versions\n\naffected by\n\nCVE-2026-59241\n\nCurrently no fix is available\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 11\n\naffected by\n\nCVE-2026-59241\n\nUpdate to V8.0 Update 11 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSIMATIC WinCC V8.1\n\nAll versions < V8.1 Update 7\n\naffected by\n\nCVE-2026-59241\n\nUpdate to V8.1 Update 7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109977191/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC WinCC is a supervisory control and data acquisition (SCADA) system.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-59241\n\nThe affected application does not sufficiently restrict the permissions assigned to a database role.\nThis could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-266: Incorrect Privilege Assignment\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nSascha Meyer, Simon Wessling, and Jonathan Lauener from GAI NetConsult GmbH for coordinated disclosure\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-550198\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-59241" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "sourcePath": "body:advisory", "text": "SSA-563922\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-563922: Local Privilege Escalation Vulnerability in SIMOTION Tools\n\nPublication Date:\n\n2025-09-09\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.1\n\nCVSS v3.1 Base Score:\n8.1\n\nSUMMARY\n\nSeveral tools for the SIMOTION system are affected by a local privilege escalation vulnerability. This could allow an attacker to execute arbitrary code with SYSTEM privileges when a legitimate user installs an application that uses the affected setup component. This vulnerability poses a risk only during setup and installation phase of the affected tools.\n\nSiemens has released a new version for SIMATIC Technology Package TPCamGen and recommends to update to the latest version. Siemens recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)\n\nAll versions < V1.3.1\n\naffected by\n\nCVE-2025-43715\n\nUpdate to V1.3.1 or later version\n\nTo obtain the patch and update information, please contact your regular Siemens contact person.\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109804905/\n\nSee further recommendations from section\nMitigations\n\nSIMOTION OA MIIF (6AU1820-3DA20-0AB0)\n\nAll versions\n\naffected by\n\nCVE-2025-43715\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMOTION OACAMGEN (6AU1820-3EA20-0AB0)\n\nAll versions\n\naffected by\n\nCVE-2025-43715\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMOTION OALECO (6AU1820-3HA20-0AB0)\n\nAll versions\n\naffected by\n\nCVE-2025-43715\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMOTION OAVIBX (6AU1820-3CA20-0AB0)\n\nAll versions\n\naffected by\n\nCVE-2025-43715\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nEnsure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC Technology Package TPCamGen is part of the software package SIMATIC SimaPressServo. It determines optimized motion profiles for servo presses in which the tool is connected to the drive axis via a connecting rod.\n\nSIMOTION OA MIIF is a SIMOTION tool that enables access to the variables of SIMOTION via a client.\n\nSIMOTION OACAMGEN is a SIMOTION tool for cam generation with calculation of optimized motion profiles for servopresses.\n\nSIMOTION OALECO is a SIMOTION tool for elimination of the position error resulting from cyclic distortion during a production process.\n\nSIMOTION OAVIBX is a SIMOTION tool that changes the setpoint variable of an axis so that the moving mechanical system is activated to oscillations as little as possible within the range of its natural frequency.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-43715\n\nNullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.\n\nCVSS v3.1 Base Score\n8.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n\nCWE\nCWE-754: Improper Check for Unusual or Exceptional Conditions\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2025-09-09):\n\nPublication Date\n\nV1.1 (2026-10-13):\n\nAdded fix version for SIMATIC Technology Package TPCamGen\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-563922\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2025-43715" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "sourcePath": "body:advisory", "text": "SSA-580366\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-580366: DLL Sideloading Vulnerability in Siemens Software Center\n\nPublication Date:\n\n2026-10-15\n\nLast Update:\n\n2026-10-19\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n6.7\n\nCVSS v4.0 Base Score:\n8.4\n\nSUMMARY\n\nThe affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.\n\nSiemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSiemens Software Center\n\nAll versions < V4.0.9.8\n\naffected by\n\nCVE-2026-110936\n\nUpdate to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link)\n\nhttps://www.sw.siemens.com/en-US/siemens-software-center/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSiemens Software Center allows you to download, install, and activate purchased software. You can also update your software as new versions become available and launch free trials.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-110936\n\nThe affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.4\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-427: Uncontrolled Search Path Element\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nJose Oregon from Huntress Labs for reporting the vulnerability\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-15):\n\nPublication Date\n\nV1.1 (2026-10-17):\n\nAdded remediation for Siemens Software Center\n\nV1.2 (2026-10-19):\n\nAdded reference to blog post about active exploitation of the vulnerability\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-580366\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-110936" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "sourcePath": "body:advisory", "text": "SSA-591731\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.6\n\nCVSS v4.0 Base Score:\n9.4\n\nSUMMARY\n\nSIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization.\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC Drive Controller family\n\nShow more details\n\nSIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC ET 200SP Open Controller (incl. SIPLUS variants)\n\nShow more details\n\nExpand children\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)\n\nShow more details\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs\n\nShow more details\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nSIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516pro F-2 PN (6ES7516-2GP03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516pro-2 PN (6ES7516-2PP03-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516T-3 PN (6ES7516-3TP10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516TF-3 PN (6ES7516-3UP10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517-3 PN (6ES7517-3AQ10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517F-3 PN (6ES7517-3FQ10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP01-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517T-3 PN (6ES7517-3TQ10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517TF-3 PN (6ES7517-3UQ10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-63350", "CVE-2026-63351", "CVE-2026-63352", "CVE-2026-63353", "CVE-2026-63354", "CVE-2026-63355", "CVE-2026-63356", "CVE-2026-63357" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourcePath": "body:advisory", "text": "SSA-628843\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-628843: Out of Bound Read Vulnerability in TPM 2.0\n\nPublication Date:\n\n2026-04-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n6.6\n\nSUMMARY\n\nThe products listed below contain a vulnerability that could allow an attacker to perform an out-of-bound read, potentially leading to information disclosure or denial of service of the TPM.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC CN 4100\n\nAll versions with Hardware versions < FS 05\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC Field PG\n\nShow more details\n\nSIMATIC Field PG M5\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nSIMATIC Field PG M6\n\nAll versions < V26.01.14\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V26.01.14 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nExpand children\n\nSIMATIC IPC family\n\nShow more details\n\nSIMATIC IPC227E\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nSIMATIC IPC277E\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC IPC427E / IPC477E / IPC477E PRO\n\nShow more details\n\nSIMATIC IPC427E\n\nAll versions < V21.01.20\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V21.01.20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC477E\n\nAll versions < V21.01.20\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V21.01.20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC477E PRO\n\nAll versions < V21.01.20\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V21.01.20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIPLUS IPC427E\n\nAll versions < V21.01.20\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V21.01.20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nExpand children\n\nSIMATIC IPC627E / IPC647E / IPC677E / IPC847E\n\nShow more details\n\nSIMATIC IPC627E\n\nAll versions < V25.02.16\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V25.02.16 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC647E\n\nAll versions < V25.02.16\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V25.02.16 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC677E\n\nAll versions < V25.02.16\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V25.02.16 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC847E\n\nAll versions < V25.02.16\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V25.02.16 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC BX-32A\n\nAll versions < V29.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nExpand children\n\nSIMATIC IPC BX-39A / IPC PX-39A / IPC PX-39A PRO\n\nShow more details\n\nSIMATIC IPC BX-39A\n\nAll versions < V29.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC PX-39A\n\nAll versions < V29.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC PX-39A PRO\n\nAll versions < V29.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC BX-56A\n\nAll versions < V32.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V32.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC BX-59A\n\nAll versions < V32.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V32.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC PX-32A\n\nAll versions < V29.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC RW-528A\n\nAll versions < V34.01.02\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V34.01.02 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC RW-548A\n\nAll versions < V34.01.02\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V34.01.02 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC MD-57A\n\nAll versions < V30.01.10\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V30.01.10 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC ITP1000\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC Field PG is a mobile, industry-standard programming device for automation engineers with all commonly used interfaces for industrial applications that also brings pre-installed SIMATIC engineering software.\n\nSIMATIC IPC (Industrial PC) is the hardware platform for PC-based automation from Siemens.\n\nThe SIMATIC CN 4100 is a communication node that allows connecting third-party systems helping to implement system concepts for process control technology.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-2884\n\nTCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0\n\nCVSS v3.1 Base Score\n6.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H\n\nCWE\nCWE-125: Out-of-bounds Read\n\nADDITIONAL INFORMATION\n\nFurther information can be found on https://trustedcomputinggroup.org/wp-content/uploads/VRT0009-Advisory-FINAL.pdf\n\nSiemens has released new hardware version FS 05 for CN 4100. This new hardware version isn’t affected by the vulnerability CVE-2025-2884.\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-04-14):\n\nPublication Date\n\nV1.1 (2026-08-11):\n\nAdded no fix planned for SIMATIC ITP1000 and for SIMATIC Field PG M5. Added fix for SIMATIC Field PG M6\n\nV1.2 (2026-10-13):\n\nAdded fix for SIMATIC IPC627E / IPC647E / IPC677E / IPC847E\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-628843\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2025-2884" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourcePath": "body:advisory", "text": "SSA-693808\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms\n\nPublication Date:\n\n2025-08-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.4\n\nCVSS v3.1 Base Score:\n8.2\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nAffected products do not properly restrict access permissions to a local Windows Named Pipe and do not properly sanitize user-controllable input sent to that Named Pipe. This could allow a local authenticated attacker to cause a type confusion and execute arbitrary code within the affected application and its privileges.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC PCS neo\n\nShow more details\n\nSIMATIC PCS neo V4.1\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V5.0\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V6.0\n\nAll versions < V6.0 SP1 Update 1\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V6.0 SP1 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110000357/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V17\n\nShow more details\n\nSIMATIC STEP 7 V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V17\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.4\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V17\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V18\n\nShow more details\n\nSIMATIC STEP 7 V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V18\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.5\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V18\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V18 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V18 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V18\n\nAll versions < V6.3.0.2\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V6.3.0.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V19\n\nShow more details\n\nSIMATIC STEP 7 V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V19\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.6\n\nAll versions < V5.6 SP1 HF7\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V5.6 SP1 HF7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989067/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V19\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2024-54678\n\nFixed with V5.2.1.1, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V20\n\nShow more details\n\nSIMATIC STEP 7 V20\n\nAll versions < V20 Update 4\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V20 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109963851/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V20\n\nAll versions < V20 Update 4\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V20 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109963851/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V20\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.7\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V20\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V20 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V20 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V20\n\nAll versions < V5.2.2.2\n\naffected by\n\nCVE-2024-54678\n\nFixed with V5.2.2.2, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Test Suite V20\n\nAll versions < V20 Update 4\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V20 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109963851/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOn Desktop systems: Execute affected software on Windows hosts where only a single user is configured\n\nOn Server systems: Reduce the access on operating system level to administrators only\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC PCS neo is a distributed control system (DCS).\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMOCODE ES is the central software package for the configuration, commissioning, operation, and diagnosis of SIMOCODE pro.\r\nThe software is based on the Totally Integrated Automation Portal (TIA Portal) central engineering framework and can be seamlessly integrated if additional TIA Portal-based software such as STEP 7 and WinCC is present.\n\nSIMOTION SCOUT TIA is the add-in for TIA Portal for commissioning of SIMOTION devices.\n\nSINAMICS Startdrive commissioning software is the engineering tool for integration of SINAMICS drives in TIA Portal.\n\nSIRIUS Safety ES is the central software package for the configuration, commissioning, operation, and diagnosis of 3SK2 safety relays. The software is based on the Totally Integrated Automation Portal (TIA Portal) central engineering framework and can be seamlessly integrated if additional TIA Portal-based software such as STEP 7 and WinCC is present, thus providing the user with a consistent, efficient, and intuitive solution to all automation tasks. Those using SIRIUS Safety ES as standalone software will also enjoy its benefits.\n\nSIRIUS Soft Starter ES is the central software for commissioning, operation, and diagnostics of the SIRIUS 3RW5 and 3RW44 soft starter series. It is integrated seamlessly if other TIA Portal-based software such as STEP 7 or WinCC is already installed, thus enabling users to achieve a consistent, efficient, and intuitive solution for all automation tasks. Those who use Soft Starter as standalone software will also benefit from its features.\n\nTIA Portal Cloud makes it possible to use the main packages as well as the main option packages of TIA Portal in a virtualized environment. Local projects can be transferred to the cloud and loaded back again via a file share service.\n\nTIA Test Suite is a testing tool that ensures programming quality through automated validation of TIA Portal projects.\n\nTotally Integrated Automation Portal (TIA Portal) is a PC software that provides access to the complete range of Siemens digitalized automation services, from digital planning and integrated engineering to transparent operation.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-54678\n\nAffected products do not properly sanitize Interprocess Communication input received through a Windows Named Pipe accessible to all local users. This could allow an authenticated local attacker to cause a type confusion and execute arbitrary code within the affected application.\n\nCVSS v3.1 Base Score\n8.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.6\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n\nCWE\nCWE-502: Deserialization of Untrusted Data\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2025-08-12):\n\nPublication Date\n\nV1.1 (2025-10-14):\n\nAdded no fix expected for PCS neo V5.0, added fix for TIA Portal V20\n\nV1.2 (2025-12-09):\n\nAdded fix for Totally Integrated Automation Portal (TIA Portal) V17\n\nV1.3 (2026-06-09):\n\nAdded fix for SIMATIC PCS NEO V6.0\n\nV1.4 (2026-10-13):\n\nAdded fix version for SIMATIC STEP 7 V18, TIA Portal Cloud V18 and SIMATIC WinCC V18\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-693808\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-54678" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "sourcePath": "body:advisory", "text": "SSA-765416\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n9.2\n\nSUMMARY\n\nRUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information.\n\nSiemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM CROSSBOW Station Access Controller (SAC)\n\nAll versions < V6.0\n\naffected by\n\nall CVEs\n\nCVE-2025-6965\n\nCVE-2026-11822\n\nCVE-2026-11824\n\nCVE-2025-70873\n\nCVE-2025-71316\n\nUpdate to V6.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006651/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP compliant access to Intelligent Electronic Devices.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-6965\n\nThere exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.\n\nCVSS v3.1 Base Score\n7.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L\n\nCVSS v4.0 Base Score\n7.2\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L\n\nCWE\nCWE-197: Numeric Truncation Error\n\nVulnerability CVE-2025-70873\n\nAn information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\nCWE\nCWE-244: Improper Clearing of Heap Memory Before Release ('Heap Inspection')\n\nVulnerability CVE-2025-71316\n\nSQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n9.2\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-176: Improper Handling of Unicode Encoding\n\nVulnerability CVE-2026-11822\n\nSQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.5\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nVulnerability CVE-2026-11824\n\nSQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.5\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-765416\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2025-6965", "CVE-2026-11822", "CVE-2026-11824", "CVE-2025-70873", "CVE-2025-71316" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourcePath": "body:advisory", "text": "SSA-784472\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1.\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2024-58002\n\nCVE-2025-21844\n\nCVE-2024-26982\n\nCVE-2024-58079\n\nCVE-2025-21858\n\nCVE-2025-21865\n\nCVE-2025-21859\n\nCVE-2025-21862\n\nCVE-2025-21846\n\nCVE-2025-21864\n\nCVE-2025-21838\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-57977\n\nCVE-2025-21725\n\nCVE-2025-21806\n\nCVE-2024-58009\n\nCVE-2025-21767\n\nCVE-2025-21763\n\nCVE-2024-58077\n\nCVE-2024-58063\n\nCVE-2024-58013\n\nCVE-2025-21835\n\nCVE-2024-57979\n\nCVE-2025-21703\n\nCVE-2025-21735\n\nCVE-2025-21761\n\nCVE-2024-58071\n\nCVE-2025-21728\n\nCVE-2025-21738\n\nCVE-2025-21766\n\nCVE-2025-21795\n\nCVE-2025-21787\n\nCVE-2025-21779\n\nCVE-2024-58061\n\nCVE-2025-21724\n\nCVE-2025-21719\n\nCVE-2025-21790\n\nCVE-2025-21764\n\nCVE-2025-21705\n\nCVE-2025-21814\n\nCVE-2025-21765\n\nCVE-2025-21791\n\nCVE-2024-57986\n\nCVE-2024-40945\n\nCVE-2025-21744\n\nCVE-2024-57993\n\nCVE-2025-21700\n\nCVE-2024-57981\n\nCVE-2025-21832\n\nCVE-2024-58083\n\nCVE-2024-58020\n\nCVE-2025-21706\n\nCVE-2024-57996\n\nCVE-2025-21796\n\nCVE-2025-21758\n\nCVE-2025-21727\n\nCVE-2025-21745\n\nCVE-2024-58058\n\nCVE-2024-58017\n\nCVE-2024-58068\n\nCVE-2025-21716\n\nCVE-2025-21708\n\nCVE-2024-58014\n\nCVE-2025-21704\n\nCVE-2024-57980\n\nCVE-2025-21731\n\nCVE-2025-21726\n\nCVE-2025-21707\n\nCVE-2025-21776\n\nCVE-2025-21830\n\nCVE-2025-21760\n\nCVE-2025-21753\n\nCVE-2025-21762\n\nCVE-2024-58072\n\nCVE-2026-23253\n\nCVE-2026-23277\n\nCVE-2026-23279\n\nCVE-2026-23303\n\nCVE-2026-23356\n\nCVE-2025-21682\n\nCVE-2025-38250\n\nCVE-2026-23204\n\nCVE-2026-23365\n\nCVE-2026-23290\n\nCVE-2026-23339\n\nCVE-2026-23281\n\nCVE-2026-23372\n\nCVE-2026-23312\n\nCVE-2026-23367\n\nCVE-2026-23388\n\nCVE-2026-23398\n\nCVE-2026-23396\n\nCVE-2026-23274\n\nCVE-2026-23336\n\nCVE-2026-23395\n\nCVE-2026-23382\n\nCVE-2026-23368\n\nCVE-2026-23351\n\nCVE-2026-23357\n\nCVE-2026-23245\n\nCVE-2026-23352\n\nCVE-2026-23300\n\nCVE-2026-23100\n\nCVE-2025-68206\n\nCVE-2026-23379\n\nCVE-2025-39748\n\nCVE-2026-23381\n\nCVE-2026-23291\n\nCVE-2026-23304\n\nCVE-2026-23397\n\nCVE-2026-23318\n\nCVE-2026-23391\n\nCVE-2026-23113\n\nCVE-2024-56719\n\nCVE-2026-23154\n\nCVE-2025-68265\n\nCVE-2026-23296\n\nCVE-2026-23231\n\nCVE-2026-23292\n\nCVE-2026-23317\n\nCVE-2026-23319\n\nCVE-2026-23271\n\nCVE-2026-23141\n\nCVE-2026-23157\n\nCVE-2026-23270\n\nCVE-2025-40135\n\nCVE-2025-38162\n\nCVE-2026-23315\n\nCVE-2024-47809\n\nCVE-2025-39863\n\nCVE-2025-68239\n\nCVE-2026-23321\n\nCVE-2025-38192\n\nCVE-2025-38105\n\nCVE-2026-23343\n\nCVE-2026-23340\n\nCVE-2026-23364\n\nCVE-2026-23392\n\nCVE-2024-49998\n\nCVE-2026-23370\n\nCVE-2025-38704\n\nCVE-2026-23359\n\nCVE-2026-23378\n\nCVE-2026-23273\n\nCVE-2026-31708\n\nCVE-2026-43052\n\nCVE-2026-43350\n\nCVE-2026-46056\n\nCVE-2026-31705\n\nCVE-2026-46107\n\nCVE-2026-31449\n\nCVE-2025-21863\n\nCVE-2026-46307\n\nCVE-2026-46047\n\nCVE-2026-31586\n\nCVE-2026-31580\n\nCVE-2026-23444\n\nCVE-2026-23442\n\nCVE-2026-31583\n\nCVE-2026-31532\n\nCVE-2026-31624\n\nCVE-2026-31625\n\nCVE-2026-31630\n\nCVE-2026-31622\n\nCVE-2026-31637\n\nCVE-2026-31629\n\nCVE-2026-31617\n\nCVE-2026-31642\n\nCVE-2026-23066\n\nCVE-2026-23389\n\nCVE-2026-31488\n\nCVE-2026-43110\n\nCVE-2026-31711\n\nCVE-2026-46015\n\nCVE-2026-23399\n\nCVE-2026-43080\n\nCVE-2026-31500\n\nCVE-2026-43111\n\nCVE-2026-31673\n\nCVE-2026-43099\n\nCVE-2026-46037\n\nCVE-2023-53292\n\nCVE-2026-46101\n\nCVE-2026-46161\n\nCVE-2026-31681\n\nCVE-2026-31685\n\nCVE-2026-31696\n\nCVE-2026-43085\n\nCVE-2026-31699\n\nCVE-2026-43089\n\nCVE-2026-31698\n\nCVE-2026-43093\n\nCVE-2026-43493\n\nCVE-2026-43496\n\nCVE-2026-43502\n\nCVE-2026-45834\n\nCVE-2026-45835\n\nCVE-2026-45844\n\nCVE-2026-45843\n\nCVE-2026-45836\n\nCVE-2026-45840\n\nCVE-2026-45842\n\nCVE-2026-46023\n\nCVE-2026-46040\n\nCVE-2026-46051\n\nCVE-2026-46046\n\nCVE-2026-45838\n\nCVE-2026-46033\n\nCVE-2026-46022\n\nCVE-2026-46064\n\nCVE-2026-46070\n\nCVE-2026-46018\n\nCVE-2026-45841\n\nCVE-2026-46088\n\nCVE-2026-46128\n\nCVE-2026-46120\n\nCVE-2026-46124\n\nCVE-2026-46102\n\nCVE-2026-46122\n\nCVE-2026-46146\n\nCVE-2026-46149\n\nCVE-2026-46163\n\nCVE-2026-46177\n\nCVE-2026-46187\n\nCVE-2026-46227\n\nCVE-2026-46243\n\nCVE-2026-43117\n\nCVE-2026-46275\n\nCVE-2026-46303\n\nCVE-2026-43503\n\nCVE-2026-46294\n\nCVE-2026-46167\n\nCVE-2026-46151\n\nCVE-2025-22105\n\nCVE-2024-36922\n\nCVE-2024-56647\n\nCVE-2024-56657\n\nCVE-2026-23255\n\nCVE-2026-43499\n\nCVE-2026-31704\n\nCVE-2026-46113\n\nCVE-2026-46304\n\nCVE-2026-31697\n\nCVE-2026-43114\n\nCVE-2025-38584\n\nCVE-2026-31407\n\nCVE-2026-46150\n\nCVE-2026-31676\n\nCVE-2026-46234\n\nCVE-2026-46214\n\nCVE-2026-46172\n\nCVE-2026-46209\n\nCVE-2026-45997\n\nCVE-2026-31613\n\nCVE-2026-45839\n\nCVE-2026-31612\n\nCVE-2026-43074\n\nCVE-2026-31611\n\nCVE-2026-46050\n\nCVE-2026-43112\n\nCVE-2026-46092\n\nCVE-2025-39997\n\nCVE-2026-46099\n\nCVE-2026-46165\n\nCVE-2026-31694\n\nCVE-2026-46168\n\nCVE-2026-46173\n\nCVE-2026-46136\n\nCVE-2026-46185\n\nCVE-2026-43071\n\nCVE-2026-43094\n\nCVE-2026-46306\n\nCVE-2026-46195\n\nCVE-2026-46193\n\nCVE-2026-46116\n\nCVE-2026-46044\n\nCVE-2026-43116\n\nCVE-2026-53184\n\nCVE-2026-31712\n\nCVE-2026-43421\n\nCVE-2026-53131\n\nCVE-2026-23310\n\nCVE-2026-53198\n\nCVE-2026-46065\n\nCVE-2026-53183\n\nCVE-2026-53147\n\nCVE-2026-46190\n\nCVE-2026-46110\n\nCVE-2026-46323\n\nCVE-2023-54271\n\nCVE-2026-43492\n\nCVE-2026-52918\n\nCVE-2026-45991\n\nCVE-2026-46026\n\nCVE-2026-46038\n\nCVE-2026-46191\n\nCVE-2026-46003\n\nCVE-2026-31700\n\nCVE-2026-46069\n\nCVE-2026-53177\n\nCVE-2026-46021\n\nCVE-2026-52929\n\nCVE-2026-46159\n\nCVE-2026-52923\n\nCVE-2026-52930\n\nCVE-2026-52943\n\nCVE-2026-46083\n\nCVE-2026-46125\n\nCVE-2026-52946\n\nCVE-2026-46180\n\nCVE-2026-53168\n\nCVE-2026-53150\n\nCVE-2026-53080\n\nCVE-2026-53148\n\nCVE-2026-43303\n\nCVE-2026-53149\n\nCVE-2026-46321\n\nCVE-2026-53146\n\nCVE-2026-52947\n\nCVE-2026-52942\n\nCVE-2026-52910\n\nCVE-2026-46322\n\nCVE-2026-46086\n\nCVE-2026-45850\n\nCVE-2026-31709\n\nCVE-2026-46137\n\nCVE-2026-52948\n\nCVE-2026-46320\n\nCVE-2026-53181\n\nCVE-2026-52917\n\nCVE-2026-46196\n\nCVE-2026-53208\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53225\n\nCVE-2026-53228\n\nCVE-2026-53236\n\nCVE-2026-53212\n\nCVE-2026-53221\n\nCVE-2026-53227\n\nCVE-2026-53245\n\nCVE-2026-53249\n\nCVE-2026-53253\n\nCVE-2026-53239\n\nCVE-2026-53254\n\nCVE-2026-53242\n\nCVE-2026-53256\n\nCVE-2026-53263\n\nCVE-2026-53265\n\nCVE-2026-53264\n\nCVE-2026-53255\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53337\n\nCVE-2026-53349\n\nCVE-2026-53350\n\nCVE-2026-53352\n\nCVE-2026-53358\n\nCVE-2025-23131\n\nCVE-2026-23278\n\nCVE-2026-53356\n\nCVE-2026-31451\n\nCVE-2026-23302\n\nCVE-2026-23272\n\nCVE-2026-46331\n\nCVE-2026-52928\n\nCVE-2026-52909\n\nCVE-2026-53325\n\nCVE-2026-53167\n\nCVE-2026-53362\n\nCVE-2026-53192\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly build and run applications from trusted sources.\n\nLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-1500 TM MFP is a Technology module Multi functional platform for SIMATIC S7-1500 PLCs based on SIMATIC Industrial OS\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2023-52927\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: allow exp not to be removed in nf_ct_find_expectation\n\nCurrently nf_conntrack_in() calling nf_ct_find_expectation() will\nremove the exp from the hash table. However, in some scenario, we\nexpect the exp not to be removed when the created ct will not be\nconfirmed, like in OVS and TC conntrack in the following patches.\n\nThis patch allows exp not to be removed by setting IPS_CONFIRMED\nin the status of the tmpl.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2023-53292\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none\n\nAfter grabbing q->sysfs_lock, q->elevator may become NULL because of\nelevator switch.\n\nFix the NULL dereference on q->elevator by checking it with lock.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2023-54271\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init\n\nblk-iocost sometimes causes the following crash:\n\nBUG: kernel NULL pointer dereference, address: 00000000000000e0\n...\nRIP: 0010:_raw_spin_lock+0x17/0x30\nCode: be 01 02 00 00 e8 79 38 39 ff 31 d2 89 d0 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 65 ff 05 48 d0 34 7e b9 01 00 00 00 31 c0 0f b1 0f 75 02 5d c3 89 c6 e8 ea 04 00 00 5d c3 0f 1f 84 00 00\nRSP: 0018:ffffc900023b3d40 EFLAGS: 00010046\nRAX: 0000000000000000 RBX: 00000000000000e0 RCX: 0000000000000001\nRDX: ffffc900023b3d20 RSI: ffffc900023b3cf0 RDI: 00000000000000e0\nRBP: ffffc900023b3d40 R08: ffffc900023b3c10 R09: 0000000000000003\nR10: 0000000000000064 R11: 000000000000000a R12: ffff888102337000\nR13: fffffffffffffff2 R14: ffff88810af408c8 R15: ffff8881070c3600\nFS: 00007faaaf364fc0(0000) GS:ffff88842fdc0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000000e0 CR3: 00000001097b1000 CR4: 0000000000350ea0\nCall Trace:\n\nioc_weight_write+0x13d/0x410\ncgroup_file_write+0x7a/0x130\nkernfs_fop_write_iter+0xf5/0x170\nvfs_write+0x298/0x370\nksys_write+0x5f/0xb0\n__x64_sys_write+0x1b/0x20\ndo_syscall_64+0x3d/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis happens because iocg->ioc is NULL. The field is initialized by\nioc_pd_init() and never cleared. The NULL deref is caused by\nblkcg_activate_policy() installing blkg_policy_data before initializing it.\n\nblkcg_activate_policy() was doing the following:\n\nAllocate pd's for all existing blkg's and install them in blkg->pd[].\n\nInitialize all pd's.\n\nOnline all pd's.\n\nblkcg_activate_policy() only grabs the queue_lock and may release and\nre-acquire the lock as allocation may need to sleep. ioc_weight_write()\ngrabs blkcg->lock and iterates all its blkg's. The two can race and if\nioc_weight_write() runs during #1 or between #1 and #2, it can encounter a\npd which is not initialized yet, leading to crash.\n\nThe crash can be reproduced with the following script:\n\n#!/bin/bash\n\necho +io > /sys/fs/cgroup/cgroup.subtree_control\nsystemd-run --unit touch-sda --scope dd if=/dev/sda of=/dev/null bs=1M count=1 iflag=direct\necho 100 > /sys/fs/cgroup/system.slice/io.weight\nbash -c \"echo '8:0 enable=1' > /sys/fs/cgroup/io.cost.qos\" &\nsleep .2\necho 100 > /sys/fs/cgroup/system.slice/io.weight\n\nwith the following patch applied:\n\ndiff --git a/block/blk-cgroup.c b/block/blk-cgroup.c\nindex fc49be622e05..38d671d5e10c 100644\n--- a/block/blk-cgroup.c\n+++ b/block/blk-cgroup.c\n@@ -1553,6 +1553,12 @@ int blkcg_activate_policy(struct gendisk disk, const struct blkcg_policy pol)\npd->online = false;\n}\n\nif (system_state == SYSTEM_RUNNING) {\n\nspin_unlock_irq(&q->queue_lock);\n\nssleep(1);\n\nspin_lock_irq(&q->queue_lock);\n\n}\n+\n/ all allocated, init in the same order /\nif (pol->pd_init_fn)\nlist_for_each_entry_reverse(blkg, &q->blkg_list, q_node)\n\nI don't see a reason why all pd's should be allocated, initialized and\nonlined together. The only ordering requirement is that parent blkgs to be\ninitialized and onlined before children, which is guaranteed from the\nwalking order. Let's fix the bug by allocating, initializing and onlining pd\nfor each blkg and holding blkcg->lock over initialization and onlining. This\nensures that an installed blkg is always fully initialized and onlined\nremoving the the race window.\n\nCVSS v3.1 Base Score\n0.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2024-26982\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check the inode number is not the invalid value of zero\n\nSyskiller has produced an out of bounds access in fill_meta_index().\n\nThat out of bounds access is ultimately caused because the inode\nhas an inode number with the invalid value of zero, which was not checked.\n\nThe reason this causes the out of bounds access is due to following\nsequence of events:\n\nFill_meta_index() is called to allocate (via empty_meta_index())\nand fill a metadata index. It however suffers a data read error\nand aborts, invalidating the newly returned empty metadata index.\nIt does this by setting the inode number of the index to zero,\nwhich means unused (zero is not a valid inode number).\n\nWhen fill_meta_index() is subsequently called again on another\nread operation, locate_meta_index() returns the previous index\nbecause it matches the inode number of 0. Because this index\nhas been returned it is expected to have been filled, and because\nit hasn't been, an out of bounds access is performed.\n\nThis patch adds a sanity check which checks that the inode number\nis not zero when the inode is created and returns -EINVAL if it is.\n\n[phillip@squashfs.org.uk: whitespace fix]\n\nCVSS v3.1 Base Score\n7.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2024-36922\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq->read_ptr under lock\n\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2024-40945\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu: Return right value in iommu_sva_bind_device()\n\niommu_sva_bind_device() should return either a sva bond handle or an\nERR_PTR value in error cases. Existing drivers (idxd and uacce) only\ncheck the return value with IS_ERR(). This could potentially lead to\na kernel NULL pointer dereference issue if the function returns NULL\ninstead of an error pointer.\n\nIn reality, this doesn't cause any problems because iommu_sva_bind_device()\nonly returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA.\nIn this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will\nreturn an error, and the device drivers won't call iommu_sva_bind_device()\nat all.\n\nCVSS v3.1 Base Score\n6.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\n\nCWE\nCWE-393: Return of Wrong Status Code\n\nVulnerability CVE-2024-47809\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb->lkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2024-49998\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: improve shutdown sequence\n\nAlexander Sverdlin presents 2 problems during shutdown with the\nlan9303 driver. One is specific to lan9303 and the other just happens\nto reproduce there.\n\nThe first problem is that lan9303 is unique among DSA drivers in that it\ncalls dev_get_drvdata() at \"arbitrary runtime\" (not probe, not shutdown,\nnot remove):\n\nphy_state_machine()\n-> ...\n-> dsa_user_phy_read()\n-> ds->ops->phy_read()\n-> lan9303_phy_read()\n-> chip->ops->phy_read()\n-> lan9303_mdio_phy_read()\n-> dev_get_drvdata()\n\nBut we never stop the phy_state_machine(), so it may continue to run\nafter dsa_switch_shutdown(). Our common pattern in all DSA drivers is\nto set drvdata to NULL to suppress the remove() method that may come\nafterwards. But in this case it will result in an NPD.\n\nThe second problem is that the way in which we set\ndp->conduit->dsa_ptr = NULL; is concurrent with receive packet\nprocessing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL,\nbut afterwards, rather than continuing to use that non-NULL value,\ndev->dsa_ptr is dereferenced again and again without NULL checks:\ndsa_conduit_find_user() and many other places. In between dereferences,\nthere is no locking to ensure that what was valid once continues to be\nvalid.\n\nBoth problems have the common aspect that closing the conduit interface\nsolves them.\n\nIn the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN\nevent in dsa_user_netdevice_event() which closes user ports as well.\ndsa_port_disable_rt() calls phylink_stop(), which synchronously stops\nthe phylink state machine, and ds->ops->phy_read() will thus no longer\ncall into the driver after this point.\n\nIn the second case, dev_close(conduit) should do this, as per\nDocumentation/networking/driver.rst:\n\n| Quiescence\n| ----------\n|\n| After the ndo_stop routine has been called, the hardware must\n| not receive or transmit any data. All in flight packets must\n| be aborted. If necessary, poll or wait for completion of\n| any reset commands.\n\nSo it should be sufficient to ensure that later, when we zeroize\nconduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call\non this conduit.\n\nThe addition of the netif_device_detach() function is to ensure that\nioctls, rtnetlinks and ethtool requests on the user ports no longer\npropagate down to the driver - we're no longer prepared to handle them.\n\nThe race condition actually did not exist when commit 0650bf52b31f\n(\"net: dsa: be compatible with masters which unregister on shutdown\")\nfirst introduced dsa_switch_shutdown(). It was created later, when we\nstopped unregistering the user interfaces from a bad spot, and we just\nreplaced that sequence with a racy zeroization of conduit->dsa_ptr\n(one which doesn't ensure that the interfaces aren't up).\n\nCVSS v3.1 Base Score\n4.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2024-53166\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix bfqq uaf in bfq_limit_depth()\n\nSet new allocated bfqq to bic or remove freed bfqq from bic are both\nprotected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq\nfrom bic without the lock, this can lead to UAF if the io_context is\nshared by multiple tasks.\n\nFor example, test bfq with io_uring can trigger following UAF in v6.6:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50\n\nCall Trace:\n\ndump_stack_lvl+0x47/0x80\nprint_address_description.constprop.0+0x66/0x300\nprint_report+0x3e/0x70\nkasan_report+0xb4/0xf0\nbfqq_group+0x15/0x50\nbfqq_request_over_limit+0x130/0x9a0\nbfq_limit_depth+0x1b5/0x480\n__blk_mq_alloc_requests+0x2b5/0xa00\nblk_mq_get_new_requests+0x11d/0x1d0\nblk_mq_submit_bio+0x286/0xb00\nsubmit_bio_noacct_nocheck+0x331/0x400\n__block_write_full_folio+0x3d0/0x640\nwritepage_cb+0x3b/0xc0\nwrite_cache_pages+0x254/0x6c0\nwrite_cache_pages+0x254/0x6c0\ndo_writepages+0x192/0x310\nfilemap_fdatawrite_wbc+0x95/0xc0\n__filemap_fdatawrite_range+0x99/0xd0\nfilemap_write_and_wait_range.part.0+0x4d/0xa0\nblkdev_read_iter+0xef/0x1e0\nio_read+0x1b6/0x8a0\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork_asm+0x1b/0x30\n\nAllocated by task 808602:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\n__kasan_slab_alloc+0x83/0x90\nkmem_cache_alloc_node+0x1b1/0x6d0\nbfq_get_queue+0x138/0xfa0\nbfq_get_bfqq_handle_split+0xe3/0x2c0\nbfq_init_rq+0x196/0xbb0\nbfq_insert_request.isra.0+0xb5/0x480\nbfq_insert_requests+0x156/0x180\nblk_mq_insert_request+0x15d/0x440\nblk_mq_submit_bio+0x8a4/0xb00\nsubmit_bio_noacct_nocheck+0x331/0x400\n__blkdev_direct_IO_async+0x2dd/0x330\nblkdev_write_iter+0x39a/0x450\nio_write+0x22a/0x840\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork+0x2d/0x50\nret_from_fork_asm+0x1b/0x30\n\nFreed by task 808589:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\nkasan_save_free_info+0x27/0x40\n__kasan_slab_free+0x126/0x1b0\nkmem_cache_free+0x10c/0x750\nbfq_put_queue+0x2dd/0x770\n__bfq_insert_request.isra.0+0x155/0x7a0\nbfq_insert_request.isra.0+0x122/0x480\nbfq_insert_requests+0x156/0x180\nblk_mq_dispatch_plug_list+0x528/0x7e0\nblk_mq_flush_plug_list.part.0+0xe5/0x590\n__blk_flush_plug+0x3b/0x90\nblk_finish_plug+0x40/0x60\ndo_writepages+0x19d/0x310\nfilemap_fdatawrite_wbc+0x95/0xc0\n__filemap_fdatawrite_range+0x99/0xd0\nfilemap_write_and_wait_range.part.0+0x4d/0xa0\nblkdev_read_iter+0xef/0x1e0\nio_read+0x1b6/0x8a0\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork+0x2d/0x50\nret_from_fork_asm+0x1b/0x30\n\nFix the problem by protecting bic_to_bfqq() with bfqd->lock.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n7.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2024-56647\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix icmp host relookup triggering ip_rt_bug\n\narp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:\n\nWARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20\nModules linked in:\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:ip_rt_bug+0x14/0x20\nCall Trace:\n\nip_send_skb+0x14/0x40\n__icmp_send+0x42d/0x6a0\nipv4_link_failure+0xe2/0x1d0\narp_error_report+0x3c/0x50\nneigh_invalidate+0x8d/0x100\nneigh_timer_handler+0x2e1/0x330\ncall_timer_fn+0x21/0x120\n__run_timer_base.part.0+0x1c9/0x270\nrun_timer_softirq+0x4c/0x80\nhandle_softirqs+0xac/0x280\nirq_exit_rcu+0x62/0x80\nsysvec_apic_timer_interrupt+0x77/0x90\n\nThe script below reproduces this scenario:\nip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \\\ndir out priority 0 ptype main flag localok icmp\nip l a veth1 type veth\nip a a 192.168.141.111/24 dev veth0\nip l s ", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourcePath": "body:advisory", "text": "SSA-794185\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products\n\nPublication Date:\n\n2025-05-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.4\n\nCVSS v3.1 Base Score:\n9.0\n\nCVSS v4.0 Base Score:\n9.1\n\nSUMMARY\n\nThis advisory documents the impact of CVE-2024-3596 (also dubbed \"Blastradius\"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products.\n\nThe vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an \"Access-Reject\" message into an \"Access-Accept\". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials).\n\nFurther details incl. external references can be found in the chapter \"Additional Information\".\nSiemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter \"Additional Information\".\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.See chapter \"Additional Information\" for details.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nCPC80 Central Processing/Communication\n\nAll versions < V16.51\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V16.51 or later version\n\nSee further recommendations from section\nMitigations\n\nCPCI85 Central Processing/Communication\n\nAll versions < V6.20\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V6.20 or later version\n\nSee further recommendations from section\nMitigations\n\nPOWER METER SICAM Q100 family\n\nAll versions < V2.70\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V2.70 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109743524/\n\nSee further recommendations from section\nMitigations\n\nPOWER METER SICAM Q200 family\n\nAll versions < V2.83\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V2.83 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109743592/\n\nSee further recommendations from section\nMitigations\n\nPowerlink IP\n\nAll versions < V4.23\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V4.23 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109986527/\n\nSee further recommendations from section\nMitigations\n\nSICAM GridPass\n\nAll versions < V2.50\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V2.50 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763384/\n\nSee further recommendations from section\nMitigations\n\nSICORE Base system\n\nAll versions < V2.20.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V2.20.0 or later version\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIPROTEC 5 - CP100 Devices\n\nShow more details\n\nSIPROTEC 5 7SA82 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SD82 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SJ81 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109751934/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SJ82 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109751934/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SK82 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757434/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SL82 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7UT82 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757438/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIPROTEC 5 - CP150 Devices\n\nShow more details\n\nSIPROTEC 5 7SA82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SD82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SJ81 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109751934/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SJ82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109751934/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SK82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757434/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SL82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SX82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109768011/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SY82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109804070/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7UT82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757438/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIPROTEC 5 - CP300 Devices\n\nShow more details\n\nSIPROTEC 5 6MD84 (CP300)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109814150/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 6MD85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757428/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 6MD86 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757428/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 6MD89 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109742950/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 6MD89 (CP300) V9.6x\n\nAll versions < V9.68\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V9.68 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109742950/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 6MU85 (CP300)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109765263/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7KE85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757430/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SA86 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SA87 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757432/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SD86 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SD87 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757432/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SJ85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109751934/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SJ86 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SK85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757434/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SL86 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SL87 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757432/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SS85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757429/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7ST85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109740299/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7ST85 (CP300) V9.6x\n\nAll versions < V9.68\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V9.68 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109740299/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7ST86 (CP300)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109768428/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7ST86 (CP300) V9.8x\n\nAll versions < V9.83\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V9.83 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109768428/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SX85 (CP300)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109768011/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7UM85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757431/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7UT85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757438/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7UT86 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757438/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7UT87 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757438/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7VE85 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109749865/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7VK87 (CP300)\n\nAll versions >= V7.80 < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757432/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7VU85 (CP300)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109800399/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 Compact 7SX800 (CP050)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109796884/\n\nSee further recommendations from section\nMitigations\n\nKNOWN NOT AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nKnown Not Affected Products\nReason\n\nSICAM AK 3\n\nAll versions\n\nnot affected by\n\nCVE-2024-3596\n\nThe product does not support the RADIUS protocol. (Vulnerable Code Not Present)\n\nSICAM BC\n\nAll versions\n\nnot affected by\n\nCVE-2024-3596\n\nThe product does not support the RADIUS protocol. (Vulnerable Code Not Present)\n\nSICAM GridEdge (Classic)\n\nAll versions\n\nnot affected by\n\nCVE-2024-3596\n\nThe product includes a component which also supports the RADIUS protocol, but the product doesn't enable or support RADIUS. (Vulnerable Code Not in Execute Path)\n\nSICAM GridEdge Applications for SICAM 8 Platform\n\nAll versions\n\nnot affected by\n\nCVE-2024-3596\n\nThe product does not support the RADIUS protocol. (Vulnerable Code Not Present)\n\nSICAM TM\n\nAll versions\n\nnot affected by\n\nCVE-2024-3596\n\nThe product does not support the RADIUS protocol. (Vulnerable Code Not Present)\n\nSIPROTEC 5 - CP200 Devices\n\nAll versions\n\nnot affected by\n\nCVE-2024-3596\n\nThe product does not support the RADIUS protocol. (Vulnerable Code Not Present)\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nConfigure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it\n\nRestrict access to the networks where RADIUS messages are exchanged (e.g., send RADIUS traffic via management network or a dedicated VLAN)\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nOperators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment.\nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\nhttps://www.siemens.com/gridsecurity\n\nPRODUCT DESCRIPTION\n\nCPCI85 is a robust, high-performance central processing and communication unit used as a component within SICAM A8000 CP-8031/CP-8050 Devices and SICAM EGS.\n\nPOWER METER SICAM Q100 is a multifunctional device for detecting, reporting, and analyzing measured values and events.\n\nPOWER METER SICAM Q200 is a multifunctional device for detecting, reporting, and analyzing measured values and events.\n\nPowerlink IP is a powerline carrier system utilizing high-voltage lines for providing a cost-effective communication path for data, teleprotection, and voice.\n\nSICAM AK 3 is a telecontrol and automation device facilitating the automation of diverse processes across widely distributed systems.\n\nSICAM BC is a bay control device with a standardized communication interface.\n\nSICAM GridEdge adds IoT functionality to existing IEC61850 equipment, using various international standards (MQTT, OPC UA Pub/Sub (IEC 62451), IEC61850) to connect with cloud platforms (e.g., Siemens MindSphere, Microsoft Azure) or self-hosted platforms.\n\nSICAM GridPass is an easy to manage PKI (public key infrastructure) product which creates and manages X.509 standardized certificates.\n\nSICAM TM is an automation and telecontrol system with a standardized communication interface.\n\nSICORE is the underlying engine responsible for executing critical functions within SICAM A8000 CP-8010/CP-8012 devices and the SICAM S8000.\n\nSIPROTEC 5 and SIPROTEC 5 Compact devices provide a range of integrated protection, control, measurement, and automation functions for electrical substations and other fields of application.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-3596\n\nRADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify responses Access-Reject or Access-Accept using a chosen-prefix collision attack against MD5 Response Authenticator signature.\n\nCVSS v3.1 Base Score\n9.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n9.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H\n\nCWE\nCWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel\n\nADDITIONAL INFORMATION\n\nAffected software or firmware for several SICAM products are as follows:\n\nSICAM A8000 Device firmware\n\nCPC80 for CP-8000/CP-8021/CP-8022\nThe fix version CPC80 V16.51 is present within \"SICAM A8000 CP-8000, CP-8021, CP-8022 Package\" ( https://support.industry.siemens.com/cs/ww/en/view/109812178/ ) V16.51\n\nCPCI85 for CP-8031/CP-8050\nThe fix version CPCI85 V6.20 is present within \"CP-8031/CP-8050 Package\" ( https://support.industry.siemens.com/cs/ww/en/view/109804985/ V6.20\n\nSICORE for CP-8010/CP-8012\nThe fix version SICORE V2.20.0 is present within \"SICAM A8000 CP-8010 / CP-8012 Package\" ( https://support.industry.siemens.com/cs/ww/en/view/109972894/ ) V6.20\n\nSICAM EGS Device firmware\n\nCPCI85\nThe fix version CPCI85 V6.20 is present within \"SICAM EGS Package\" ( https://support.industry.siemens.com/cs/ww/en/view/109972536/ V6.20\n\nSICAM S8000\n\nSICORE\nThe fix version SICORE V2.20.0 is present within \"SICAM S8000 Package\" ( https://support.industry.siemens.com/cs/ww/en/view/109818240/ ) V6.20\n\nDescription of the Vulnerability\n\nThe vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., SICAM or SIPROTEC 5 devices) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an \"Access-Reject\" message into an \"Access-Accept\". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials).\n\nSuccessful attacks are demonstrated against RADIUS/UDP (IETF RFC 2865), similar attacks are considered possible against RADIUS/TCP (IETF RFC 6613).\nRADIUS/TLS (IETF RFC 6614) and RADIUS/DTLS (IETF RFC 7360) are not vulnerable.\n\nImpact to SICAM, SIPROTEC 5 and related Products, Countermeasures\n\nSICAM, SIPROTEC 5 and related devices use RADIUS/UDP for user authentication and are therefore considered vulnerable.\n\nTo fix the issue, specific countermeasures are required on both RADIUS client and RADIUS server side. The affected products listed in this advisory can operate as RADIUS clients but not as RADIUS servers. The requirements S1 - S3 listed below are therefore not applicable.\n\nIn the context of this advisory, RADIUS clients (i.e., SICAM, SIPROTEC 5 and related devices) need to:\n\nC1. Ensure that all Access-Request packets they send to the server contain a Message-Authenticator attribute.\n\nC2. Check all Access-accept, Access-Reject, and Access-Challenge packets coming from a RADIUS server for the presence of a Message-Authenticator attribute (see S1); submit an entry in the client's error log, if the attribute is missing. This supports operators to identify outdated RADIUS servers in their deployment, that haven't yet implemented or configured S1.\n\nRADIUS servers need to:\n\nS1. Ensure that all replies to Access-Request packets contain a Message-Authenticator attribute as the first attribute in the packet.\n\nS2. Implement a per-client configuration flag which requires that all Access-Request packets coming from a client must contain a Message-Authenticator attribute.\n\nS3. If the server is also configured as a proxy (i.e., forwards certain client Access-Requests to another RADIUS server): Ensure that all proxied Access-Request packets contain a Message-Authenticator attribute.\n\nThe issue is fully mitigated only, if all recommendations are enforced in all RADIUS clients and servers. However, every individual recommendation decreases the likelihood of a successful attack.\n\nStatus\n\nSIPROTEC 5 CP100 devices: C1 and C2 are implemented in V8.90 or later V8.xx version. Update to V8.90 or later V8.xx version and enable S1 and S2 on the RADIUS server(s) in your deployment. Check the device's security log for entries containing \"RADIUS server response without Message-Authenticator\" to determine insecurely configured RADIUS servers.\n\nSIPROTEC 5 CP150 and CP300 devices: C1 and C2 are implemented in V10.0 or later. Update to V10.0 or later and enable S1 and S2 on the RADIUS server(s) in your deployment. Check the device's security log for entries containing \"RADIUS server response without Message-Authenticator\" to determine insecurely configured RADIUS servers.\n\nSIPROTEC 5 6MD89 (CP300) V9.6x and 7ST85 (CP300) V9.6x: C1 and C2 are implemented in V9.68. Update to V9.68 and enable S1 and S2 on the RADIUS server(s) in your deployment. Check the device's security log for entries containing \"RADIUS server response without Message-Authenticator\" to determine insecurely configured RADIUS servers.\n\nSIPROTEC 5 7ST86 (CP300) V9.8x: C1 and C2 are implemented in V", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-3596" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "sourcePath": "body:advisory", "text": "SSA-794697\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1\n\nPublication Date:\n\n2023-06-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.9\n\nCVSS v3.1 Base Score:\n9.8\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.0.\n\nSiemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version.\n\nSIMATIC S7-1500 TM MFP V1.0 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nThis advisory lists vulnerabilities for firmware version V1.0 only; for V1.1 refer to Siemens Security Advisory SSA-265688 ( https://cert-portal.siemens.com/productcert/html/ssa-265688.html ).\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions < V1.1\n\naffected by\n\nall CVEs\n\nCVE-2021-3759\n\nCVE-2021-4037\n\nCVE-2021-33655\n\nCVE-2022-0171\n\nCVE-2022-1012\n\nCVE-2022-1015\n\nCVE-2022-1184\n\nCVE-2022-1292\n\nCVE-2022-1343\n\nCVE-2022-1434\n\nCVE-2022-1462\n\nCVE-2022-1473\n\nCVE-2022-1679\n\nCVE-2022-1852\n\nCVE-2022-1882\n\nCVE-2022-2068\n\nCVE-2022-2078\n\nCVE-2022-2097\n\nCVE-2022-2153\n\nCVE-2022-2274\n\nCVE-2022-2327\n\nCVE-2022-2503\n\nCVE-2022-2586\n\nCVE-2022-2588\n\nCVE-2022-2602\n\nCVE-2022-2663\n\nCVE-2022-2905\n\nCVE-2022-2959\n\nCVE-2022-2978\n\nCVE-2022-3028\n\nCVE-2022-3104\n\nCVE-2022-3115\n\nCVE-2022-3169\n\nCVE-2022-3303\n\nCVE-2022-3521\n\nCVE-2022-3524\n\nCVE-2022-3534\n\nCVE-2022-3545\n\nCVE-2022-3564\n\nCVE-2022-3565\n\nCVE-2022-3586\n\nCVE-2022-3594\n\nCVE-2022-3606\n\nCVE-2022-3621\n\nCVE-2022-3625\n\nCVE-2022-3628\n\nCVE-2022-3629\n\nCVE-2022-3633\n\nCVE-2022-3635\n\nCVE-2022-3646\n\nCVE-2022-3649\n\nCVE-2022-4095\n\nCVE-2022-4129\n\nCVE-2022-4139\n\nCVE-2022-4269\n\nCVE-2022-4304\n\nCVE-2022-4450\n\nCVE-2022-4662\n\nCVE-2022-20421\n\nCVE-2022-20422\n\nCVE-2022-20566\n\nCVE-2022-20572\n\nCVE-2022-21123\n\nCVE-2022-21125\n\nCVE-2022-21166\n\nCVE-2022-21505\n\nCVE-2022-26373\n\nCVE-2022-32250\n\nCVE-2022-32296\n\nCVE-2022-34918\n\nCVE-2022-36123\n\nCVE-2022-36280\n\nCVE-2022-36879\n\nCVE-2022-36946\n\nCVE-2022-39188\n\nCVE-2022-39190\n\nCVE-2022-40307\n\nCVE-2022-40768\n\nCVE-2022-41218\n\nCVE-2022-41222\n\nCVE-2022-41674\n\nCVE-2022-41849\n\nCVE-2022-41850\n\nCVE-2022-42328\n\nCVE-2022-42329\n\nCVE-2022-42432\n\nCVE-2022-42703\n\nCVE-2022-42719\n\nCVE-2022-42720\n\nCVE-2022-42721\n\nCVE-2022-42722\n\nCVE-2022-42895\n\nCVE-2022-42896\n\nCVE-2022-43750\n\nCVE-2022-47518\n\nCVE-2022-47520\n\nCVE-2022-47929\n\nCVE-2022-47946\n\nCVE-2023-0215\n\nCVE-2023-0286\n\nCVE-2023-0464\n\nCVE-2023-0465\n\nCVE-2023-0466\n\nCVE-2023-0590\n\nCVE-2023-1077\n\nCVE-2023-1095\n\nCVE-2023-3141\n\nCVE-2023-3268\n\nCVE-2023-3338\n\nCVE-2023-3389\n\nCVE-2023-3446\n\nCVE-2023-3609\n\nCVE-2023-23454\n\nCVE-2023-23455\n\nCVE-2023-23559\n\nCVE-2023-26607\n\nCVE-2023-31436\n\nCVE-2023-32233\n\nCVE-2023-4911\n\nCVE-2023-37453\n\nCVE-2023-39192\n\nCVE-2023-39193\n\nCVE-2023-42753\n\nCVE-2023-42755\n\nCVE-2023-4623\n\nCVE-2023-4921\n\nCVE-2023-3610\n\nCVE-2023-35001\n\nCVE-2023-3611\n\nCVE-2023-2898\n\nCVE-2023-4004\n\nCVE-2023-3777\n\nCVE-2023-1206\n\nCVE-2023-4015\n\nCVE-2023-4273\n\nCVE-2023-39194\n\nCVE-2023-3772\n\nCVE-2023-3773\n\nCVE-2021-44879\n\nCVE-2023-5178\n\nCVE-2023-5197\n\nCVE-2023-5678\n\nCVE-2023-5717\n\nCVE-2023-31085\n\nCVE-2023-35827\n\nCVE-2023-39189\n\nCVE-2023-42754\n\nCVE-2023-45863\n\nCVE-2023-45871\n\nCVE-2023-48795\n\nCVE-2020-12762\n\nCVE-2023-6606\n\nCVE-2023-6931\n\nCVE-2023-6932\n\nCVE-2023-7008\n\nCVE-2023-7104\n\nCVE-2023-36660\n\nCVE-2023-50495\n\nCVE-2023-51384\n\nCVE-2023-51385\n\nCVE-2023-51767\n\nCVE-2024-0232\n\nCVE-2024-0553\n\nCVE-2024-0567\n\nCVE-2024-0584\n\nCVE-2024-0684\n\nCVE-2024-22365\n\nCVE-2024-25062\n\nUpdate to V1.1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109827684/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2022-4304\n\nDisable the use of RSA ciphers in the web server configuration; note that RSA ciphers are disabled by default\n\nCVE-2022-4450\n\nDo not import or configure certificate files in PEM format from untrusted sources\n\nCVE-2023-0286\n\nDisable CRL (certification revocation list) checking, if possible\n\nOnly build and run applications from trusted sources\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-1500 TM MFP is a Technology module Multi functional platform for SIMATIC S7-1500 PLCs based on SIMATIC Industrial OS\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2020-12762\n\njson-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-190: Integer Overflow or Wraparound\n\nVulnerability CVE-2021-3759\n\nA memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-400: Uncontrolled Resource Consumption\n\nVulnerability CVE-2021-4037\n\nA vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-284: Improper Access Control\n\nVulnerability CVE-2021-33655\n\nWhen sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2021-44879\n\nIn gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2022-0171\n\nA flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-459: Incomplete Cleanup\n\nVulnerability CVE-2022-1012\n\nA memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.\n\nCVSS v3.1 Base Score\n8.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-401: Missing Release of Memory after Effective Lifetime\n\nVulnerability CVE-2022-1015\n\nA flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.\n\nCVSS v3.1 Base Score\n6.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2022-1184\n\nA use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2022-1292\n\nThe c_rehash script does not properly sanitise shell metacharacters to prevent command injection.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\nVulnerability CVE-2022-1343\n\nUnder certain circumstances, the command line OCSP verify function reports successful verification when the verification in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C\n\nCWE\nCWE-295: Improper Certificate Validation\n\nVulnerability CVE-2022-1434\n\nWhen using the RC4-MD5 ciphersuite, which is disabled by default, an attacker is able to modify data in transit due to an incorrect use of the AAD data as the MAC key in OpenSSL 3.0. An attacker is not able to decrypt any communication.\n\nCVSS v3.1 Base Score\n5.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C\n\nCWE\nCWE-327: Use of a Broken or Risky Cryptographic Algorithm\n\nVulnerability CVE-2022-1462\n\nAn out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.\n\nCVSS v3.1 Base Score\n6.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\nVulnerability CVE-2022-1473\n\nThe used OpenSSL version improperly reuses memory when decoding certificates or keys. This can lead to a process termination and Denial of Service for long lived processes.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-404: Improper Resource Shutdown or Release\n\nVulnerability CVE-2022-1679\n\nA use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2022-1852\n\nA NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2022-1882\n\nA use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2022-2068\n\nIn addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\nVulnerability CVE-2022-2078\n\nA vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and possibly to run code.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2022-2097\n\nAES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C\n\nCWE\nCWE-326: Inadequate Encryption Strength\n\nVulnerability CVE-2022-2153\n\nA flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2022-2274\n\nThe OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2022-2327\n\nio_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-415: Double Free\n\nVulnerability CVE-2022-2503\n\nDm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-287: Improper Authentication\n\nVulnerability CVE-2022-2586\n\nA use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2022-2588\n\nZhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-415: Double Free\n\nVulnerability CVE-2022-2602\n\nA flaw was found in the Linux kernel. A race issue occurs between an io_uring request and the Unix socket garbage collector, allowing an attacker local privilege escalation.\n\nCVSS v3.1 Base Score\n7.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2022-2663\n\nAn issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\n\nCWE\nCWE-923: Improper Restriction of Communication Channel to Intended Endpoints\n\nVulnerability CVE-2022-2905\n\nAn out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2022-2959\n\nA race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system.\n\nCVSS v3.1 Base Score\n7.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\nVulnerability CVE-2022-2978\n\nA flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2022-3028\n\nA race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.\n\nCVSS v3.1 Base Score\n7.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\nVulnerability CVE-2022-3104\n\nAn issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2022-3115\n\nAn issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2022-3169\n\nA flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2022-3303\n\nA race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition\n\nCVSS v3.1 Base Score\n4.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C\n\nCWE\nCWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\nVulnerability CVE-2022-3521\n\nA vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.\n\nCVSS v3.1 Base Score\n2.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C\n\nCWE\nCWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\nVulnerability CVE-2022-3524\n\nA vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-404: Improper Resource Shutdown or Release\n\nVulnerability CVE-2022-3534\n\nA vulnerability classified as critical has been found in Linux Kernel. Affected is the functio", "truncated": true, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2021-3759", "CVE-2021-4037", "CVE-2021-33655", "CVE-2022-0171", "CVE-2022-1012", "CVE-2022-1015", "CVE-2022-1184", "CVE-2022-1292", "CVE-2022-1343", "CVE-2022-1434", "CVE-2022-1462", "CVE-2022-1473", "CVE-2022-1679", "CVE-2022-1852", "CVE-2022-1882", "CVE-2022-2068", "CVE-2022-2078", "CVE-2022-2097", "CVE-2022-2153", "CVE-2022-2274", "CVE-2022-2327", "CVE-2022-2503", "CVE-2022-2586", "CVE-2022-2588", "CVE-2022-2602", "CVE-2022-2663", "CVE-2022-2905", "CVE-2022-2959", "CVE-2022-2978", "CVE-2022-3028", "CVE-2022-3104", "CVE-2022-3115", "CVE-2022-3169", "CVE-2022-3303", "CVE-2022-3521", "CVE-2022-3524", "CVE-2022-3534", "CVE-2022-3545", "CVE-2022-3564", "CVE-2022-3565", "CVE-2022-3586", "CVE-2022-3594", "CVE-2022-3606", "CVE-2022-3621", "CVE-2022-3625", "CVE-2022-3628", "CVE-2022-3629", "CVE-2022-3633", "CVE-2022-3635", "CVE-2022-3646", "CVE-2022-3649", "CVE-2022-4095", "CVE-2022-4129", "CVE-2022-4139", "CVE-2022-4269", "CVE-2022-4304", "CVE-2022-4450", "CVE-2022-4662", "CVE-2022-20421", "CVE-2022-20422", "CVE-2022-20566", "CVE-2022-20572", "CVE-2022-21123", "CVE-2022-21125", "CVE-2022-21166", "CVE-2022-21505", "CVE-2022-26373", "CVE-2022-32250", "CVE-2022-32296", "CVE-2022-34918", "CVE-2022-36123", "CVE-2022-36280", "CVE-2022-36879", "CVE-2022-36946", "CVE-2022-39188", "CVE-2022-39190", "CVE-2022-40307", "CVE-2022-40768", "CVE-2022-41218", "CVE-2022-41222", "CVE-2022-41674", "CVE-2022-41849", "CVE-2022-41850", "CVE-2022-42328", "CVE-2022-42329", "CVE-2022-42432", "CVE-2022-42703", "CVE-2022-42719", "CVE-2022-42720", "CVE-2022-42721", "CVE-2022-42722", "CVE-2022-42895", "CVE-2022-42896", "CVE-2022-43750", "CVE-2022-47518", "CVE-2022-47520", "CVE-2022-47929", "CVE-2022-47946", "CVE-2023-0215", "CVE-2023-0286", "CVE-2023-0464", "CVE-2023-0465", "CVE-2023-0466", "CVE-2023-0590", "CVE-2023-1077", "CVE-2023-1095", "CVE-2023-3141", "CVE-2023-3268", "CVE-2023-3338", "CVE-2023-3389", "CVE-2023-3446", "CVE-2023-3609", "CVE-2023-23454", "CVE-2023-23455", "CVE-2023-23559", "CVE-2023-26607", "CVE-2023-31436", "CVE-2023-32233", "CVE-2023-4911", "CVE-2023-37453", "CVE-2023-39192", "CVE-2023-39193", "CVE-2023-42753", "CVE-2023-42755", "CVE-2023-4623", "CVE-2023-4921", "CVE-2023-3610", "CVE-2023-35001", "CVE-2023-3611", "CVE-2023-2898", "CVE-2023-4004", "CVE-2023-3777", "CVE-2023-1206", "CVE-2023-4015", "CVE-2023-4273", "CVE-2023-39194", "CVE-2023-3772", "CVE-2023-3773", "CVE-2021-44879", "CVE-2023-5178", "CVE-2023-5197", "CVE-2023-5678", "CVE-2023-5717", "CVE-2023-31085", "CVE-2023-35827", "CVE-2023-39189", "CVE-2023-42754", "CVE-2023-45863", "CVE-2023-45871", "CVE-2023-48795", "CVE-2020-12762", "CVE-2023-6606", "CVE-2023-6931", "CVE-2023-6932", "CVE-2023-7008", "CVE-2023-7104", "CVE-2023-36660", "CVE-2023-50495", "CVE-2023-51384", "CVE-2023-51385", "CVE-2023-51767", "CVE-2024-0232", "CVE-2024-0553", "CVE-2024-0567", "CVE-2024-0584", "CVE-2024-0684", "CVE-2024-22365", "CVE-2024-25062", "CVE-2018-13405", "CVE-2023-3817", "CVE-2023-5981" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourcePath": "body:advisory", "text": "SSA-800126\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20\n\nPublication Date:\n\n2024-12-10\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n7.8\n\nCVSS v4.0 Base Score:\n8.4\n\nSUMMARY\n\nAffected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nSiemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter \"Additional Information\" below for more details.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-PLCSIM\n\nShow more details\n\nSIMATIC S7-PLCSIM V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V16\n\nShow more details\n\nSIMATIC STEP 7 Safety V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC STEP 7 V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Unified V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V17\n\nShow more details\n\nSIMATIC STEP 7 Safety V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC STEP 7 V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Unified V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V17 Update 9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V17\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.4\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V17\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V18\n\nShow more details\n\nSIMATIC STEP 7 Safety V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC STEP 7 V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Unified V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V18\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.5\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V18\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V18 (TIA Portal)\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817575/\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V18 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V18\n\nAll versions < V6.3.0.2\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V6.3.0.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V19\n\nShow more details\n\nSIMATIC STEP 7 Safety V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC STEP 7 V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC Unified V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nSee further recommendations from section\nMitigations\n\nSIMOCODE ES V19\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.6\n\nAll versions < V5.6 SP1 HF7\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V5.6 SP1 HF7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989067/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V19\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Soft Starter ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2024-49849\n\nTIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nAvoid opening untrusted files from unknown sources in affected products\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMATIC STEP 7 Safety Basic / Advanced is the high-performance add-on package for programming of fail-safe S7 controllers for the Totally Integrated Automation Portal\n\nSIMOCODE ES is the central software package for the configuration, commissioning, operation, and diagnosis of SIMOCODE pro.\r\nThe software is based on the Totally Integrated Automation Portal (TIA Portal) central engineering framework and can be seamlessly integrated if additional TIA Portal-based software such as STEP 7 and WinCC is present.\n\nSIMOTION SCOUT TIA is the add-in for TIA Portal for commissioning of SIMOTION devices.\n\nSINAMICS Startdrive commissioning software is the engineering tool for integration of SINAMICS drives in TIA Portal.\n\nSIRIUS Safety ES is the central software package for the configuration, commissioning, operation, and diagnosis of 3SK2 safety relays. The software is based on the Totally Integrated Automation Portal (TIA Portal) central engineering framework and can be seamlessly integrated if additional TIA Portal-based software such as STEP 7 and WinCC is present, thus providing the user with a consistent, efficient, and intuitive solution to all automation tasks. Those using SIRIUS Safety ES as standalone software will also enjoy its benefits.\n\nTIA Portal Cloud makes it possible to use the main packages as well as the main option packages of TIA Portal in a virtualized environment. Local projects can be transferred to the cloud and loaded back again via a file share service.\n\nTotally Integrated Automation Portal (TIA Portal) is a PC software that provides access to the complete range of Siemens digitalized automation services, from digital planning and integrated engineering to transparent operation.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-49849\n\nAffected products do not properly sanitize user-controllable input when parsing log files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\n\nCVSS v4.0 Base Score\n8.4\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-502: Deserialization of Untrusted Data\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following parties for their efforts:\n\nPeter Cheng from Elex Feigong Research Institute for coordinated disclosure of CVE-2024-49849\n\nChengBin Wang and Yuan Li from Zhejiang Guoli Network Security Technology for coordinated disclosure of CVE-2024-49849\n\nADDITIONAL INFORMATION\n\nProducts based on the Totally Integrated Automation Portal (TIA Portal) V20 [1] are not affected by CVE-2024-49849.\n\n[1] https://support.industry.siemens.com/cs/document/109963850\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2024-12-10):\n\nPublication Date\n\nV1.1 (2025-08-12):\n\nAdded fix for Totally Integrated Automation Portal (TIA Portal) V19; Name of SIMOTION SCOUT TIA V5.6 SP1 was updated to SIMOTION SCOUT TIA V5.6 and Name of SIMOTION SCOUT TIA V5.5 SP1 was updated to SIMOTION SCOUT TIA V5.5; Removed entry for SIMOTION SCOUT TIA V5.4 SP1 as the product is renamed to SIMOTION SCOUT TIA V5.4 which is mentioned in TIA portal; Name of SIMOTION SCOUT TIA V5.4 SP3 was updated to SIMOTION SCOUT TIA V5.4\n\nV1.2 (2025-12-09):\n\nAdded fix for Totally Integrated Automation Portal (TIA Portal) V17\n\nV1.3 (2026-10-13):\n\nAdded fix version for SIMATIC STEP 7 Safety V18, SIMATIC STEP 7 V18, SIMATIC WinCC Unified V18, SIMATIC WinCC V18, TIA Portal Cloud V18\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-800126\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-49849" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourcePath": "body:advisory", "text": "SSA-832641\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.1\n\nCVSS v4.0 Base Score:\n8.9\n\nSUMMARY\n\nSiemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge Cloud Device (IECD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28.1/industrial-edge-virtual/cloud-device/release-notes\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Own Device (IEOD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28.1/industrial-edge-own-device/release-notes\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Virtual Device (IEVD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28.1/industrial-edge-virtual/cloud-device/release-notes\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9413 (6GK5998-3GS01-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2026-44414\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9433 (6GK5998-3GS11-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2026-44414\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC HMI Operator Device\n\nShow more details\n\nExpand children\n\nSIMATIC Advanced HMI Panel\n\nShow more details\n\nExpand children\n\nSIMATIC HMI Unified Comfort Panels family\n\nShow more details\n\nExpand children\n\nSIMATIC HMI Unified Comfort Panel PRO family\n\nShow more details\n\nSIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC HMI Unified Comfort Panels Hygienic family\n\nShow more details\n\nSIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC HMI Unified Comfort Panels Standard family\n\nShow more details\n\nSIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIPLUS HMI Unified Comfort Panels Standard family\n\nShow more details\n\nSIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2)\n\nAll versions < V1.28.1-2\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1-2 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28/one-db-simatic-iot2050-industrial-edge-device/all-release-notes/release-notes-v1.28\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2)\n\nAll versions < V1.28.1-2\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1-2 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28/one-db-simatic-iot2050-industrial-edge-device/all-release-notes/release-notes-v1.28\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC127E Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V3.2.0-17 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v3.2/simatic-ipc-ied-os/all-release-notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC227E Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V3.2.0-17 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v3.2/simatic-ipc-ied-os/all-release-notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC227G Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V3.2.0-17 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v3.2/simatic-ipc-ied-os/all-release-notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC427E Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V3.2.0-17 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v3.2/simatic-ipc-ied-os/all-release-notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC847E Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V3.2.0-17 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v3.2/simatic-ipc-ied-os/all-release-notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC BX-21A Industrial Edge Device\n\nAll versions < V1.28.1-2\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1-2 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28/one-db-simatic-ipc-industrial-edge-device/all-release-notes/release-notes-v1.28\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC BX-39A Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V3.2.0-17 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v3.2/simatic-ipc-ied-os/all-release-notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC BX-59A Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V3.2.0-17 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v3.2/simatic-ipc-ied-os/all-release-notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nEnsure network access to affected products is limited to trusted parties only\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nIndustrial Edge Cloud Device (IECD) offers you the Industrial Edge Device functionality on demand and without the need of dedicated physical hardware devices.\n\nIndustrial Edge Own Device (IEOD) offers the Industrial Edge functionality and user experience on top of hardware by customer-choice.\n\nIndustrial Edge represents an open, ready-to-use Edge computing platform consisting of Edge devices, Edge apps, Edge connectivity, and an application and device management infrastructure.\n\nIndustrial Edge Virtual Device (IEVD) offers you the Industrial Edge Device functionality without the need of dedicated physical hardware devices.\n\nSCALANCE LPE9000 (Local Processing Engine) extends the SCALANCE family portfolio by a component that provides computing power for a wide range of applications in the network, close to the process – Edge Computing.\n\nSIMATIC HMI Panels are used for operator control and monitoring of machines and plants.\n\nSIMATIC IPC Industrial Edge devices are industrial PCs that are pre-configured with the Industrial Edge Device software.\n\nThe devices of the SIMATIC IOT family offer a robust, compact and flexible solution with a\r\nfocus on the IOT environment and round off the SIMATIC IPC product range in the lower\r\noutput range.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-44414\n\nAffected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system.\n\nCVSS v3.1 Base Score\n6.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\n\nCVSS v4.0 Base Score\n6.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N\n\nCWE\nCWE-35: Path Traversal: '.../...//'\n\nVulnerability CVE-2026-44415\n\nAffected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.\n\nCVSS v3.1 Base Score\n9.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n\nCWE\nCWE-35: Path Traversal: '.../...//'\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-832641\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-44414", "CVE-2026-44415" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "sourcePath": "body:advisory", "text": "SSA-858251\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-858251: Authentication Bypass Vulnerabilities in OPC UA\n\nPublication Date:\n\n2025-03-11\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n9.1\n\nSUMMARY\n\nThe products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge for Machine Tools (formerly known as \"SINUMERIK Edge\")\n\nAll versions\n\naffected by\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC Energy Manager PRO\n\nShow more details\n\nSIMATIC Energy Manager PRO V7.2\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nSIMATIC Energy Manager PRO V7.3\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nSIMATIC Energy Manager PRO V7.4\n\nAll versions >= V7.4 Update 0 < V7.4 Update 7\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nUpdate to V7.4 Update 7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109997044/\n\nSIMATIC Energy Manager PRO V7.5\n\nAll versions >= V7.5 Update 0 < V7.5 Update 2\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nUpdate to V7.5 Update 2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109996728/\n\nSIMATIC IPC DiagMonitor\n\nAll versions\n\naffected by\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nPlease note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default. Systems running with default configuration are therefore not affected by this vulnerability.\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 3\n\naffected by\n\nCVE-2024-42513\n\nUpdate to V8.0 Update 3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSIMIT V11\n\nAll versions < V11.3\n\naffected by\n\nCVE-2024-42512\n\nUpdate to V11.3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987184/\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nSIMATIC WinCC Unified V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-42513\n\nUpdate to V18 Update 6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nPlease note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default in Unified RT. Systems running with default configuration are therefore not affected by this vulnerability.\n\nSIMATIC WinCC Unified V19\n\nAll versions < V19 Update 4\n\naffected by\n\nCVE-2024-42513\n\nUpdate to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109925643/\n\nPlease note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default in Unified RT. Systems running with default configuration are therefore not affected by this vulnerability.\n\nKNOWN NOT AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nKnown Not Affected Products\nReason\n\nSIMATIC BRAUMAT\n\nAll versions\n\nnot affected by\n\nCVE-2024-42513\n\nThe product does not expose an HTTPS endpoint. (Vulnerable Code Not in Execute Path)\n\nSIMATIC SISTAR\n\nAll versions\n\nnot affected by\n\nCVE-2024-42513\n\nThe product does not expose an HTTPS endpoint. (Vulnerable Code Not in Execute Path)\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nIndustrial Edge represents an open, ready-to-use Edge computing platform consisting of Edge devices, Edge apps, Edge connectivity, and an application and device management infrastructure.\n\nSIMATIC BRAUMAT / SISTAR are industry-specific control systems especially for the control and monitoring of recipe-controlled production processes such as in the food, beverages and tobacco industries as well as for comparable batch-oriented production processes.\n\nSIMATIC Energy Manager provides users with a scalable, non-sector-specific energy data management system.\n\nSIMATIC IPC DiagMonitor monitors, reports, visualizes and logs the system states of the SIMATIC IPCs. It communicates with other systems and reacts when events occur.\n\nSIMATIC WinCC is a supervisory control and data acquisition (SCADA) system.\n\nSIMIT Simluation Platform allows the simulation of plant setups in order to anticipate faults in the early planning phase.\n\nTotally Integrated Automation Portal (TIA Portal) is a PC software that provides access to the complete range of Siemens digitalized automation services, from digital planning and integrated engineering to transparent operation.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-42512\n\nVulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.\n\nCVSS v3.1 Base Score\n7.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\n\nCWE\nCWE-208: Observable Timing Discrepancy\n\nVulnerability CVE-2024-42513\n\nVulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.\n\nCVSS v3.1 Base Score\n9.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n\nCWE\nCWE-305: Authentication Bypass by Primary Weakness\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2025-03-11):\n\nPublication Date\n\nV1.1 (2025-06-10):\n\nAdded fix for SIMIT V11; Clarified that SIMATIC BRAUMAT and SIMATIC SISTAR are not affected by CVE-2024-42513\n\nV1.2 (2026-10-13):\n\nAdded Fix version for SIMATIC WinCC Unified V18\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-858251\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-42513", "CVE-2024-42512" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourcePath": "body:advisory", "text": "SSA-864900\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2025-05-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.1\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nRUGGEDCOM APE1808\n\nShow more details\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.9\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-52963\n\nCVE-2024-32122\n\nCVE-2024-50562\n\nCVE-2025-22862\n\nCVE-2025-24471\n\nCVE-2025-25250\n\nCVE-2024-55599\n\nCVE-2025-25248\n\nCVE-2025-53744\n\nCVE-2025-57740\n\nCVE-2025-58903\n\nCVE-2025-31366\n\nCVE-2025-47890\n\nCVE-2025-25253\n\nCVE-2025-58413\n\nCVE-2025-53843\n\nCVE-2025-59718\n\nCVE-2025-59719\n\nCVE-2025-25249\n\nUpdate Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.6.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2025-31514\n\nCVE-2025-54821\n\nCVE-2025-53844\n\nCVE-2025-67862\n\nCVE-2026-59837\n\nCVE-2025-62826\n\nCVE-2025-62675\n\nCVE-2025-43892\n\nCVE-2026-59840\n\nCVE-2026-84392\n\nUpdate Fortigate NGFW to V7.6.6 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2024-52963\n\nUnder the config vpn ipsec phase1-interface configuration, either set authmethod to psk, or set digital-signature-auth to disable (see https://fortiguard.fortinet.com/psirt/FG-IR-24-373 )\n\nCVE-2025-25249\n\nFor each interface, remove \"fabric\" access (see https://fortiguard.fortinet.com/psirt/FG-IR-25-084 )\n\nCVE-2025-53843\n\nDisable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs (see https://fortiguard.fortinet.com/psirt/FG-IR-25-358 for more information)\n\nCVE-2025-58413\n\nDisable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs . Remove inter-controller-peer elements in config wireless-controller inter-controller configuration. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-632 for more information)\n\nCVE-2025-59718\n\nTo prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-647 for more information)\n\nCVE-2025-59719\n\nTo prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-647 for more information)\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-32122\n\nAn insufficiently protected credentials vulnerability in FortiOS may allow a privileged authenticated attacker to retrieve LDAP credentials via modifying the LDAP server IP address in the FortiOS configuration to point to a malicious attacker-controlled server.\n\nCVSS v3.1 Base Score\n2.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-522: Insufficiently Protected Credentials\n\nVulnerability CVE-2024-50562\n\nAn Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.\n\nCVSS v3.1 Base Score\n4.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RC:R\n\nCWE\nCWE-613: Insufficient Session Expiration\n\nVulnerability CVE-2024-52963\n\nA out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets.\n\nCVSS v3.1 Base Score\n3.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:W/RC:C\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2024-55599\n\nAn Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U\n\nCWE\nCWE-358: Improperly Implemented Security Check for Standard\n\nVulnerability CVE-2025-22862\n\nAn Authentication Bypass Using an Alternate Path or Channel vulnerability in FortiOS and FortiProxy may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-288: Authentication Bypass Using an Alternate Path or Channel\n\nVulnerability CVE-2025-24471\n\nAn Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C\n\nCWE\nCWE-295: Improper Certificate Validation\n\nVulnerability CVE-2025-25248\n\nAn Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R\n\nCVSS v4.0 Base Score\n6.0\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-190: Integer Overflow or Wraparound\n\nVulnerability CVE-2025-25249\n\nA heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4.0 through 6.4.16, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n8.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nVulnerability CVE-2025-25250\n\nAn Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS version 7.6.0, version 7.4.7 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions SSL-VPN web-mode may allow an authenticated user to access full SSL-VPN settings via crafted URL.\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R\n\nCWE\nCWE-200: Exposure of Sensitive Information to an Unauthorized Actor\n\nVulnerability CVE-2025-25253\n\nAn Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-297: Improper Validation of Certificate with Host Mismatch\n\nVulnerability CVE-2025-31366\n\nAn Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] in FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions; FortiSASE 25.3.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n4.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nVulnerability CVE-2025-31514\n\nAn Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command.\n\nCVSS v3.1 Base Score\n2.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-532: Insertion of Sensitive Information into Log File\n\nVulnerability CVE-2025-43892\n\nA buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request.\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-126: Buffer Over-read\n\nVulnerability CVE-2025-47890\n\nAn URL Redirection to Untrusted Site vulnerabilities [CWE-601] in FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions; FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n2.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\nCWE\nCWE-601: URL Redirection to Untrusted Site ('Open Redirect')\n\nVulnerability CVE-2025-53744\n\nAn incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.\n\nCVSS v3.1 Base Score\n7.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.6\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-266: Incorrect Privilege Assignment\n\nVulnerability CVE-2025-53843\n\nA stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2025-53844\n\nA out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2025-54821\n\nAn Improper Privilege Management vulnerability [CWE-269] in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.\n\nCVSS v3.1 Base Score\n1.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N\n\nCWE\nCWE-269: Improper Privilege Management\n\nVulnerability CVE-2025-57740\n\nAn Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nVulnerability CVE-2025-58413\n\nA stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2025-58903\n\nAn Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.\n\nCVSS v3.1 Base Score\n2.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-252: Unchecked Return Value\n\nVulnerability CVE-2025-59718\n\nA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-347: Improper Verification of Cryptographic Signature\n\nVulnerability CVE-2025-59719\n\nAn improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-347: Improper Verification of Cryptographic Signature\n\nVulnerability CVE-2025-62675\n\nAn Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link.\n\nCVSS v3.1 Base Score\n3.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N\n\nCWE\nCWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')\n\nVulnerability CVE-2025-62826\n\nAn Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n3.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\nCWE\nCWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')\n\nVulnerability CVE-2025-67862\n\nAn Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State\n\nVulnerability CVE-2026-59837\n\nA stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n6.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2026-59840\n\nA buffer over-read vulnerability [CWE-126] in FortiOS, FortiProxy, and FortiSASE may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-126: Buffer Over-read\n\nVulnerability CVE-2026-84392\n\nA NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n2.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nADDITIONAL INFORMATION\n\nSiemens recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications .\nFortinet provides a public RSS feed for their security alerts to which customers can also subscribe [1].\n\n[1] https://filestore.fortinet.com/fortiguard/rss/ir.xml\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2025-05-13):\n\nPublication Date\n\nV1.1 (2025-07-08):\n\nAdded CVE-2025-24471, CVE-2025-22862, CVE-2024-50562 and CVE-2025-25250\n\nV1.2 (2025-08-12):\n\nAdded CVE-2024-55599\n\nV1.3 (2025-09-09):\n\nAdded CVE-2025-25248 and CVE-2025-53744\n\nV1.4 (2025-11-11):\n\nAdded CVE-2025-57740, CVE-2025-31514, CVE-2025-58903, CVE-2025-31366, CVE-2025-47890 and CVE-2025-25253\n\nV1.5 (2026-01-13):\n\nAdded CVE-2025-54821, CVE-2025-58413, CVE-2025-53843, CVE-2025-59718 and CVE-2025-59719\n\nV1.6 (2026-01-22):\n\nUpdated remediation for CVE-2024-52963 , CVE-2024-32122, CVE-2024-32122, CVE-2024-50562, CVE-2025-22862, CVE-2025-24471, CVE-2025-25250 , CVE-2024-55599, CVE-2025-25248, CVE-2025-53744, CVE-2025-57740, CVE-2025-58903, CVE-2025-31366, CVE-2025-47890, CVE-2025-25253, CVE-2025-58413, CVE-2025-53843, CVE-2025-59718 and CVE-2025-59719\n\nV1.7 (2026-02-10):\n\nAdded CVE-2025-25249\n\nV1.8 (2026-06-09):\n\nAdded CVE-2025-53844. Updated remediation for CVE-2025-31514 and CVE-2025-54821\n\nV1.9 (2026-07-14):\n\nAdded CVE-2025-67862\n\nV2.0 (2026-08-11):\n\nAdded CVE-2026-59837, CVE-2025-62826, CVE-2025-62675, CVE-2025-43892 and CVE-2026-59840\n\nV2.1 (2026-10-13):\n\nAdded CVE-2026-84392\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-864900\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2024-52963", "CVE-2024-32122", "CVE-2024-50562", "CVE-2025-22862", "CVE-2025-24471", "CVE-2025-25250", "CVE-2024-55599", "CVE-2025-25248", "CVE-2025-53744", "CVE-2025-57740", "CVE-2025-58903", "CVE-2025-31366", "CVE-2025-47890", "CVE-2025-25253", "CVE-2025-58413", "CVE-2025-53843", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-25249", "CVE-2025-31514", "CVE-2025-54821", "CVE-2025-53844", "CVE-2025-67862", "CVE-2026-59837", "CVE-2025-62826", "CVE-2025-62675", "CVE-2025-43892", "CVE-2026-59840", "CVE-2026-84392" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "sourcePath": "body:advisory", "text": "SSA-911336\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n7.5\n\nCVSS v4.0 Base Score:\n6.4\n\nSUMMARY\n\nNozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC . This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nSiemens recommends to contact customer support to receive patch and update information.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM APE1808\n\nAll versions with Nozomi Guardian/CMC\n\naffected by\n\nall CVEs\n\nCVE-2026-33387\n\nCVE-2026-33391\n\nCVE-2026-33920\n\nCVE-2026-33388\n\nCVE-2026-33389\n\nContact customer support to receive patch and update information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-33387\n\nA template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.\n\nCVSS v3.1 Base Score\n4.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L\n\nCVSS v4.0 Base Score\n5.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N\n\nCWE\nCWE-1336: Improper Neutralization of Special Elements Used in a Template Engine\n\nVulnerability CVE-2026-33388\n\nAn access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials.\n\nCVSS v3.1 Base Score\n7.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L\n\nCVSS v4.0 Base Score\n6.4\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L\n\nCWE\nCWE-863: Incorrect Authorization\n\nVulnerability CVE-2026-33389\n\nAn improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L\n\nCVSS v4.0 Base Score\n5.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L\n\nCWE\nCWE-671: Lack of Administrator Control over Security\n\nVulnerability CVE-2026-33391\n\nAn access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.\n\nCVSS v3.1 Base Score\n5.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\n\nCVSS v4.0 Base Score\n5.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N\n\nCWE\nCWE-863: Incorrect Authorization\n\nVulnerability CVE-2026-33920\n\nA cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.\n\nCVSS v3.1 Base Score\n3.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N\n\nCVSS v4.0 Base Score\n5.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-352: Cross-Site Request Forgery (CSRF)\n\nADDITIONAL INFORMATION\n\nNozomi provides a public RSS feed for their security alerts to which customers can also subscribe [1].\n\n[1] https://security.nozominetworks.com/alerts/\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-911336\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-33387", "CVE-2026-33391", "CVE-2026-33920", "CVE-2026-33388", "CVE-2026-33389" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourcePath": "body:advisory", "text": "SSA-967325\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS before V11.2.10-h7 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-05-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n9.3\n\nSUMMARY\n\nPalo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications.\n\n[1] https://security.paloaltonetworks.com/\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nRUGGEDCOM APE1808\n\nShow more details\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with User-ID™ Authentication Portal configured and interface management profile with response pages enabled\n\naffected by\n\nCVE-2026-0300\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-0256\n\nCVE-2026-0261\n\nCVE-2026-0262\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists\n\naffected by\n\nCVE-2026-0257\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h7. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with a PAN-OS Site-to-Site VPN Gateway with IKEv2 configured\n\naffected by\n\nCVE-2026-0258\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with DNS Proxy enabled and a network proxy attached\n\naffected by\n\nCVE-2026-0264\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with Authentication Profile with CAS enabled and Authentication profile is attached to a login interface\n\naffected by\n\nCVE-2026-0265\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW\n\naffected by\n\nCVE-2026-0269\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h7. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with URL filtering enabled and a customized response page\n\naffected by\n\nCVE-2026-0301\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h7 or later versions. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2026-0257\n\nUse a dedicated certificate for Authentication Override cookies\n\nDisable Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration\n\nCVE-2026-0264\n\nDisassociate DNS Proxy from externally accessible interfaces and configure DNS server with a RFC1918 or a public trusted IP address\n\nDisable the DNS Proxy feature (Network > DNS Proxy) if it is not being used and configure DNS server with a RFC1918 or a public trusted IP address\n\nCVE-2026-0300\n\nRestrict access to the User-ID Authentication Portal to trusted internal IP addresses only\n\nDisable Response Pages in the Interface Management Profile attached to every L3 interface in any zone where untrusted/internet traffic can ingress. Keep Response Pages enabled only on interfaces in trust/internal zones where legitimate users' browsers ingress\n\nDisable User-ID™ Authentication Portal if not required\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-0256\n\nA stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.\n\nCVSS v3.1 Base Score\n5.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N\n\nCVSS v4.0 Base Score\n6.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nVulnerability CVE-2026-0257\n\nAuthentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nCVSS v3.1 Base Score\n9.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N\n\nCVSS v4.0 Base Score\n7.8\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N\n\nCWE\nCWE-565: Reliance on Cookies without Validation and Integrity Checking\n\nVulnerability CVE-2026-0258\n\nA server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition\n\nCVSS v3.1 Base Score\n8.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\n\nCVSS v4.0 Base Score\n8.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-918: Server-Side Request Forgery (SSRF)\n\nVulnerability CVE-2026-0261\n\nMultiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI\n\nCVSS v3.1 Base Score\n7.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.6\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\n\nVulnerability CVE-2026-0262\n\nMultiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to a dataplane interface\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCVSS v4.0 Base Score\n8.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-754: Improper Check for Unusual or Exceptional Conditions\n\nVulnerability CVE-2026-0264\n\nA buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only)\n\nCVSS v3.1 Base Score\n9.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n9.2\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nVulnerability CVE-2026-0265\n\nAn authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n9.2\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-347: Improper Verification of Cryptographic Signature\n\nVulnerability CVE-2026-0269\n\nA memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.\n\nCVSS v3.1 Base Score\n0.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N\n\nCVSS v4.0 Base Score\n6.9\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-754: Improper Check for Unusual or Exceptional Conditions\n\nVulnerability CVE-2026-0300\n\nA buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.\n\nCVSS v3.1 Base Score\n10.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n9.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2026-0301\n\nAn information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n\nCVSS v4.0 Base Score\n6.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-908: Use of Uninitialized Resource\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-05-12):\n\nPublication Date\n\nV1.1 (2026-06-09):\n\nAdded CVE-2026-0256, CVE-2026-0257, CVE-2026-0258, CVE-2026-0261, CVE-2026-0262, CVE-2026-0264 and CVE-2026-0265\n\nV1.2 (2026-07-14):\n\nAdded CVE-2026-0269. Added remediation for CVE-2026-0300, CVE-2026-0256, CVE-2026-0257, CVE-2026-0261, CVE-2026-0262, CVE-2026-0258, CVE-2026-0264 and CVE-2026-0265\n\nV1.3 (2026-10-13):\n\nAdded CVE-2026-0301\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-967325\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-0300", "CVE-2026-0256", "CVE-2026-0261", "CVE-2026-0262", "CVE-2026-0257", "CVE-2026-0258", "CVE-2026-0264", "CVE-2026-0265", "CVE-2026-0269", "CVE-2026-0301" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "sourcePath": "body:advisory", "text": "SSA-968435\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-968435: Multiple Vulnerabilities in Industrial Edge App Publisher\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n8.3\n\nCVSS v4.0 Base Score:\n7.7\n\nSUMMARY\n\nThe Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration.\n\nSiemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge App Publisher\n\nAll versions < V1.27.9\n\naffected by\n\nall CVEs\n\nCVE-2026-78556\n\nCVE-2026-78557\n\nUpdate to V1.27.9 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/develop_an_application/ieap/download_the_ie_ap.html\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nIndustrial Edge App Publisher packages Docker images into Industrial Edge Apps for deployment on Industrial Edge Devices\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-78556\n\nThe affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.\n\nCVSS v3.1 Base Score\n7.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\n\nCVSS v4.0 Base Score\n7.6\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n\nCWE\nCWE-295: Improper Certificate Validation\n\nVulnerability CVE-2026-78557\n\nThe application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine\n\nCVSS v3.1 Base Score\n8.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n7.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nEzinne Kalu for reporting and coordinated disclosure\n\nADDITIONAL INFORMATION\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-968435\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [ "CVE-2026-78556", "CVE-2026-78557" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "sourcePath": "body:advisory", "text": "SSB-091449\n\nSiemens Security Bulletin by Siemens ProductCERT\n\nSSB-091449: SIMATIC S7 PLCs and Related Products: Per-Variable HMI/OPC UA/Web API Access Attributes Not Enforced on PG/HMI Communication\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nSUMMARY\nSiemens became aware of a documentation ambiguity affecting SIMATIC S7 PLCs and related products [1]. SIMATIC S7 PLCs use two distinct, channel-specific security models: PLC protection levels govern PG/HMI access, while the per-variable access attributes \"Accessible from HMI/OPC UA/Web API\" and \"Writable from HMI/OPC UA/Web API\" govern OPC UA/Web API access. The TIA Portal documentation does not sufficiently explain this distinction. Operators who are unaware of it may draw incorrect conclusions about the access control boundaries across communication channels.\n\nSiemens recommends that customers ensure secure access protection is configured as documented in the relevant product documentation, e.g.:\n\nSIMATIC S7-1500/ET 200MP System Manual (Sections 4.9 and 11.6)\n\nSIMATIC S7-1200 G2 System Manual (Section 2.9 and 6.5)\n\nSINUMERIK ONE Configuration Manual (Section 11.7.2 or 11.10)\n\nISSUE DESCRIPTION\nTIA Portal supports configuration of below attribute properties for local tags and constants for SIMATIC S7 PLCs and related products:\n\n\"Accessible from HMI/OPC UA/Web API\" — controls whether a variable is visible to clients on HMI/OPC UA/Web API\n\n\"Writable from HMI/OPC UA/Web API\" — controls whether a variable can be modified by clients on HMI/OPC UA/Web API\n\nThe TIA Portal documentation [1] contains the following remark:\n\n\"Note, however, that you cannot implement general access protection for the tag with the \"Accessible from HMI/OPC UA/Web API\" attribute. Read or write access from other applications is possible even if the attribute is not enabled.\"\n\nThis may not emphasize the channel-specific security model distinction sufficiently. An operator reading the documentation may incorrectly conclude that the per-variable access attributes provide a unified, cross-channel access restriction, without being aware that these attributes are only enforced on OPC UA/Web API but not on PG/HMI communication. To enforce access restriction on PG/HMI communication protection levels / function rights must be applied.\n\nThis is the intended product behavior. However, operators who are unaware of this scope limitation may unknowingly deploy systems under incorrect security assumptions.\n\nRECOMMENDED ACTIONS\nSiemens is working to update the TIA Portal documentation to improve the clarity of the scope of enforcement for per-variable access attributes.\n\nSiemens recommends to ensure secure access protection is configured as documented in the relevant product documentation, e.g SIMATIC S7-1500/ET 200MP System Manual (Sections 4.9 and 11.6) or SIMATIC S7-1200 G2 System Manual (Section 2.9 and 6.5) or SINUMERIK ONE Configuration Manual (Section 11.7.2 or 11.10).\n\nREFERENCES\n\nProperties of Local Tags and Constants – TIA Portal v21 Documentation\n\nSiemens Industrial Security\n\nSIMATIC S7-1500/ET 200MP System Manual (Sections 4.9 and 11.6)\n\nSIMATIC S7-1200 G2 System Manual (Section 2.9 and 6.5)\n\nSINUMERIK ONE Configuration Manual (Section 11.7.2 or 11.10)\n\nOperational Guidelines Industrial Security\n\nACKNOWLEDGMENTS\n\nSiemens thanks the following party for its efforts:\n\nChristofer Dutz from ToddySoft GmbH for coordinated disclosure\n\nHISTORY DATA\n\nV1.0 (2026-10-13):\n\nPublication Date\n\nTERMS OF USE\n\nThe use of Siemens Security Bulletins is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSB-091449\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCves": [] } ], "limits": { "completeness": "bounded", "truncatedFields": [ "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "https://cert-portal.siemens.com/productcert/html/ssa-794697.html" ], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2024-3596", "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-3497", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-46174", "CVE-2026-46333", "CVE-2023-53292", "CVE-2025-21863", "CVE-2025-40196", "CVE-2026-23255", "CVE-2026-23399", "CVE-2026-31449", "CVE-2026-31681", "CVE-2026-31700", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2026-31431", "CVE-2026-43284", "CVE-2026-46300", "CVE-2025-38617", "CVE-2026-89208", "CVE-2024-58005", "CVE-2024-53166", "CVE-2025-21848", "CVE-2025-21712", "CVE-2025-21865", "CVE-2025-21862", "CVE-2025-21756", "CVE-2024-50246", "CVE-2024-24855", "CVE-2024-26596", "CVE-2025-21701", "CVE-2025-21767", "CVE-2025-21728", "CVE-2025-21766", "CVE-2025-21724", "CVE-2024-57996", "CVE-2023-4527", "CVE-2023-4806", "CVE-2023-4911", "CVE-2023-38545", "CVE-2023-38546", "CVE-2023-5363", "CVE-2023-44487", "CVE-2023-48795", "CVE-2023-51385", "CVE-2023-46218", "CVE-2023-46219", "CVE-2023-6246", "CVE-2023-6779", "CVE-2023-6780", "CVE-2024-28085", "CVE-2024-2961", "CVE-2024-33599", "CVE-2024-33600", "CVE-2024-33601", "CVE-2024-33602", "CVE-2024-34397", "CVE-2024-6387", "CVE-2024-37370", "CVE-2024-37371", "CVE-2024-6119", "CVE-2024-45490", "CVE-2024-45491", "CVE-2024-45492", "CVE-2024-12133", "CVE-2024-12243", "CVE-2025-26465", "CVE-2025-31115", "CVE-2025-46836", "CVE-2025-4598", "CVE-2025-4373", "CVE-2025-6395", "CVE-2025-32988", "CVE-2025-32989", "CVE-2025-3198", "CVE-2025-5244", "CVE-2025-5245", "CVE-2025-7425", "CVE-2025-7545", "CVE-2025-7546", "CVE-2025-8224", "CVE-2025-9230", "CVE-2025-9232", "CVE-2025-11082", "CVE-2025-11083", "CVE-2025-11412", "CVE-2025-11413", "CVE-2025-11414", "CVE-2025-11494", "CVE-2025-11495", "CVE-2025-11839", "CVE-2025-11840", "CVE-2025-39929", "CVE-2025-59375", "CVE-2025-66382", "CVE-2025-38685", "CVE-2025-38691", "CVE-2025-38701", "CVE-2025-38702", "CVE-2025-38708", "CVE-2025-38724", "CVE-2025-39683", "CVE-2025-39689", "CVE-2025-39697", "CVE-2025-39724", "CVE-2025-39783", "CVE-2025-39787", "CVE-2025-39798", "CVE-2025-38058", "CVE-2025-38063", "CVE-2025-38067", "CVE-2025-38071", "CVE-2025-38079", "CVE-2025-38083", "CVE-2025-38100", "CVE-2025-38111", "CVE-2025-38124", "CVE-2025-38167", "CVE-2025-38198", "CVE-2025-38212", "CVE-2025-38214", "CVE-2025-38215", "CVE-2025-38222", "CVE-2025-38231", "CVE-2025-38236", "CVE-2025-38280", "CVE-2025-38285", "CVE-2025-38312", "CVE-2025-38342", "CVE-2025-38350", "CVE-2025-38364", "CVE-2025-38393", "CVE-2025-38400", "CVE-2025-38430", "CVE-2025-38451", "CVE-2025-38457", "CVE-2025-38465", "CVE-2025-38466", "CVE-2025-38468", "CVE-2025-38470", "CVE-2025-38471", "CVE-2025-38477", "CVE-2025-38498", "CVE-2025-38499", "CVE-2026-32776", "CVE-2026-32777", "CVE-2026-32778", "CVE-2026-3904", "CVE-2026-4046", "CVE-2026-41080", "CVE-2026-4437", "CVE-2026-4438", "CVE-2026-45186", "CVE-2026-5435", "CVE-2026-5450", "CVE-2026-5928", "CVE-2026-6238", "CVE-2006-5051", "CVE-2025-32990", "CVE-2024-7322", "CVE-2026-0266", "CVE-2026-0272", "CVE-2026-0273", "CVE-2026-0279", "CVE-2026-0280", "CVE-2026-0281", "CVE-2026-0282", "CVE-2026-0283", "CVE-2026-0284", "CVE-2026-0285", "CVE-2026-0286", "CVE-2026-0287", "CVE-2026-0288", "CVE-2026-0308", "CVE-2026-0309", "CVE-2026-0310", "CVE-2026-23573", "CVE-2026-59839", "CVE-2026-71408", "CVE-2026-71407", "CVE-2026-84393", "CVE-2026-84854", "CVE-2026-72895", "CVE-2023-5678", "CVE-2024-0727", "CVE-2023-6121", "CVE-2023-45898", "CVE-2023-6932", "CVE-2023-6931", "CVE-2023-6817", "CVE-2024-2511", "CVE-2024-5535", "CVE-2024-9143", "CVE-2024-36484", "CVE-2024-36902", "CVE-2024-36904", "CVE-2024-36905", "CVE-2024-36916", "CVE-2024-36929", "CVE-2024-36939", "CVE-2024-36940", "CVE-2024-36959", "CVE-2024-44987", "CVE-2024-44989", "CVE-2024-44990", "CVE-2024-45016", "CVE-2024-45018", "CVE-2024-46679", "CVE-2024-46743", "CVE-2024-46744", "CVE-2024-46745", "CVE-2024-46750", "CVE-2024-46759", "CVE-2024-46783", "CVE-2024-47660", "CVE-2024-50299", "CVE-2024-50301", "CVE-2024-53101", "CVE-2024-50302", "CVE-2023-52447", "CVE-2024-22099", "CVE-2024-26651", "CVE-2024-26659", "CVE-2024-26787", "CVE-2024-26816", "CVE-2024-26820", "CVE-2024-26851", "CVE-2024-26852", "CVE-2024-26855", "CVE-2024-26859", "CVE-2024-26861", "CVE-2024-26863", "CVE-2024-26870", "CVE-2024-26872", "CVE-2024-26875", "CVE-2024-26877", "CVE-2024-26878", "CVE-2024-26880", "CVE-2024-26882", "CVE-2024-26883", "CVE-2024-26884", "CVE-2024-26889", "CVE-2024-26891", "CVE-2024-26894", "CVE-2024-26895", "CVE-2024-26897", "CVE-2024-26898", "CVE-2024-26901", "CVE-2024-26903", "CVE-2024-26906", "CVE-2024-26907", "CVE-2024-27024", "CVE-2024-27025", "CVE-2024-27038", "CVE-2024-27047", "CVE-2024-27052", "CVE-2024-27053", "CVE-2024-27065", "CVE-2024-27076", "CVE-2024-27077", "CVE-2024-27078", "CVE-2024-27419", "CVE-2024-27431", "CVE-2024-27436", "CVE-2024-35828", "CVE-2024-35845", "CVE-2024-35902", "CVE-2024-40961", "CVE-2022-48829", "CVE-2024-40934", "CVE-2024-36286", "CVE-2021-47107", "CVE-2024-38619", "CVE-2024-33847", "CVE-2024-39509", "CVE-2022-48827", "CVE-2024-40941", "CVE-2024-38596", "CVE-2024-38599", "CVE-2024-38565", "CVE-2024-42093", "CVE-2024-42097", "CVE-2024-39502", "CVE-2024-40995", "CVE-2024-40942", "CVE-2024-40960", "CVE-2024-38598", "CVE-2024-41004", "CVE-2024-26629", "CVE-2024-41006", "CVE-2024-36489", "CVE-2024-41005", "CVE-2024-39468", "CVE-2024-40984", "CVE-2024-38567", "CVE-2024-39489", "CVE-2024-38662", "CVE-2021-47316", "CVE-2024-39482", "CVE-2024-38552", "CVE-2024-42094", "CVE-2024-40958", "CVE-2024-38780", "CVE-2024-36894", "CVE-2024-40912", "CVE-2024-40905", "CVE-2024-36974", "CVE-2024-40971", "CVE-2021-47002", "CVE-2024-38558", "CVE-2024-38659", "CVE-2024-36270", "CVE-2024-38612", "CVE-2024-41000", "CVE-2024-42070", "CVE-2024-38547", "CVE-2024-38578", "CVE-2024-42090", "CVE-2024-42082", "CVE-2024-37356", "CVE-2024-33621", "CVE-2024-38615", "CVE-2024-38381", "CVE-2024-42096", "CVE-2024-40959", "CVE-2024-38589", "CVE-2024-38579", "CVE-2024-38560", "CVE-2024-34027", "CVE-2022-48828", "CVE-2024-40978", "CVE-2024-40993", "CVE-2024-40980", "CVE-2024-39503", "CVE-2024-38635", "CVE-2024-36978", "CVE-2021-4090", "CVE-2024-23848", "CVE-2024-50121", "CVE-2023-1652", "CVE-2024-42272", "CVE-2024-36288", "CVE-2021-38202", "CVE-2024-49977", "CVE-2022-43945", "CVE-2024-38559", "CVE-2024-50251", "CVE-2024-50262", "CVE-2024-53042", "CVE-2024-53057", "CVE-2024-53059", "CVE-2024-26885", "CVE-2024-27072", "CVE-2024-35965", "CVE-2024-41016", "CVE-2024-46854", "CVE-2024-46865", "CVE-2024-47684", "CVE-2024-47685", "CVE-2024-47692", "CVE-2024-47696", "CVE-2024-47697", "CVE-2024-47699", "CVE-2024-47701", "CVE-2024-47705", "CVE-2024-47706", "CVE-2024-47709", "CVE-2024-47710", "CVE-2024-47713", "CVE-2024-47718", "CVE-2024-47723", "CVE-2024-47735", "CVE-2024-47737", "CVE-2024-47747", "CVE-2024-49851", "CVE-2024-49889", "CVE-2024-49890", "CVE-2024-49892", "CVE-2024-49894", "CVE-2024-49900", "CVE-2024-49902", "CVE-2024-49903", "CVE-2024-49930", "CVE-2024-49938", "CVE-2024-49944", "CVE-2024-49948", "CVE-2024-49949", "CVE-2024-49952", "CVE-2024-49955", "CVE-2024-49973", "CVE-2024-49997", "CVE-2024-50001", "CVE-2024-50006", "CVE-2024-50008", "CVE-2024-50010", "CVE-2024-50015", "CVE-2024-50033", "CVE-2024-50035", "CVE-2024-50039", "CVE-2024-50040", "CVE-2024-50044", "CVE-2024-50045", "CVE-2024-50046", "CVE-2024-50058", "CVE-2024-50095", "CVE-2024-50127", "CVE-2024-50131", "CVE-2024-50134", "CVE-2024-50142", "CVE-2024-50148", "CVE-2024-50150", "CVE-2024-50151", "CVE-2024-50153", "CVE-2024-50188", "CVE-2024-50205", "CVE-2024-50210", "CVE-2022-38096", "CVE-2023-28746", "CVE-2023-47233", "CVE-2023-52458", "CVE-2023-52614", "CVE-2023-52620", "CVE-2024-23307", "CVE-2024-24857", "CVE-2024-24858", "CVE-2024-24859", "CVE-2024-25739", "CVE-2024-26642", "CVE-2024-26643", "CVE-2024-26810", "CVE-2024-26812", "CVE-2024-26920", "CVE-2024-26923", "CVE-2024-26925", "CVE-2024-26934", "CVE-2024-26935", "CVE-2024-26937", "CVE-2024-26950", "CVE-2024-26951", "CVE-2024-26958", "CVE-2024-26960", "CVE-2024-26961", "CVE-2024-26973", "CVE-2024-26974", "CVE-2024-26988", "CVE-2024-26993", "CVE-2024-27004", "CVE-2024-27013", "CVE-2024-27020", "CVE-2024-27059", "CVE-2024-27395", "CVE-2024-27396", "CVE-2024-27397", "CVE-2024-27437", "CVE-2024-35789", "CVE-2024-35805", "CVE-2024-35807", "CVE-2024-35811", "CVE-2024-35813", "CVE-2024-35815", "CVE-2024-35823", "CVE-2024-35849", "CVE-2024-35877", "CVE-2024-35884", "CVE-2024-35886", "CVE-2024-35888", "CVE-2024-35893", "CVE-2024-35895", "CVE-2024-35896", "CVE-2024-35897", "CVE-2024-35898", "CVE-2024-35899", "CVE-2024-35900", "CVE-2024-35905", "CVE-2024-35910", "CVE-2024-35915", "CVE-2024-35922", "CVE-2024-35925", "CVE-2024-35930", "CVE-2024-35933", "CVE-2024-35934", "CVE-2024-35935", "CVE-2024-35936", "CVE-2024-35940", "CVE-2024-35944", "CVE-2024-35950", "CVE-2024-35955", "CVE-2024-35958", "CVE-2024-35960", "CVE-2024-35962", "CVE-2024-35966", "CVE-2024-35967", "CVE-2024-35969", "CVE-2024-35973", "CVE-2024-35976", "CVE-2024-35978", "CVE-2024-35982", "CVE-2024-35983", "CVE-2024-35984", "CVE-2024-35988", "CVE-2024-35990", "CVE-2024-35996", "CVE-2024-35997", "CVE-2024-36004", "CVE-2024-36005", "CVE-2024-36006", "CVE-2024-36007", "CVE-2024-36008", "CVE-2024-36020", "CVE-2024-36899", "CVE-2024-38587", "CVE-2024-39493", "CVE-2024-40916", "CVE-2024-42114", "CVE-2024-42259", "CVE-2024-42265", "CVE-2024-42276", "CVE-2024-42281", "CVE-2024-42283", "CVE-2024-42292", "CVE-2024-42302", "CVE-2024-42304", "CVE-2024-42305", "CVE-2024-42306", "CVE-2024-42312", "CVE-2024-43828", "CVE-2024-43830", "CVE-2024-43834", "CVE-2024-43856", "CVE-2024-43858", "CVE-2024-43871", "CVE-2024-43879", "CVE-2024-43882", "CVE-2024-43889", "CVE-2024-43890", "CVE-2024-43893", "CVE-2024-44935", "CVE-2024-44944", "CVE-2024-44948", "CVE-2024-44960", "CVE-2024-47707", "CVE-2024-56672", "CVE-2024-57901", "CVE-2024-57902", "CVE-2024-57913", "CVE-2024-57929", "CVE-2024-57940", "CVE-2024-57948", "CVE-2024-57951", "CVE-2024-58051", "CVE-2024-58085", "CVE-2024-41996", "CVE-2023-6237", "CVE-2023-6129", "CVE-2023-50781", "CVE-2024-40945", "CVE-2025-21638", "CVE-2025-21639", "CVE-2025-21640", "CVE-2025-21653", "CVE-2025-21664", "CVE-2025-21666", "CVE-2025-21669", "CVE-2025-21678", "CVE-2025-21683", "CVE-2025-21692", "CVE-2025-21694", "CVE-2024-26982", "CVE-2024-57981", "CVE-2024-57986", "CVE-2024-58009", "CVE-2024-58014", "CVE-2024-58017", "CVE-2024-58063", "CVE-2024-58071", "CVE-2024-58072", "CVE-2025-21647", "CVE-2025-21704", "CVE-2025-21711", "CVE-2025-21719", "CVE-2025-21726", "CVE-2025-21727", "CVE-2025-21735", "CVE-2025-21744", "CVE-2025-21753", "CVE-2025-21761", "CVE-2025-21762", "CVE-2025-21763", "CVE-2025-21772", "CVE-2025-21776", "CVE-2025-21787", "CVE-2025-21806", "CVE-2025-21826", "CVE-2025-21835", "CVE-2025-21844", "CVE-2025-21858", "CVE-2025-21859", "CVE-2025-68160", "CVE-2025-69418", "CVE-2025-69419", "CVE-2025-69420", "CVE-2025-69421", "CVE-2026-22795", "CVE-2026-22796", "CVE-2026-28387", "CVE-2026-28388", "CVE-2026-28389", "CVE-2026-28390", "CVE-2023-3817", "CVE-2024-0584", "CVE-2024-47672", "CVE-2025-40815", "CVE-2025-40816", "CVE-2025-40817", "CVE-2025-30033", "CVE-2026-102075", "CVE-2026-102076", "CVE-2026-102074", "CVE-2026-102073", "CVE-2026-44414", "CVE-2026-44415", "CVE-2026-85114", "CVE-2026-85115", "CVE-2024-52051", "CVE-2023-45871", "CVE-2023-45853", "CVE-2023-45322", "CVE-2013-0340", "CVE-2013-4235", "CVE-2014-7209", "CVE-2015-20107", "CVE-2022-37454", "CVE-2022-43680", "CVE-2022-45061", "CVE-2019-19242", "CVE-2019-19244", "CVE-2019-19317", "CVE-2019-19603", "CVE-2019-19645", "CVE-2019-19646", "CVE-2019-19880", "CVE-2019-19923", "CVE-2019-19924", "CVE-2019-19925", "CVE-2019-19926", "CVE-2019-19959", "CVE-2019-20218", "CVE-2016-10228", "CVE-2020-10029", "CVE-2020-1752", "CVE-2020-6096", "CVE-2016-10739", "CVE-2019-6488", "CVE-2016-3189", "CVE-2019-12900", "CVE-2021-28363", "CVE-2021-45960", "CVE-2022-0778", "CVE-2022-25235", "CVE-2022-25236", "CVE-2022-25313", "CVE-2022-25314", "CVE-2022-25315", "CVE-2022-26488", "CVE-2016-3709", "CVE-2022-29824", "CVE-2016-4658", "CVE-2016-5131", "CVE-2016-9318", "CVE-2017-0663", "CVE-2017-9047", "CVE-2017-9048", "CVE-2017-9049", "CVE-2017-9050", "CVE-2017-16931", "CVE-2017-16932", "CVE-2017-17512", "CVE-2017-18258", "CVE-2017-7375", "CVE-2017-7376", "CVE-2018-0495", "CVE-2019-12904", "CVE-2019-13627", "CVE-2018-12886", "CVE-2018-14404", "CVE-2018-14567", "CVE-2018-19591", "CVE-2018-20482", "CVE-2018-20843", "CVE-2018-25032", "CVE-2019-1010022", "CVE-2019-1010023", "CVE-2019-1010024", "CVE-2019-1010025", "CVE-2019-1010180", "CVE-2019-10160", "CVE-2019-9636", "CVE-2019-9740", "CVE-2019-9947", "CVE-2019-9948", "CVE-2019-11360", "CVE-2019-12290", "CVE-2019-13057", "CVE-2019-13565", "CVE-2019-15847", "CVE-2019-15903", "CVE-2019-16056", "CVE-2019-16168", "CVE-2019-16905", "CVE-2019-17498", "CVE-2020-22218", "CVE-2019-17543", "CVE-2019-17594", "CVE-2019-17595", "CVE-2019-18224", "CVE-2019-18276", "CVE-2019-18348", "CVE-2020-8492", "CVE-2019-19126", "CVE-2020-1751", "CVE-2019-19906", "CVE-2019-19956", "CVE-2019-20367", "CVE-2019-20388", "CVE-2020-24977", "CVE-2020-7595", "CVE-2021-3516", "CVE-2021-3517", "CVE-2021-3518", "CVE-2021-3537", "CVE-2021-3541", "CVE-2019-20795", "CVE-2019-20907", "CVE-2020-14422", "CVE-2020-15523", "CVE-2020-15801", "CVE-2020-26116", "CVE-2019-25013", "CVE-2020-27618", "CVE-2020-29562", "CVE-2020-29573", "CVE-2021-27645", "CVE-2021-3326", "CVE-2019-3855", "CVE-2019-3856", "CVE-2019-3857", "CVE-2019-3858", "CVE-2019-3859", "CVE-2019-3860", "CVE-2019-3861", "CVE-2019-3862", "CVE-2019-3863", "CVE-2019-5018", "CVE-2019-8457", "CVE-2019-9936", "CVE-2019-9937", "CVE-2019-5094", "CVE-2019-5188", "CVE-2019-5435", "CVE-2019-5436", "CVE-2019-5443", "CVE-2019-5481", "CVE-2019-5482", "CVE-2020-19909", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111", "CVE-2019-7309", "CVE-2019-9169", "CVE-2019-9674", "CVE-2019-9923", "CVE-2020-10531", "CVE-2020-21913", "CVE-2020-10543", "CVE-2020-10878", "CVE-2020-12723", "CVE-2020-10735", "CVE-2021-28861", "CVE-2020-11501", "CVE-2020-11655", "CVE-2020-11656", "CVE-2020-13630", "CVE-2020-13631", "CVE-2020-13632", "CVE-2020-35525", "CVE-2020-35527", "CVE-2020-9327", "CVE-2020-12062", "CVE-2020-12243", "CVE-2020-12762", "CVE-2020-13434", "CVE-2020-13435", "CVE-2020-13529", "CVE-2023-26604", "CVE-2020-13776", "CVE-2020-13777", "CVE-2020-13871", "CVE-2020-15358", "CVE-2020-14145", "CVE-2021-28041", "CVE-2020-15778", "CVE-2020-1712", "CVE-2020-19185", "CVE-2020-19186", "CVE-2020-19187", "CVE-2020-19188", "CVE-2020-19189", "CVE-2020-19190", "CVE-2023-29491", "CVE-2020-21047", "CVE-2021-33294", "CVE-2020-24659", "CVE-2020-25692", "CVE-2020-25709", "CVE-2020-25710", "CVE-2020-28196", "CVE-2020-29361", "CVE-2020-29362", "CVE-2020-29363", "CVE-2020-36221", "CVE-2020-36222", "CVE-2020-36223", "CVE-2020-36224", "CVE-2020-36225", "CVE-2020-36226", "CVE-2020-36227", "CVE-2020-36228", "CVE-2020-36229", "CVE-2020-36230", "CVE-2020-8169", "CVE-2020-8177", "CVE-2020-8231", "CVE-2020-8284", "CVE-2020-8285", "CVE-2020-8286", "CVE-2020-8315", "CVE-2022-48560", "CVE-2021-20193", "CVE-2021-20227", "CVE-2021-20231", "CVE-2021-20232", "CVE-2021-20305", "CVE-2021-3580", "CVE-2021-22876", "CVE-2021-22890", "CVE-2021-22897", "CVE-2021-22898", "CVE-2021-22901", "CVE-2021-22922", "CVE-2021-22923", "CVE-2021-22924", "CVE-2021-22925", "CVE-2021-22926", "CVE-2021-22945", "CVE-2021-22946", "CVE-2021-22947", "CVE-2021-23336", "CVE-2021-3177", "CVE-2021-27212", "CVE-2021-27218", "CVE-2021-27219", "CVE-2021-28153", "CVE-2021-31239", "CVE-2021-32292", "CVE-2021-33560", "CVE-2021-33574", "CVE-2021-35942", "CVE-2021-33910", "CVE-2021-3426", "CVE-2021-3733", "CVE-2021-3737", "CVE-2021-4189", "CVE-2022-0391", "CVE-2021-3520", "CVE-2021-36084", "CVE-2021-36085", "CVE-2021-36086", "CVE-2021-36087", "CVE-2021-36222", "CVE-2021-36690", "CVE-2021-37600", "CVE-2021-37750", "CVE-2021-3826", "CVE-2021-46195", "CVE-2021-38604", "CVE-2021-3998", "CVE-2021-3999", "CVE-2021-43396", "CVE-2022-23218", "CVE-2022-23219", "CVE-2021-3997", "CVE-2021-4122", "CVE-2021-4209", "CVE-2021-43618", "CVE-2021-46143", "CVE-2022-22822", "CVE-2022-22823", "CVE-2022-22824", "CVE-2022-22825", "CVE-2022-22826", "CVE-2022-22827", "CVE-2021-46828", "CVE-2021-46848", "CVE-2022-0563", "CVE-2022-1271", "CVE-2022-1292", "CVE-2022-1343", "CVE-2022-1434", "CVE-2022-1473", "CVE-2022-1304", "CVE-2022-2068", "CVE-2022-2097", "CVE-2022-2274", "CVE-2022-22576", "CVE-2022-27774", "CVE-2022-27775", "CVE-2022-27776", "CVE-2022-23308", "CVE-2022-23852", "CVE-2022-23990", "CVE-2022-24407", "CVE-2022-2509", "CVE-2022-27778", "CVE-2022-27779", "CVE-2022-27780", "CVE-2022-27781", "CVE-2022-27782", "CVE-2022-30115", "CVE-2022-27943", "CVE-2022-28321", "CVE-2022-29155", "CVE-2022-32205", "CVE-2022-32206", "CVE-2022-32207", "CVE-2022-32208", "CVE-2022-32221", "CVE-2022-35260", "CVE-2022-42915", "CVE-2022-42916", "CVE-2022-35252", "CVE-2022-35737", "CVE-2022-3715", "CVE-2022-37434", "CVE-2022-3821", "CVE-2022-45873", "CVE-2022-40303", "CVE-2022-40304", "CVE-2022-40674", "CVE-2022-42898", "CVE-2022-4304", "CVE-2022-4450", "CVE-2023-0215", "CVE-2023-0286", "CVE-2022-43551", "CVE-2022-43552", "CVE-2022-46908", "CVE-2022-48303", "CVE-2022-48522", "CVE-2023-0464", "CVE-2023-24329", "CVE-2023-0361", "CVE-2023-0465", "CVE-2023-0466", "CVE-2023-2650", "CVE-2023-0687", "CVE-2023-25139", "CVE-2023-1077", "CVE-2023-1206", "CVE-2023-3212", "CVE-2023-34319", "CVE-2023-35001", "CVE-2023-3609", "CVE-2023-3611", "CVE-2023-3772", "CVE-2023-39189", "CVE-2023-39192", "CVE-2023-39193", "CVE-2023-39194", "CVE-2023-40283", "CVE-2023-42755", "CVE-2023-4623", "CVE-2023-4921", "CVE-2023-23914", "CVE-2023-23915", "CVE-2023-23916", "CVE-2023-29499", "CVE-2023-32611", "CVE-2023-32636", "CVE-2023-32643", "CVE-2023-32665", "CVE-2023-25136", "CVE-2023-27371", "CVE-2023-27533", "CVE-2023-27534", "CVE-2023-27535", "CVE-2023-27536", "CVE-2023-27537", "CVE-2023-27538", "CVE-2023-28484", "CVE-2023-29469", "CVE-2023-29383", "CVE-2023-2953", "CVE-2023-31085", "CVE-2023-42754", "CVE-2023-5717", "CVE-2023-3446", "CVE-2023-34969", "CVE-2023-35945", "CVE-2023-38408", "CVE-2023-39128", "CVE-2023-39615", "CVE-2023-4016", "CVE-2023-4039", "CVE-2023-4813", "CVE-2023-5156", "CVE-2023-4807", "CVE-2023-5981", "CVE-2021-44879", "CVE-2023-46862", "CVE-2023-45918", "CVE-2023-52425", "CVE-2023-52426", "CVE-2024-28757", "CVE-2024-2004", "CVE-2024-2379", "CVE-2024-2398", "CVE-2024-2466", "CVE-2024-28182", "CVE-2024-28834", "CVE-2024-28835", "CVE-2024-34459", "CVE-2024-5742", "CVE-2024-7264", "CVE-2024-6409", "CVE-2024-8096", "CVE-2024-2236", "CVE-2024-50602", "CVE-2024-52533", "CVE-2024-11053", "CVE-2023-52444", "CVE-2023-52464", "CVE-2023-52612", "CVE-2023-52675", "CVE-2024-35809", "CVE-2024-56433", "CVE-2024-27074", "CVE-2023-52699", "CVE-2024-49982", "CVE-2024-39292", "CVE-2024-39469", "CVE-2024-40901", "CVE-2024-26835", "CVE-2024-38621", "CVE-2024-26957", "CVE-2024-35830", "CVE-2017-15422", "CVE-2018-18928", "CVE-2023-52622", "CVE-2024-27032", "CVE-2024-36017", "CVE-2024-26645", "CVE-2024-26671", "CVE-2024-36934", "CVE-2024-26679", "CVE-2024-39487", "CVE-2024-26772", "CVE-2024-41046", "CVE-2024-26773", "CVE-2024-42106", "CVE-2024-26777", "CVE-2024-42131", "CVE-2024-26805", "CVE-2024-42154", "CVE-2024-44965", "CVE-2024-49881", "CVE-2024-49884", "CVE-2024-53140", "CVE-2024-53165", "CVE-2024-53217", "CVE-2025-0167", "CVE-2025-0395", "CVE-2025-0665", "CVE-2025-0725", "CVE-2025-26466", "CVE-2024-8176", "CVE-2024-56569", "CVE-2024-56600", "CVE-2024-56770", "CVE-2025-1390", "CVE-2024-56780", "CVE-2024-56606", "CVE-2024-56779", "CVE-2024-57884", "CVE-2024-48881", "CVE-2024-52332", "CVE-2024-56650", "CVE-2024-56570", "CVE-2024-56601", "CVE-2024-53164", "CVE-2024-56644", "CVE-2025-29087", "CVE-2025-29088", "CVE-2025-3277", "CVE-2025-3360", "CVE-2025-32728", "CVE-2016-1839", "CVE-2015-8035", "CVE-2018-9251", "CVE-2019-11340", "CVE-2017-1000082", "CVE-2016-10009", "CVE-2023-6270", "CVE-2025-15467", "CVE-2025-40759", "CVE-2026-89196", "CVE-2026-89197", "CVE-2026-89198", "CVE-2026-89199", "CVE-2026-89200", "CVE-2026-89201", "CVE-2026-89202", "CVE-2026-89203", "CVE-2026-89204", "CVE-2026-89205", "CVE-2026-89206", "CVE-2025-40946", "CVE-2026-41125", "CVE-2026-59241", "CVE-2025-43715", "CVE-2026-110936", "CVE-2026-63350", "CVE-2026-63351", "CVE-2026-63352", "CVE-2026-63353", "CVE-2026-63354", "CVE-2026-63355", "CVE-2026-63356", "CVE-2026-63357", "CVE-2025-2884", "CVE-2024-54678", "CVE-2025-6965", "CVE-2026-11822", "CVE-2026-11824", "CVE-2025-70873", "CVE-2025-71316", "CVE-2024-58002", "CVE-2024-58079", "CVE-2025-21838", "CVE-2025-21725", "CVE-2024-58077", "CVE-2024-58013", "CVE-2025-21703", "CVE-2025-21738", "CVE-2025-21779", "CVE-2025-21790", "CVE-2025-21791", "CVE-2024-57993", "CVE-2025-21700", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-57980", "CVE-2025-21830", "CVE-2026-23253", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-38250", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23396", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23357", "CVE-2026-23352", "CVE-2026-23291", "CVE-2026-23318", "CVE-2026-23296", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23315", "CVE-2025-39863", "CVE-2025-68239", "CVE-2025-38105", "CVE-2026-23364", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46161", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-31699", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46051", "CVE-2026-45838", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43094", "CVE-2026-46195", "CVE-2026-46044", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2023-54271", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-46322", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53253", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2025-37780", "CVE-2021-3759", "CVE-2021-4037", "CVE-2021-33655", "CVE-2022-0171", "CVE-2022-1012", "CVE-2022-1015", "CVE-2022-1184", "CVE-2022-1462", "CVE-2022-1679", "CVE-2022-1852", "CVE-2022-1882", "CVE-2022-2078", "CVE-2022-2153", "CVE-2022-2327", "CVE-2022-2503", "CVE-2022-2586", "CVE-2022-2588", "CVE-2022-2602", "CVE-2022-2663", "CVE-2022-2905", "CVE-2022-2959", "CVE-2022-2978", "CVE-2022-3028", "CVE-2022-3104", "CVE-2022-3115", "CVE-2022-3169", "CVE-2022-3303", "CVE-2022-3521", "CVE-2022-3524", "CVE-2022-3534", "CVE-2022-3545", "CVE-2022-3564", "CVE-2022-3565", "CVE-2022-3586", "CVE-2022-3594", "CVE-2022-3606", "CVE-2022-3621", "CVE-2022-3625", "CVE-2022-3628", "CVE-2022-3629", "CVE-2022-3633", "CVE-2022-3635", "CVE-2022-3646", "CVE-2022-3649", "CVE-2022-4095", "CVE-2022-4129", "CVE-2022-4139", "CVE-2022-4269", "CVE-2022-4662", "CVE-2022-20421", "CVE-2022-20422", "CVE-2022-20566", "CVE-2022-20572", "CVE-2022-21123", "CVE-2022-21125", "CVE-2022-21166", "CVE-2022-21505", "CVE-2022-26373", "CVE-2022-32250", "CVE-2022-32296", "CVE-2022-34918", "CVE-2022-36123", "CVE-2022-36280", "CVE-2022-36879", "CVE-2022-36946", "CVE-2022-39188", "CVE-2022-39190", "CVE-2022-40307", "CVE-2022-40768", "CVE-2022-41218", "CVE-2022-41222", "CVE-2022-41674", "CVE-2022-41849", "CVE-2022-41850", "CVE-2022-42328", "CVE-2022-42329", "CVE-2022-42432", "CVE-2022-42703", "CVE-2022-42719", "CVE-2022-42720", "CVE-2022-42721", "CVE-2022-42722", "CVE-2022-42895", "CVE-2022-42896", "CVE-2022-43750", "CVE-2022-47518", "CVE-2022-47520", "CVE-2022-47929", "CVE-2022-47946", "CVE-2023-0590", "CVE-2023-1095", "CVE-2023-3141", "CVE-2023-3268", "CVE-2023-3338", "CVE-2023-3389", "CVE-2023-23454", "CVE-2023-23455", "CVE-2023-23559", "CVE-2023-26607", "CVE-2023-31436", "CVE-2023-32233", "CVE-2023-37453", "CVE-2023-42753", "CVE-2023-3610", "CVE-2023-2898", "CVE-2023-4004", "CVE-2023-3777", "CVE-2023-4015", "CVE-2023-4273", "CVE-2023-3773", "CVE-2023-5178", "CVE-2023-5197", "CVE-2023-35827", "CVE-2023-45863", "CVE-2023-6606", "CVE-2023-7008", "CVE-2023-7104", "CVE-2023-36660", "CVE-2023-50495", "CVE-2023-51767", "CVE-2024-0232", "CVE-2024-0553", "CVE-2024-0567", "CVE-2024-0684", "CVE-2024-22365", "CVE-2024-25062", "CVE-2018-13405", "CVE-2024-49849", "CVE-2024-42513", "CVE-2024-42512", "CVE-2024-52963", "CVE-2024-32122", "CVE-2024-50562", "CVE-2025-22862", "CVE-2025-24471", "CVE-2025-25250", "CVE-2024-55599", "CVE-2025-25248", "CVE-2025-53744", "CVE-2025-57740", "CVE-2025-58903", "CVE-2025-31366", "CVE-2025-47890", "CVE-2025-25253", "CVE-2025-58413", "CVE-2025-53843", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-25249", "CVE-2025-31514", "CVE-2025-54821", "CVE-2025-53844", "CVE-2025-67862", "CVE-2026-59837", "CVE-2025-62826", "CVE-2025-62675", "CVE-2025-43892", "CVE-2026-59840", "CVE-2026-84392", "CVE-2026-33387", "CVE-2026-33391", "CVE-2026-33920", "CVE-2026-33388", "CVE-2026-33389", "CVE-2026-0300", "CVE-2026-0256", "CVE-2026-0261", "CVE-2026-0262", "CVE-2026-0257", "CVE-2026-0258", "CVE-2026-0264", "CVE-2026-0265", "CVE-2026-0269", "CVE-2026-0301", "CVE-2026-78556", "CVE-2026-78557" ], "supplementarySources": [ { "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3596.json", "id": "CVE-2024-3596", "modifiedAt": "2026-10-15T00:25:35.013Z" }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "SSA-019113", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-3497", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-46174", "CVE-2026-46333", "CVE-2023-53292", "CVE-2025-21863", "CVE-2025-40196", "CVE-2026-23255", "CVE-2026-23399", "CVE-2026-31449", "CVE-2026-31681", "CVE-2026-31700", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2026-31431", "CVE-2026-43284", "CVE-2026-46300", "CVE-2025-38617" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "title": "SSA-055299", "relatedCves": [ "CVE-2026-89208" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "SSA-082556", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2025-21848", "CVE-2025-21712", "CVE-2025-21865", "CVE-2025-21862", "CVE-2025-21864", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-50246", "CVE-2024-57977", "CVE-2024-24855", "CVE-2024-26596", "CVE-2025-21701", "CVE-2025-21767", "CVE-2025-21728", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21724", "CVE-2025-21765", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21745", "CVE-2023-4527", "CVE-2023-4806", "CVE-2023-4911", "CVE-2023-38545", "CVE-2023-38546", "CVE-2023-5363", "CVE-2023-44487", "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-48795", "CVE-2023-51384", "CVE-2023-51385", "CVE-2023-46218", "CVE-2023-46219", "CVE-2023-6246", "CVE-2023-6779", "CVE-2023-6780", "CVE-2024-28085", "CVE-2024-2961", "CVE-2024-33599", "CVE-2024-33600", "CVE-2024-33601", "CVE-2024-33602", "CVE-2024-34397", "CVE-2024-6387", "CVE-2024-37370", "CVE-2024-37371", "CVE-2024-6119", "CVE-2024-45490", "CVE-2024-45491", "CVE-2024-45492", "CVE-2024-12133", "CVE-2024-12243", "CVE-2025-26465", "CVE-2025-31115", "CVE-2025-46836", "CVE-2025-4598", "CVE-2025-4373", "CVE-2025-6395", "CVE-2025-32988", "CVE-2025-32989", "CVE-2025-3198", "CVE-2025-5244", "CVE-2025-5245", "CVE-2025-7425", "CVE-2025-7545", "CVE-2025-7546", "CVE-2025-8224", "CVE-2025-9230", "CVE-2025-9232", "CVE-2025-11082", "CVE-2025-11083", "CVE-2025-11412", "CVE-2025-11413", "CVE-2025-11414", "CVE-2025-11494", "CVE-2025-11495", "CVE-2025-11839", "CVE-2025-11840", "CVE-2025-39929", "CVE-2025-39931", "CVE-2025-39977", "CVE-2025-40022", "CVE-2025-59375", "CVE-2025-66382", "CVE-2024-57924", "CVE-2025-38614", "CVE-2025-38685", "CVE-2025-38691", "CVE-2025-38701", "CVE-2025-38702", "CVE-2025-38708", "CVE-2025-38721", "CVE-2025-38724", "CVE-2025-38727", "CVE-2025-39683", "CVE-2025-39689", "CVE-2025-39697", "CVE-2025-39724", "CVE-2025-39756", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39783", "CVE-2025-39787", "CVE-2025-39795", "CVE-2025-39798", "CVE-2025-39866", "CVE-2025-38058", "CVE-2025-38063", "CVE-2025-38067", "CVE-2025-38071", "CVE-2025-38079", "CVE-2025-38083", "CVE-2025-38100", "CVE-2025-38111", "CVE-2025-38124", "CVE-2025-38167", "CVE-2025-38198", "CVE-2025-38212", "CVE-2025-38214", "CVE-2025-38215", "CVE-2025-38222", "CVE-2025-38231", "CVE-2025-38236", "CVE-2025-38280", "CVE-2025-38285", "CVE-2025-38312", "CVE-2025-38342", "CVE-2025-38350", "CVE-2025-38364", "CVE-2025-38393", "CVE-2025-38400", "CVE-2025-38430", "CVE-2025-38451", "CVE-2025-38457", "CVE-2025-38465", "CVE-2025-38466", "CVE-2025-38468", "CVE-2025-38470", "CVE-2025-38471", "CVE-2025-38477", "CVE-2025-38498", "CVE-2025-38499", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49998", "CVE-2024-50298", "CVE-2024-56719", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-37945", "CVE-2025-37980", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38704", "CVE-2025-39748", "CVE-2025-39764", "CVE-2025-40135", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-68206", "CVE-2025-68265", "CVE-2025-71161", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-23100", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31431", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43284", "CVE-2026-46174", "CVE-2026-46300", "CVE-2026-32776", "CVE-2026-32777", "CVE-2026-32778", "CVE-2026-3904", "CVE-2026-4046", "CVE-2026-41080", "CVE-2026-4437", "CVE-2026-4438", "CVE-2026-45186", "CVE-2026-5435", "CVE-2026-5450", "CVE-2026-5928", "CVE-2026-6238", "CVE-2006-5051", "CVE-2025-38617", "CVE-2025-32990" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "title": "SSA-099819", "relatedCves": [ "CVE-2024-7322" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "title": "SSA-104023", "relatedCves": [ "CVE-2026-0266", "CVE-2026-0272", "CVE-2026-0273", "CVE-2026-0279", "CVE-2026-0280", "CVE-2026-0281", "CVE-2026-0282", "CVE-2026-0283", "CVE-2026-0284", "CVE-2026-0285", "CVE-2026-0286", "CVE-2026-0287", "CVE-2026-0288", "CVE-2026-0308", "CVE-2026-0309", "CVE-2026-0310" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "title": "SSA-127084", "relatedCves": [ "CVE-2026-23573", "CVE-2026-59839", "CVE-2026-71408", "CVE-2026-71407", "CVE-2026-84393" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "title": "SSA-148322", "relatedCves": [ "CVE-2026-84854" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "title": "SSA-159454", "relatedCves": [ "CVE-2026-72895" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "SSA-265688", "relatedCves": [ "CVE-2023-5678", "CVE-2024-0727", "CVE-2023-6121", "CVE-2023-45898", "CVE-2023-6932", "CVE-2023-6931", "CVE-2023-6817", "CVE-2024-2511", "CVE-2024-5535", "CVE-2024-9143", "CVE-2024-36484", "CVE-2024-36902", "CVE-2024-36904", "CVE-2024-36905", "CVE-2024-36916", "CVE-2024-36929", "CVE-2024-36939", "CVE-2024-36940", "CVE-2024-36959", "CVE-2024-44987", "CVE-2024-44989", "CVE-2024-44990", "CVE-2024-45016", "CVE-2024-45018", "CVE-2024-46679", "CVE-2024-46743", "CVE-2024-46744", "CVE-2024-46745", "CVE-2024-46750", "CVE-2024-46759", "CVE-2024-46783", "CVE-2024-47660", "CVE-2024-50299", "CVE-2024-50301", "CVE-2024-53101", "CVE-2024-50302", "CVE-2023-52447", "CVE-2024-22099", "CVE-2024-26651", "CVE-2024-26659", "CVE-2024-26787", "CVE-2024-26816", "CVE-2024-26820", "CVE-2024-26851", "CVE-2024-26852", "CVE-2024-26855", "CVE-2024-26859", "CVE-2024-26861", "CVE-2024-26863", "CVE-2024-26870", "CVE-2024-26872", "CVE-2024-26875", "CVE-2024-26877", "CVE-2024-26878", "CVE-2024-26880", "CVE-2024-26882", "CVE-2024-26883", "CVE-2024-26884", "CVE-2024-26889", "CVE-2024-26891", "CVE-2024-26894", "CVE-2024-26895", "CVE-2024-26897", "CVE-2024-26898", "CVE-2024-26901", "CVE-2024-26903", "CVE-2024-26906", "CVE-2024-26907", "CVE-2024-27024", "CVE-2024-27025", "CVE-2024-27038", "CVE-2024-27047", "CVE-2024-27052", "CVE-2024-27053", "CVE-2024-27065", "CVE-2024-27076", "CVE-2024-27077", "CVE-2024-27078", "CVE-2024-27419", "CVE-2024-27431", "CVE-2024-27436", "CVE-2024-35828", "CVE-2024-35845", "CVE-2024-35902", "CVE-2024-40961", "CVE-2022-48829", "CVE-2024-40934", "CVE-2024-36286", "CVE-2021-47107", "CVE-2024-38619", "CVE-2024-33847", "CVE-2024-39509", "CVE-2022-48827", "CVE-2024-40941", "CVE-2024-38596", "CVE-2024-38599", "CVE-2024-38565", "CVE-2024-42093", "CVE-2024-42097", "CVE-2024-39502", "CVE-2024-40995", "CVE-2024-40942", "CVE-2024-40960", "CVE-2024-38598", "CVE-2024-41004", "CVE-2024-26629", "CVE-2024-41006", "CVE-2024-36489", "CVE-2024-41005", "CVE-2024-39468", "CVE-2024-40984", "CVE-2024-38567", "CVE-2024-39489", "CVE-2024-38662", "CVE-2021-47316", "CVE-2024-39482", "CVE-2024-38552", "CVE-2024-42094", "CVE-2024-40958", "CVE-2024-38780", "CVE-2024-36894", "CVE-2024-40912", "CVE-2024-40905", "CVE-2024-36974", "CVE-2024-40971", "CVE-2021-47002", "CVE-2024-38558", "CVE-2024-38659", "CVE-2024-36270", "CVE-2024-38612", "CVE-2024-41000", "CVE-2024-42070", "CVE-2024-38547", "CVE-2024-38578", "CVE-2024-42090", "CVE-2024-42082", "CVE-2024-37356", "CVE-2024-33621", "CVE-2024-38615", "CVE-2024-38381", "CVE-2024-42096", "CVE-2024-40959", "CVE-2024-38589", "CVE-2024-38579", "CVE-2024-38560", "CVE-2024-34027", "CVE-2022-48828", "CVE-2024-40978", "CVE-2024-40993", "CVE-2024-40980", "CVE-2024-39503", "CVE-2024-38635", "CVE-2024-36978", "CVE-2021-4090", "CVE-2024-23848", "CVE-2024-50121", "CVE-2023-1652", "CVE-2024-42272", "CVE-2024-36288", "CVE-2021-38202", "CVE-2024-49977", "CVE-2022-43945", "CVE-2024-38559", "CVE-2024-50251", "CVE-2024-50262", "CVE-2024-53042", "CVE-2024-53057", "CVE-2024-53059", "CVE-2024-26885", "CVE-2024-27072", "CVE-2024-35965", "CVE-2024-41016", "CVE-2024-46854", "CVE-2024-46865", "CVE-2024-47684", "CVE-2024-47685", "CVE-2024-47692", "CVE-2024-47696", "CVE-2024-47697", "CVE-2024-47699", "CVE-2024-47701", "CVE-2024-47705", "CVE-2024-47706", "CVE-2024-47709", "CVE-2024-47710", "CVE-2024-47713", "CVE-2024-47718", "CVE-2024-47723", "CVE-2024-47735", "CVE-2024-47737", "CVE-2024-47747", "CVE-2024-49851", "CVE-2024-49889", "CVE-2024-49890", "CVE-2024-49892", "CVE-2024-49894", "CVE-2024-49900", "CVE-2024-49902", "CVE-2024-49903", "CVE-2024-49930", "CVE-2024-49938", "CVE-2024-49944", "CVE-2024-49948", "CVE-2024-49949", "CVE-2024-49952", "CVE-2024-49955", "CVE-2024-49973", "CVE-2024-49997", "CVE-2024-50001", "CVE-2024-50006", "CVE-2024-50008", "CVE-2024-50010", "CVE-2024-50015", "CVE-2024-50033", "CVE-2024-50035", "CVE-2024-50039", "CVE-2024-50040", "CVE-2024-50044", "CVE-2024-50045", "CVE-2024-50046", "CVE-2024-50058", "CVE-2024-50095", "CVE-2024-50127", "CVE-2024-50131", "CVE-2024-50134", "CVE-2024-50142", "CVE-2024-50148", "CVE-2024-50150", "CVE-2024-50151", "CVE-2024-50153", "CVE-2024-50188", "CVE-2024-50205", "CVE-2024-50210", "CVE-2022-38096", "CVE-2023-28746", "CVE-2023-47233", "CVE-2023-52458", "CVE-2023-52614", "CVE-2023-52620", "CVE-2024-23307", "CVE-2024-24857", "CVE-2024-24858", "CVE-2024-24859", "CVE-2024-25739", "CVE-2024-26642", "CVE-2024-26643", "CVE-2024-26810", "CVE-2024-26812", "CVE-2024-26920", "CVE-2024-26923", "CVE-2024-26925", "CVE-2024-26934", "CVE-2024-26935", "CVE-2024-26937", "CVE-2024-26950", "CVE-2024-26951", "CVE-2024-26958", "CVE-2024-26960", "CVE-2024-26961", "CVE-2024-26973", "CVE-2024-26974", "CVE-2024-26988", "CVE-2024-26993", "CVE-2024-27004", "CVE-2024-27013", "CVE-2024-27020", "CVE-2024-27059", "CVE-2024-27395", "CVE-2024-27396", "CVE-2024-27397", "CVE-2024-27437", "CVE-2024-35789", "CVE-2024-35805", "CVE-2024-35807", "CVE-2024-35811", "CVE-2024-35813", "CVE-2024-35815", "CVE-2024-35823", "CVE-2024-35849", "CVE-2024-35877", "CVE-2024-35884", "CVE-2024-35886", "CVE-2024-35888", "CVE-2024-35893", "CVE-2024-35895", "CVE-2024-35896", "CVE-2024-35897", "CVE-2024-35898", "CVE-2024-35899", "CVE-2024-35900", "CVE-2024-35905", "CVE-2024-35910", "CVE-2024-35915", "CVE-2024-35922", "CVE-2024-35925", "CVE-2024-35930", "CVE-2024-35933", "CVE-2024-35934", "CVE-2024-35935", "CVE-2024-35936", "CVE-2024-35940", "CVE-2024-35944", "CVE-2024-35950", "CVE-2024-35955", "CVE-2024-35958", "CVE-2024-35960", "CVE-2024-35962", "CVE-2024-35966", "CVE-2024-35967", "CVE-2024-35969", "CVE-2024-35973", "CVE-2024-35976", "CVE-2024-35978", "CVE-2024-35982", "CVE-2024-35983", "CVE-2024-35984", "CVE-2024-35988", "CVE-2024-35990", "CVE-2024-35996", "CVE-2024-35997", "CVE-2024-36004", "CVE-2024-36005", "CVE-2024-36006", "CVE-2024-36007", "CVE-2024-36008", "CVE-2024-36020", "CVE-2024-36899", "CVE-2024-38587", "CVE-2024-39493", "CVE-2024-40916", "CVE-2024-42114", "CVE-2024-42259", "CVE-2024-42265", "CVE-2024-42276", "CVE-2024-42281", "CVE-2024-42283", "CVE-2024-42292", "CVE-2024-42302", "CVE-2024-42304", "CVE-2024-42305", "CVE-2024-42306", "CVE-2024-42312", "CVE-2024-43828", "CVE-2024-43830", "CVE-2024-43834", "CVE-2024-43856", "CVE-2024-43858", "CVE-2024-43871", "CVE-2024-43879", "CVE-2024-43882", "CVE-2024-43889", "CVE-2024-43890", "CVE-2024-43893", "CVE-2024-44935", "CVE-2024-44944", "CVE-2024-44948", "CVE-2024-44960", "CVE-2024-47707", "CVE-2024-53124", "CVE-2024-56631", "CVE-2024-56672", "CVE-2024-57901", "CVE-2024-57902", "CVE-2024-57913", "CVE-2024-57929", "CVE-2024-57940", "CVE-2024-57948", "CVE-2024-57951", "CVE-2024-58016", "CVE-2024-58051", "CVE-2024-58085", "CVE-2024-41996", "CVE-2023-6237", "CVE-2023-6129", "CVE-2025-9230", "CVE-2023-50781", "CVE-2025-3198", "CVE-2025-5244", "CVE-2025-5245", "CVE-2025-7425", "CVE-2025-7545", "CVE-2025-7546", "CVE-2025-8224", "CVE-2024-40945", "CVE-2025-21638", "CVE-2025-21639", "CVE-2025-21640", "CVE-2025-21648", "CVE-2025-21653", "CVE-2025-21664", "CVE-2025-21666", "CVE-2025-21669", "CVE-2025-21678", "CVE-2025-21683", "CVE-2025-21692", "CVE-2025-21694", "CVE-2024-26982", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-57981", "CVE-2024-57986", "CVE-2024-58005", "CVE-2024-58009", "CVE-2024-58014", "CVE-2024-58017", "CVE-2024-58020", "CVE-2024-58058", "CVE-2024-58063", "CVE-2024-58071", "CVE-2024-58072", "CVE-2025-21647", "CVE-2025-21704", "CVE-2025-21711", "CVE-2025-21719", "CVE-2025-21726", "CVE-2025-21727", "CVE-2025-21728", "CVE-2025-21735", "CVE-2025-21744", "CVE-2025-21745", "CVE-2025-21753", "CVE-2025-21756", "CVE-2025-21760", "CVE-2025-21761", "CVE-2025-21762", "CVE-2025-21763", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21772", "CVE-2025-21776", "CVE-2025-21787", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21806", "CVE-2025-21814", "CVE-2025-21826", "CVE-2025-21835", "CVE-2025-21844", "CVE-2025-21846", "CVE-2025-21858", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21865", "CVE-2025-68160", "CVE-2025-69418", "CVE-2025-69419", "CVE-2025-69420", "CVE-2025-69421", "CVE-2026-22795", "CVE-2026-22796", "CVE-2026-28387", "CVE-2026-28388", "CVE-2026-28389", "CVE-2026-28390", "CVE-2026-31431", "CVE-2023-3817", "CVE-2024-0584", "CVE-2024-47672" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "title": "SSA-267056", "relatedCves": [ "CVE-2025-40815", "CVE-2025-40816", "CVE-2025-40817" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "title": "SSA-282044", "relatedCves": [ "CVE-2025-30033" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "title": "SSA-333035", "relatedCves": [ "CVE-2026-102075", "CVE-2026-102076", "CVE-2026-102074", "CVE-2026-102073", "CVE-2026-89208" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "title": "SSA-377139", "relatedCves": [ "CVE-2026-44414", "CVE-2026-44415" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "title": "SSA-390352", "relatedCves": [ "CVE-2026-85114", "CVE-2026-85115" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "title": "SSA-392859", "relatedCves": [ "CVE-2024-52051" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "title": "SSA-398330", "relatedCves": [ "CVE-2023-45871", "CVE-2023-45853", "CVE-2023-45322", "CVE-2013-0340", "CVE-2013-4235", "CVE-2014-7209", "CVE-2015-20107", "CVE-2022-37454", "CVE-2022-43680", "CVE-2022-45061", "CVE-2019-19242", "CVE-2019-19244", "CVE-2019-19317", "CVE-2019-19603", "CVE-2019-19645", "CVE-2019-19646", "CVE-2019-19880", "CVE-2019-19923", "CVE-2019-19924", "CVE-2019-19925", "CVE-2019-19926", "CVE-2019-19959", "CVE-2019-20218", "CVE-2016-10228", "CVE-2020-10029", "CVE-2020-1752", "CVE-2020-6096", "CVE-2016-10739", "CVE-2019-6488", "CVE-2016-3189", "CVE-2019-12900", "CVE-2021-28363", "CVE-2021-45960", "CVE-2022-0778", "CVE-2022-25235", "CVE-2022-25236", "CVE-2022-25313", "CVE-2022-25314", "CVE-2022-25315", "CVE-2022-26488", "CVE-2016-3709", "CVE-2022-29824", "CVE-2016-4658", "CVE-2016-5131", "CVE-2016-9318", "CVE-2017-0663", "CVE-2017-9047", "CVE-2017-9048", "CVE-2017-9049", "CVE-2017-9050", "CVE-2017-16931", "CVE-2017-16932", "CVE-2017-17512", "CVE-2017-18258", "CVE-2017-7375", "CVE-2017-7376", "CVE-2018-0495", "CVE-2019-12904", "CVE-2019-13627", "CVE-2018-12886", "CVE-2018-14404", "CVE-2018-14567", "CVE-2018-19591", "CVE-2018-20482", "CVE-2018-20843", "CVE-2018-25032", "CVE-2019-1010022", "CVE-2019-1010023", "CVE-2019-1010024", "CVE-2019-1010025", "CVE-2019-1010180", "CVE-2019-10160", "CVE-2019-9636", "CVE-2019-9740", "CVE-2019-9947", "CVE-2019-9948", "CVE-2019-11360", "CVE-2019-12290", "CVE-2019-13057", "CVE-2019-13565", "CVE-2019-15847", "CVE-2019-15903", "CVE-2019-16056", "CVE-2019-16168", "CVE-2019-16905", "CVE-2019-17498", "CVE-2020-22218", "CVE-2019-17543", "CVE-2019-17594", "CVE-2019-17595", "CVE-2019-18224", "CVE-2019-18276", "CVE-2019-18348", "CVE-2020-8492", "CVE-2019-19126", "CVE-2020-1751", "CVE-2019-19906", "CVE-2019-19956", "CVE-2019-20367", "CVE-2019-20388", "CVE-2020-24977", "CVE-2020-7595", "CVE-2021-3516", "CVE-2021-3517", "CVE-2021-3518", "CVE-2021-3537", "CVE-2021-3541", "CVE-2019-20795", "CVE-2019-20907", "CVE-2020-14422", "CVE-2020-15523", "CVE-2020-15801", "CVE-2020-26116", "CVE-2019-25013", "CVE-2020-27618", "CVE-2020-29562", "CVE-2020-29573", "CVE-2021-27645", "CVE-2021-3326", "CVE-2019-3855", "CVE-2019-3856", "CVE-2019-3857", "CVE-2019-3858", "CVE-2019-3859", "CVE-2019-3860", "CVE-2019-3861", "CVE-2019-3862", "CVE-2019-3863", "CVE-2019-5018", "CVE-2019-8457", "CVE-2019-9936", "CVE-2019-9937", "CVE-2019-5094", "CVE-2019-5188", "CVE-2019-5435", "CVE-2019-5436", "CVE-2019-5443", "CVE-2019-5481", "CVE-2019-5482", "CVE-2020-19909", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111", "CVE-2019-7309", "CVE-2019-9169", "CVE-2019-9674", "CVE-2019-9923", "CVE-2020-10531", "CVE-2020-21913", "CVE-2020-10543", "CVE-2020-10878", "CVE-2020-12723", "CVE-2020-10735", "CVE-2021-28861", "CVE-2020-11501", "CVE-2020-11655", "CVE-2020-11656", "CVE-2020-13630", "CVE-2020-13631", "CVE-2020-13632", "CVE-2020-35525", "CVE-2020-35527", "CVE-2020-9327", "CVE-2020-12062", "CVE-2020-12243", "CVE-2020-12762", "CVE-2020-13434", "CVE-2020-13435", "CVE-2020-13529", "CVE-2023-26604", "CVE-2020-13776", "CVE-2020-13777", "CVE-2020-13871", "CVE-2020-15358", "CVE-2020-14145", "CVE-2021-28041", "CVE-2020-15778", "CVE-2020-1712", "CVE-2020-19185", "CVE-2020-19186", "CVE-2020-19187", "CVE-2020-19188", "CVE-2020-19189", "CVE-2020-19190", "CVE-2023-29491", "CVE-2020-21047", "CVE-2021-33294", "CVE-2020-24659", "CVE-2020-25692", "CVE-2020-25709", "CVE-2020-25710", "CVE-2020-28196", "CVE-2020-29361", "CVE-2020-29362", "CVE-2020-29363", "CVE-2020-36221", "CVE-2020-36222", "CVE-2020-36223", "CVE-2020-36224", "CVE-2020-36225", "CVE-2020-36226", "CVE-2020-36227", "CVE-2020-36228", "CVE-2020-36229", "CVE-2020-36230", "CVE-2020-8169", "CVE-2020-8177", "CVE-2020-8231", "CVE-2020-8284", "CVE-2020-8285", "CVE-2020-8286", "CVE-2020-8315", "CVE-2022-48560", "CVE-2021-20193", "CVE-2021-20227", "CVE-2021-20231", "CVE-2021-20232", "CVE-2021-20305", "CVE-2021-3580", "CVE-2021-22876", "CVE-2021-22890", "CVE-2021-22897", "CVE-2021-22898", "CVE-2021-22901", "CVE-2021-22922", "CVE-2021-22923", "CVE-2021-22924", "CVE-2021-22925", "CVE-2021-22926", "CVE-2021-22945", "CVE-2021-22946", "CVE-2021-22947", "CVE-2021-23336", "CVE-2021-3177", "CVE-2021-27212", "CVE-2021-27218", "CVE-2021-27219", "CVE-2021-28153", "CVE-2021-31239", "CVE-2021-32292", "CVE-2021-33560", "CVE-2021-33574", "CVE-2021-35942", "CVE-2021-33910", "CVE-2021-3426", "CVE-2021-3733", "CVE-2021-3737", "CVE-2021-4189", "CVE-2022-0391", "CVE-2021-3520", "CVE-2021-36084", "CVE-2021-36085", "CVE-2021-36086", "CVE-2021-36087", "CVE-2021-36222", "CVE-2021-36690", "CVE-2021-37600", "CVE-2021-37750", "CVE-2021-3826", "CVE-2021-46195", "CVE-2021-38604", "CVE-2021-3998", "CVE-2021-3999", "CVE-2021-43396", "CVE-2022-23218", "CVE-2022-23219", "CVE-2021-3997", "CVE-2021-4122", "CVE-2021-4209", "CVE-2021-43618", "CVE-2021-46143", "CVE-2022-22822", "CVE-2022-22823", "CVE-2022-22824", "CVE-2022-22825", "CVE-2022-22826", "CVE-2022-22827", "CVE-2021-46828", "CVE-2021-46848", "CVE-2022-0563", "CVE-2022-1271", "CVE-2022-1292", "CVE-2022-1343", "CVE-2022-1434", "CVE-2022-1473", "CVE-2022-1304", "CVE-2022-2068", "CVE-2022-2097", "CVE-2022-2274", "CVE-2022-22576", "CVE-2022-27774", "CVE-2022-27775", "CVE-2022-27776", "CVE-2022-23308", "CVE-2022-23852", "CVE-2022-23990", "CVE-2022-24407", "CVE-2022-2509", "CVE-2022-27778", "CVE-2022-27779", "CVE-2022-27780", "CVE-2022-27781", "CVE-2022-27782", "CVE-2022-30115", "CVE-2022-27943", "CVE-2022-28321", "CVE-2022-29155", "CVE-2022-32205", "CVE-2022-32206", "CVE-2022-32207", "CVE-2022-32208", "CVE-2022-32221", "CVE-2022-35260", "CVE-2022-42915", "CVE-2022-42916", "CVE-2022-35252", "CVE-2022-35737", "CVE-2022-3715", "CVE-2022-37434", "CVE-2022-3821", "CVE-2022-45873", "CVE-2022-40303", "CVE-2022-40304", "CVE-2022-40674", "CVE-2022-42898", "CVE-2022-4304", "CVE-2022-4450", "CVE-2023-0215", "CVE-2023-0286", "CVE-2022-43551", "CVE-2022-43552", "CVE-2022-46908", "CVE-2022-48303", "CVE-2022-48522", "CVE-2023-0464", "CVE-2023-24329", "CVE-2023-0361", "CVE-2023-0465", "CVE-2023-0466", "CVE-2023-2650", "CVE-2023-0687", "CVE-2023-25139", "CVE-2023-1077", "CVE-2023-1206", "CVE-2023-3212", "CVE-2023-34319", "CVE-2023-35001", "CVE-2023-3609", "CVE-2023-3611", "CVE-2023-3772", "CVE-2023-39189", "CVE-2023-39192", "CVE-2023-39193", "CVE-2023-39194", "CVE-2023-40283", "CVE-2023-42755", "CVE-2023-4623", "CVE-2023-4921", "CVE-2023-23914", "CVE-2023-23915", "CVE-2023-23916", "CVE-2023-29499", "CVE-2023-32611", "CVE-2023-32636", "CVE-2023-32643", "CVE-2023-32665", "CVE-2023-25136", "CVE-2023-27371", "CVE-2023-27533", "CVE-2023-27534", "CVE-2023-27535", "CVE-2023-27536", "CVE-2023-27537", "CVE-2023-27538", "CVE-2023-28484", "CVE-2023-29469", "CVE-2023-29383", "CVE-2023-2953", "CVE-2023-31085", "CVE-2023-42754", "CVE-2023-5717", "CVE-2023-3446", "CVE-2023-3817", "CVE-2023-34969", "CVE-2023-35945", "CVE-2023-38408", "CVE-2023-39128", "CVE-2023-39615", "CVE-2023-4016", "CVE-2023-4039", "CVE-2023-4813", "CVE-2023-5156", "CVE-2023-4807", "CVE-2023-5678", "CVE-2023-5981", "CVE-2021-44879", "CVE-2023-45898", "CVE-2023-46862", "CVE-2023-6121", "CVE-2023-6817", "CVE-2023-6931", "CVE-2023-6932", "CVE-2024-0584", "CVE-2023-45918", "CVE-2023-52425", "CVE-2023-52426", "CVE-2024-28757", "CVE-2024-2004", "CVE-2024-2379", "CVE-2024-2398", "CVE-2024-2466", "CVE-2024-2511", "CVE-2024-28182", "CVE-2024-28834", "CVE-2024-28835", "CVE-2024-34459", "CVE-2024-5535", "CVE-2024-5742", "CVE-2024-7264", "CVE-2024-6409", "CVE-2024-8096", "CVE-2024-9143", "CVE-2024-2236", "CVE-2024-50602", "CVE-2024-52533", "CVE-2024-11053", "CVE-2023-52444", "CVE-2023-52464", "CVE-2023-52612", "CVE-2023-52675", "CVE-2024-35809", "CVE-2024-35944", "CVE-2024-56433", "CVE-2024-26880", "CVE-2024-35807", "CVE-2024-26878", "CVE-2024-27074", "CVE-2023-52699", "CVE-2024-26898", "CVE-2024-26901", "CVE-2024-49982", "CVE-2024-38780", "CVE-2024-40959", "CVE-2024-33621", "CVE-2024-39292", "CVE-2024-39469", "CVE-2024-39489", "CVE-2024-40901", "CVE-2024-42070", "CVE-2024-26835", "CVE-2024-27065", "CVE-2024-38598", "CVE-2024-36286", "CVE-2024-38596", "CVE-2024-42096", "CVE-2024-38621", "CVE-2024-37356", "CVE-2024-38612", "CVE-2024-26973", "CVE-2024-35888", "CVE-2024-26957", "CVE-2024-35910", "CVE-2024-35925", "CVE-2024-26863", "CVE-2024-35830", "CVE-2017-15422", "CVE-2018-18928", "CVE-2023-52622", "CVE-2024-27020", "CVE-2024-27032", "CVE-2024-36017", "CVE-2024-36484", "CVE-2024-36904", "CVE-2024-26645", "CVE-2024-36905", "CVE-2024-26671", "CVE-2024-36934", "CVE-2024-26679", "CVE-2024-39487", "CVE-2024-26772", "CVE-2024-41046", "CVE-2024-26773", "CVE-2024-42106", "CVE-2024-26777", "CVE-2024-42131", "CVE-2024-26805", "CVE-2024-42154", "CVE-2024-26923", "CVE-2024-43871", "CVE-2024-44944", "CVE-2024-44965", "CVE-2024-46743", "CVE-2024-46745", "CVE-2024-46750", "CVE-2024-47684", "CVE-2024-47701", "CVE-2024-47737", "CVE-2024-49881", "CVE-2024-49884", "CVE-2024-49948", "CVE-2024-49949", "CVE-2024-49952", "CVE-2024-49997", "CVE-2024-50006", "CVE-2024-50040", "CVE-2024-50045", "CVE-2024-50251", "CVE-2024-50262", "CVE-2024-50299", "CVE-2024-50301", "CVE-2024-53057", "CVE-2024-53140", "CVE-2024-53165", "CVE-2024-53217", "CVE-2025-0167", "CVE-2025-0395", "CVE-2025-0665", "CVE-2025-0725", "CVE-2025-26466", "CVE-2024-8176", "CVE-2024-47707", "CVE-2024-53124", "CVE-2024-56569", "CVE-2024-56600", "CVE-2024-56770", "CVE-2024-57901", "CVE-2025-1390", "CVE-2025-21694", "CVE-2024-56780", "CVE-2024-56606", "CVE-2024-56779", "CVE-2024-57884", "CVE-2024-48881", "CVE-2024-52332", "CVE-2024-56650", "CVE-2024-56570", "CVE-2024-56601", "CVE-2024-53164", "CVE-2024-56644", "CVE-2025-29087", "CVE-2025-29088", "CVE-2025-3277", "CVE-2025-3360", "CVE-2025-32728", "CVE-2016-1839", "CVE-2015-8035", "CVE-2018-9251", "CVE-2019-11340", "CVE-2017-1000082", "CVE-2023-4806", "CVE-2016-10009", "CVE-2023-6270", "CVE-2023-46218", "CVE-2023-46219", "CVE-2023-48795", "CVE-2024-28085", "CVE-2024-2961", "CVE-2024-33599", "CVE-2024-33600", "CVE-2024-33601", "CVE-2024-33602", "CVE-2024-37370", "CVE-2024-37371", "CVE-2024-45490", "CVE-2024-45491", "CVE-2024-45492", "CVE-2024-12133", "CVE-2024-12243", "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-38545", "CVE-2023-38546", "CVE-2023-44487", "CVE-2023-4527", "CVE-2023-4911", "CVE-2025-26465", "CVE-2025-46836" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "title": "SSA-434797", "relatedCves": [ "CVE-2025-15467" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "SSA-457936", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2023-53292", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21863", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40196", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-3497", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23255", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23399", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31449", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31681", "CVE-2026-31682", "CVE-2026-31700", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46174", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-46333", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2025-38617" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "title": "SSA-493396", "relatedCves": [ "CVE-2025-40759" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "title": "SSA-508506", "relatedCves": [ "CVE-2026-89196", "CVE-2026-89197", "CVE-2026-89198", "CVE-2026-89199", "CVE-2026-89200", "CVE-2026-89201", "CVE-2026-89202", "CVE-2026-89203", "CVE-2026-89204", "CVE-2026-89205", "CVE-2026-89206" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "title": "SSA-545643", "relatedCves": [ "CVE-2025-40946", "CVE-2026-41125" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "title": "SSA-550198", "relatedCves": [ "CVE-2026-59241" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "title": "SSA-563922", "relatedCves": [ "CVE-2025-43715" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "title": "SSA-580366", "relatedCves": [ "CVE-2026-110936" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "title": "SSA-591731", "relatedCves": [ "CVE-2026-63350", "CVE-2026-63351", "CVE-2026-63352", "CVE-2026-63353", "CVE-2026-63354", "CVE-2026-63355", "CVE-2026-63356", "CVE-2026-63357" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "title": "SSA-628843", "relatedCves": [ "CVE-2025-2884" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "title": "SSA-693808", "relatedCves": [ "CVE-2024-54678" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "SSA-765416", "relatedCves": [ "CVE-2025-6965", "CVE-2026-11822", "CVE-2026-11824", "CVE-2025-70873", "CVE-2025-71316" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "title": "SSA-784472", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "title": "SSA-794185", "relatedCves": [ "CVE-2024-3596" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "title": "SSA-794697", "relatedCves": [ "CVE-2021-3759", "CVE-2021-4037", "CVE-2021-33655", "CVE-2022-0171", "CVE-2022-1012", "CVE-2022-1015", "CVE-2022-1184", "CVE-2022-1292", "CVE-2022-1343", "CVE-2022-1434", "CVE-2022-1462", "CVE-2022-1473", "CVE-2022-1679", "CVE-2022-1852", "CVE-2022-1882", "CVE-2022-2068", "CVE-2022-2078", "CVE-2022-2097", "CVE-2022-2153", "CVE-2022-2274", "CVE-2022-2327", "CVE-2022-2503", "CVE-2022-2586", "CVE-2022-2588", "CVE-2022-2602", "CVE-2022-2663", "CVE-2022-2905", "CVE-2022-2959", "CVE-2022-2978", "CVE-2022-3028", "CVE-2022-3104", "CVE-2022-3115", "CVE-2022-3169", "CVE-2022-3303", "CVE-2022-3521", "CVE-2022-3524", "CVE-2022-3534", "CVE-2022-3545", "CVE-2022-3564", "CVE-2022-3565", "CVE-2022-3586", "CVE-2022-3594", "CVE-2022-3606", "CVE-2022-3621", "CVE-2022-3625", "CVE-2022-3628", "CVE-2022-3629", "CVE-2022-3633", "CVE-2022-3635", "CVE-2022-3646", "CVE-2022-3649", "CVE-2022-4095", "CVE-2022-4129", "CVE-2022-4139", "CVE-2022-4269", "CVE-2022-4304", "CVE-2022-4450", "CVE-2022-4662", "CVE-2022-20421", "CVE-2022-20422", "CVE-2022-20566", "CVE-2022-20572", "CVE-2022-21123", "CVE-2022-21125", "CVE-2022-21166", "CVE-2022-21505", "CVE-2022-26373", "CVE-2022-32250", "CVE-2022-32296", "CVE-2022-34918", "CVE-2022-36123", "CVE-2022-36280", "CVE-2022-36879", "CVE-2022-36946", "CVE-2022-39188", "CVE-2022-39190", "CVE-2022-40307", "CVE-2022-40768", "CVE-2022-41218", "CVE-2022-41222", "CVE-2022-41674", "CVE-2022-41849", "CVE-2022-41850", "CVE-2022-42328", "CVE-2022-42329", "CVE-2022-42432", "CVE-2022-42703", "CVE-2022-42719", "CVE-2022-42720", "CVE-2022-42721", "CVE-2022-42722", "CVE-2022-42895", "CVE-2022-42896", "CVE-2022-43750", "CVE-2022-47518", "CVE-2022-47520", "CVE-2022-47929", "CVE-2022-47946", "CVE-2023-0215", "CVE-2023-0286", "CVE-2023-0464", "CVE-2023-0465", "CVE-2023-0466", "CVE-2023-0590", "CVE-2023-1077", "CVE-2023-1095", "CVE-2023-3141", "CVE-2023-3268", "CVE-2023-3338", "CVE-2023-3389", "CVE-2023-3446", "CVE-2023-3609", "CVE-2023-23454", "CVE-2023-23455", "CVE-2023-23559", "CVE-2023-26607", "CVE-2023-31436", "CVE-2023-32233", "CVE-2023-4911", "CVE-2023-37453", "CVE-2023-39192", "CVE-2023-39193", "CVE-2023-42753", "CVE-2023-42755", "CVE-2023-4623", "CVE-2023-4921", "CVE-2023-3610", "CVE-2023-35001", "CVE-2023-3611", "CVE-2023-2898", "CVE-2023-4004", "CVE-2023-3777", "CVE-2023-1206", "CVE-2023-4015", "CVE-2023-4273", "CVE-2023-39194", "CVE-2023-3772", "CVE-2023-3773", "CVE-2021-44879", "CVE-2023-5178", "CVE-2023-5197", "CVE-2023-5678", "CVE-2023-5717", "CVE-2023-31085", "CVE-2023-35827", "CVE-2023-39189", "CVE-2023-42754", "CVE-2023-45863", "CVE-2023-45871", "CVE-2023-48795", "CVE-2020-12762", "CVE-2023-6606", "CVE-2023-6931", "CVE-2023-6932", "CVE-2023-7008", "CVE-2023-7104", "CVE-2023-36660", "CVE-2023-50495", "CVE-2023-51384", "CVE-2023-51385", "CVE-2023-51767", "CVE-2024-0232", "CVE-2024-0553", "CVE-2024-0567", "CVE-2024-0584", "CVE-2024-0684", "CVE-2024-22365", "CVE-2024-25062", "CVE-2018-13405", "CVE-2023-3817", "CVE-2023-5981" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "title": "SSA-800126", "relatedCves": [ "CVE-2024-49849" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "title": "SSA-832641", "relatedCves": [ "CVE-2026-44414", "CVE-2026-44415" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "title": "SSA-858251", "relatedCves": [ "CVE-2024-42513", "CVE-2024-42512" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "title": "SSA-864900", "relatedCves": [ "CVE-2024-52963", "CVE-2024-32122", "CVE-2024-50562", "CVE-2025-22862", "CVE-2025-24471", "CVE-2025-25250", "CVE-2024-55599", "CVE-2025-25248", "CVE-2025-53744", "CVE-2025-57740", "CVE-2025-58903", "CVE-2025-31366", "CVE-2025-47890", "CVE-2025-25253", "CVE-2025-58413", "CVE-2025-53843", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-25249", "CVE-2025-31514", "CVE-2025-54821", "CVE-2025-53844", "CVE-2025-67862", "CVE-2026-59837", "CVE-2025-62826", "CVE-2025-62675", "CVE-2025-43892", "CVE-2026-59840", "CVE-2026-84392" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "title": "SSA-911336", "relatedCves": [ "CVE-2026-33387", "CVE-2026-33391", "CVE-2026-33920", "CVE-2026-33388", "CVE-2026-33389" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "title": "SSA-967325", "relatedCves": [ "CVE-2026-0300", "CVE-2026-0256", "CVE-2026-0261", "CVE-2026-0262", "CVE-2026-0257", "CVE-2026-0258", "CVE-2026-0264", "CVE-2026-0265", "CVE-2026-0269", "CVE-2026-0301" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "title": "SSA-968435", "relatedCves": [ "CVE-2026-78556", "CVE-2026-78557" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "title": "SSB-091449", "relatedCves": [] } ], "relatedDocuments": [ { "type": "cve", "id": "CVE-2024-3596", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3596.json", "modifiedAt": "2026-10-15T00:25:35.013Z", "affected": [ { "vendor": "IETF", "product": "RFC", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "2865", "status": "affected" } ] } ], "solutions": [], "workarounds": [] }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "SSA-019113", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-3497", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-46174", "CVE-2026-46333", "CVE-2023-53292", "CVE-2025-21863", "CVE-2025-40196", "CVE-2026-23255", "CVE-2026-23399", "CVE-2026-31449", "CVE-2026-31681", "CVE-2026-31700", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2026-31431", "CVE-2026-43284", "CVE-2026-46300", "CVE-2025-38617" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "title": "SSA-055299", "relatedCves": [ "CVE-2026-89208" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "SSA-082556", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2025-21848", "CVE-2025-21712", "CVE-2025-21865", "CVE-2025-21862", "CVE-2025-21864", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-50246", "CVE-2024-57977", "CVE-2024-24855", "CVE-2024-26596", "CVE-2025-21701", "CVE-2025-21767", "CVE-2025-21728", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21724", "CVE-2025-21765", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21745", "CVE-2023-4527", "CVE-2023-4806", "CVE-2023-4911", "CVE-2023-38545", "CVE-2023-38546", "CVE-2023-5363", "CVE-2023-44487", "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-48795", "CVE-2023-51384", "CVE-2023-51385", "CVE-2023-46218", "CVE-2023-46219", "CVE-2023-6246", "CVE-2023-6779", "CVE-2023-6780", "CVE-2024-28085", "CVE-2024-2961", "CVE-2024-33599", "CVE-2024-33600", "CVE-2024-33601", "CVE-2024-33602", "CVE-2024-34397", "CVE-2024-6387", "CVE-2024-37370", "CVE-2024-37371", "CVE-2024-6119", "CVE-2024-45490", "CVE-2024-45491", "CVE-2024-45492", "CVE-2024-12133", "CVE-2024-12243", "CVE-2025-26465", "CVE-2025-31115", "CVE-2025-46836", "CVE-2025-4598", "CVE-2025-4373", "CVE-2025-6395", "CVE-2025-32988", "CVE-2025-32989", "CVE-2025-3198", "CVE-2025-5244", "CVE-2025-5245", "CVE-2025-7425", "CVE-2025-7545", "CVE-2025-7546", "CVE-2025-8224", "CVE-2025-9230", "CVE-2025-9232", "CVE-2025-11082", "CVE-2025-11083", "CVE-2025-11412", "CVE-2025-11413", "CVE-2025-11414", "CVE-2025-11494", "CVE-2025-11495", "CVE-2025-11839", "CVE-2025-11840", "CVE-2025-39929", "CVE-2025-39931", "CVE-2025-39977", "CVE-2025-40022", "CVE-2025-59375", "CVE-2025-66382", "CVE-2024-57924", "CVE-2025-38614", "CVE-2025-38685", "CVE-2025-38691", "CVE-2025-38701", "CVE-2025-38702", "CVE-2025-38708", "CVE-2025-38721", "CVE-2025-38724", "CVE-2025-38727", "CVE-2025-39683", "CVE-2025-39689", "CVE-2025-39697", "CVE-2025-39724", "CVE-2025-39756", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39783", "CVE-2025-39787", "CVE-2025-39795", "CVE-2025-39798", "CVE-2025-39866", "CVE-2025-38058", "CVE-2025-38063", "CVE-2025-38067", "CVE-2025-38071", "CVE-2025-38079", "CVE-2025-38083", "CVE-2025-38100", "CVE-2025-38111", "CVE-2025-38124", "CVE-2025-38167", "CVE-2025-38198", "CVE-2025-38212", "CVE-2025-38214", "CVE-2025-38215", "CVE-2025-38222", "CVE-2025-38231", "CVE-2025-38236", "CVE-2025-38280", "CVE-2025-38285", "CVE-2025-38312", "CVE-2025-38342", "CVE-2025-38350", "CVE-2025-38364", "CVE-2025-38393", "CVE-2025-38400", "CVE-2025-38430", "CVE-2025-38451", "CVE-2025-38457", "CVE-2025-38465", "CVE-2025-38466", "CVE-2025-38468", "CVE-2025-38470", "CVE-2025-38471", "CVE-2025-38477", "CVE-2025-38498", "CVE-2025-38499", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49998", "CVE-2024-50298", "CVE-2024-56719", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-37945", "CVE-2025-37980", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38704", "CVE-2025-39748", "CVE-2025-39764", "CVE-2025-40135", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-68206", "CVE-2025-68265", "CVE-2025-71161", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-23100", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31431", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43284", "CVE-2026-46174", "CVE-2026-46300", "CVE-2026-32776", "CVE-2026-32777", "CVE-2026-32778", "CVE-2026-3904", "CVE-2026-4046", "CVE-2026-41080", "CVE-2026-4437", "CVE-2026-4438", "CVE-2026-45186", "CVE-2026-5435", "CVE-2026-5450", "CVE-2026-5928", "CVE-2026-6238", "CVE-2006-5051", "CVE-2025-38617", "CVE-2025-32990" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "title": "SSA-099819", "relatedCves": [ "CVE-2024-7322" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "title": "SSA-104023", "relatedCves": [ "CVE-2026-0266", "CVE-2026-0272", "CVE-2026-0273", "CVE-2026-0279", "CVE-2026-0280", "CVE-2026-0281", "CVE-2026-0282", "CVE-2026-0283", "CVE-2026-0284", "CVE-2026-0285", "CVE-2026-0286", "CVE-2026-0287", "CVE-2026-0288", "CVE-2026-0308", "CVE-2026-0309", "CVE-2026-0310" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "title": "SSA-127084", "relatedCves": [ "CVE-2026-23573", "CVE-2026-59839", "CVE-2026-71408", "CVE-2026-71407", "CVE-2026-84393" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "title": "SSA-148322", "relatedCves": [ "CVE-2026-84854" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "title": "SSA-159454", "relatedCves": [ "CVE-2026-72895" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "SSA-265688", "relatedCves": [ "CVE-2023-5678", "CVE-2024-0727", "CVE-2023-6121", "CVE-2023-45898", "CVE-2023-6932", "CVE-2023-6931", "CVE-2023-6817", "CVE-2024-2511", "CVE-2024-5535", "CVE-2024-9143", "CVE-2024-36484", "CVE-2024-36902", "CVE-2024-36904", "CVE-2024-36905", "CVE-2024-36916", "CVE-2024-36929", "CVE-2024-36939", "CVE-2024-36940", "CVE-2024-36959", "CVE-2024-44987", "CVE-2024-44989", "CVE-2024-44990", "CVE-2024-45016", "CVE-2024-45018", "CVE-2024-46679", "CVE-2024-46743", "CVE-2024-46744", "CVE-2024-46745", "CVE-2024-46750", "CVE-2024-46759", "CVE-2024-46783", "CVE-2024-47660", "CVE-2024-50299", "CVE-2024-50301", "CVE-2024-53101", "CVE-2024-50302", "CVE-2023-52447", "CVE-2024-22099", "CVE-2024-26651", "CVE-2024-26659", "CVE-2024-26787", "CVE-2024-26816", "CVE-2024-26820", "CVE-2024-26851", "CVE-2024-26852", "CVE-2024-26855", "CVE-2024-26859", "CVE-2024-26861", "CVE-2024-26863", "CVE-2024-26870", "CVE-2024-26872", "CVE-2024-26875", "CVE-2024-26877", "CVE-2024-26878", "CVE-2024-26880", "CVE-2024-26882", "CVE-2024-26883", "CVE-2024-26884", "CVE-2024-26889", "CVE-2024-26891", "CVE-2024-26894", "CVE-2024-26895", "CVE-2024-26897", "CVE-2024-26898", "CVE-2024-26901", "CVE-2024-26903", "CVE-2024-26906", "CVE-2024-26907", "CVE-2024-27024", "CVE-2024-27025", "CVE-2024-27038", "CVE-2024-27047", "CVE-2024-27052", "CVE-2024-27053", "CVE-2024-27065", "CVE-2024-27076", "CVE-2024-27077", "CVE-2024-27078", "CVE-2024-27419", "CVE-2024-27431", "CVE-2024-27436", "CVE-2024-35828", "CVE-2024-35845", "CVE-2024-35902", "CVE-2024-40961", "CVE-2022-48829", "CVE-2024-40934", "CVE-2024-36286", "CVE-2021-47107", "CVE-2024-38619", "CVE-2024-33847", "CVE-2024-39509", "CVE-2022-48827", "CVE-2024-40941", "CVE-2024-38596", "CVE-2024-38599", "CVE-2024-38565", "CVE-2024-42093", "CVE-2024-42097", "CVE-2024-39502", "CVE-2024-40995", "CVE-2024-40942", "CVE-2024-40960", "CVE-2024-38598", "CVE-2024-41004", "CVE-2024-26629", "CVE-2024-41006", "CVE-2024-36489", "CVE-2024-41005", "CVE-2024-39468", "CVE-2024-40984", "CVE-2024-38567", "CVE-2024-39489", "CVE-2024-38662", "CVE-2021-47316", "CVE-2024-39482", "CVE-2024-38552", "CVE-2024-42094", "CVE-2024-40958", "CVE-2024-38780", "CVE-2024-36894", "CVE-2024-40912", "CVE-2024-40905", "CVE-2024-36974", "CVE-2024-40971", "CVE-2021-47002", "CVE-2024-38558", "CVE-2024-38659", "CVE-2024-36270", "CVE-2024-38612", "CVE-2024-41000", "CVE-2024-42070", "CVE-2024-38547", "CVE-2024-38578", "CVE-2024-42090", "CVE-2024-42082", "CVE-2024-37356", "CVE-2024-33621", "CVE-2024-38615", "CVE-2024-38381", "CVE-2024-42096", "CVE-2024-40959", "CVE-2024-38589", "CVE-2024-38579", "CVE-2024-38560", "CVE-2024-34027", "CVE-2022-48828", "CVE-2024-40978", "CVE-2024-40993", "CVE-2024-40980", "CVE-2024-39503", "CVE-2024-38635", "CVE-2024-36978", "CVE-2021-4090", "CVE-2024-23848", "CVE-2024-50121", "CVE-2023-1652", "CVE-2024-42272", "CVE-2024-36288", "CVE-2021-38202", "CVE-2024-49977", "CVE-2022-43945", "CVE-2024-38559", "CVE-2024-50251", "CVE-2024-50262", "CVE-2024-53042", "CVE-2024-53057", "CVE-2024-53059", "CVE-2024-26885", "CVE-2024-27072", "CVE-2024-35965", "CVE-2024-41016", "CVE-2024-46854", "CVE-2024-46865", "CVE-2024-47684", "CVE-2024-47685", "CVE-2024-47692", "CVE-2024-47696", "CVE-2024-47697", "CVE-2024-47699", "CVE-2024-47701", "CVE-2024-47705", "CVE-2024-47706", "CVE-2024-47709", "CVE-2024-47710", "CVE-2024-47713", "CVE-2024-47718", "CVE-2024-47723", "CVE-2024-47735", "CVE-2024-47737", "CVE-2024-47747", "CVE-2024-49851", "CVE-2024-49889", "CVE-2024-49890", "CVE-2024-49892", "CVE-2024-49894", "CVE-2024-49900", "CVE-2024-49902", "CVE-2024-49903", "CVE-2024-49930", "CVE-2024-49938", "CVE-2024-49944", "CVE-2024-49948", "CVE-2024-49949", "CVE-2024-49952", "CVE-2024-49955", "CVE-2024-49973", "CVE-2024-49997", "CVE-2024-50001", "CVE-2024-50006", "CVE-2024-50008", "CVE-2024-50010", "CVE-2024-50015", "CVE-2024-50033", "CVE-2024-50035", "CVE-2024-50039", "CVE-2024-50040", "CVE-2024-50044", "CVE-2024-50045", "CVE-2024-50046", "CVE-2024-50058", "CVE-2024-50095", "CVE-2024-50127", "CVE-2024-50131", "CVE-2024-50134", "CVE-2024-50142", "CVE-2024-50148", "CVE-2024-50150", "CVE-2024-50151", "CVE-2024-50153", "CVE-2024-50188", "CVE-2024-50205", "CVE-2024-50210", "CVE-2022-38096", "CVE-2023-28746", "CVE-2023-47233", "CVE-2023-52458", "CVE-2023-52614", "CVE-2023-52620", "CVE-2024-23307", "CVE-2024-24857", "CVE-2024-24858", "CVE-2024-24859", "CVE-2024-25739", "CVE-2024-26642", "CVE-2024-26643", "CVE-2024-26810", "CVE-2024-26812", "CVE-2024-26920", "CVE-2024-26923", "CVE-2024-26925", "CVE-2024-26934", "CVE-2024-26935", "CVE-2024-26937", "CVE-2024-26950", "CVE-2024-26951", "CVE-2024-26958", "CVE-2024-26960", "CVE-2024-26961", "CVE-2024-26973", "CVE-2024-26974", "CVE-2024-26988", "CVE-2024-26993", "CVE-2024-27004", "CVE-2024-27013", "CVE-2024-27020", "CVE-2024-27059", "CVE-2024-27395", "CVE-2024-27396", "CVE-2024-27397", "CVE-2024-27437", "CVE-2024-35789", "CVE-2024-35805", "CVE-2024-35807", "CVE-2024-35811", "CVE-2024-35813", "CVE-2024-35815", "CVE-2024-35823", "CVE-2024-35849", "CVE-2024-35877", "CVE-2024-35884", "CVE-2024-35886", "CVE-2024-35888", "CVE-2024-35893", "CVE-2024-35895", "CVE-2024-35896", "CVE-2024-35897", "CVE-2024-35898", "CVE-2024-35899", "CVE-2024-35900", "CVE-2024-35905", "CVE-2024-35910", "CVE-2024-35915", "CVE-2024-35922", "CVE-2024-35925", "CVE-2024-35930", "CVE-2024-35933", "CVE-2024-35934", "CVE-2024-35935", "CVE-2024-35936", "CVE-2024-35940", "CVE-2024-35944", "CVE-2024-35950", "CVE-2024-35955", "CVE-2024-35958", "CVE-2024-35960", "CVE-2024-35962", "CVE-2024-35966", "CVE-2024-35967", "CVE-2024-35969", "CVE-2024-35973", "CVE-2024-35976", "CVE-2024-35978", "CVE-2024-35982", "CVE-2024-35983", "CVE-2024-35984", "CVE-2024-35988", "CVE-2024-35990", "CVE-2024-35996", "CVE-2024-35997", "CVE-2024-36004", "CVE-2024-36005", "CVE-2024-36006", "CVE-2024-36007", "CVE-2024-36008", "CVE-2024-36020", "CVE-2024-36899", "CVE-2024-38587", "CVE-2024-39493", "CVE-2024-40916", "CVE-2024-42114", "CVE-2024-42259", "CVE-2024-42265", "CVE-2024-42276", "CVE-2024-42281", "CVE-2024-42283", "CVE-2024-42292", "CVE-2024-42302", "CVE-2024-42304", "CVE-2024-42305", "CVE-2024-42306", "CVE-2024-42312", "CVE-2024-43828", "CVE-2024-43830", "CVE-2024-43834", "CVE-2024-43856", "CVE-2024-43858", "CVE-2024-43871", "CVE-2024-43879", "CVE-2024-43882", "CVE-2024-43889", "CVE-2024-43890", "CVE-2024-43893", "CVE-2024-44935", "CVE-2024-44944", "CVE-2024-44948", "CVE-2024-44960", "CVE-2024-47707", "CVE-2024-53124", "CVE-2024-56631", "CVE-2024-56672", "CVE-2024-57901", "CVE-2024-57902", "CVE-2024-57913", "CVE-2024-57929", "CVE-2024-57940", "CVE-2024-57948", "CVE-2024-57951", "CVE-2024-58016", "CVE-2024-58051", "CVE-2024-58085", "CVE-2024-41996", "CVE-2023-6237", "CVE-2023-6129", "CVE-2025-9230", "CVE-2023-50781", "CVE-2025-3198", "CVE-2025-5244", "CVE-2025-5245", "CVE-2025-7425", "CVE-2025-7545", "CVE-2025-7546", "CVE-2025-8224", "CVE-2024-40945", "CVE-2025-21638", "CVE-2025-21639", "CVE-2025-21640", "CVE-2025-21648", "CVE-2025-21653", "CVE-2025-21664", "CVE-2025-21666", "CVE-2025-21669", "CVE-2025-21678", "CVE-2025-21683", "CVE-2025-21692", "CVE-2025-21694", "CVE-2024-26982", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-57981", "CVE-2024-57986", "CVE-2024-58005", "CVE-2024-58009", "CVE-2024-58014", "CVE-2024-58017", "CVE-2024-58020", "CVE-2024-58058", "CVE-2024-58063", "CVE-2024-58071", "CVE-2024-58072", "CVE-2025-21647", "CVE-2025-21704", "CVE-2025-21711", "CVE-2025-21719", "CVE-2025-21726", "CVE-2025-21727", "CVE-2025-21728", "CVE-2025-21735", "CVE-2025-21744", "CVE-2025-21745", "CVE-2025-21753", "CVE-2025-21756", "CVE-2025-21760", "CVE-2025-21761", "CVE-2025-21762", "CVE-2025-21763", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21772", "CVE-2025-21776", "CVE-2025-21787", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21806", "CVE-2025-21814", "CVE-2025-21826", "CVE-2025-21835", "CVE-2025-21844", "CVE-2025-21846", "CVE-2025-21858", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21865", "CVE-2025-68160", "CVE-2025-69418", "CVE-2025-69419", "CVE-2025-69420", "CVE-2025-69421", "CVE-2026-22795", "CVE-2026-22796", "CVE-2026-28387", "CVE-2026-28388", "CVE-2026-28389", "CVE-2026-28390", "CVE-2026-31431", "CVE-2023-3817", "CVE-2024-0584", "CVE-2024-47672" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "title": "SSA-267056", "relatedCves": [ "CVE-2025-40815", "CVE-2025-40816", "CVE-2025-40817" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "title": "SSA-282044", "relatedCves": [ "CVE-2025-30033" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "title": "SSA-333035", "relatedCves": [ "CVE-2026-102075", "CVE-2026-102076", "CVE-2026-102074", "CVE-2026-102073", "CVE-2026-89208" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "title": "SSA-377139", "relatedCves": [ "CVE-2026-44414", "CVE-2026-44415" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "title": "SSA-390352", "relatedCves": [ "CVE-2026-85114", "CVE-2026-85115" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "title": "SSA-392859", "relatedCves": [ "CVE-2024-52051" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "title": "SSA-398330", "relatedCves": [ "CVE-2023-45871", "CVE-2023-45853", "CVE-2023-45322", "CVE-2013-0340", "CVE-2013-4235", "CVE-2014-7209", "CVE-2015-20107", "CVE-2022-37454", "CVE-2022-43680", "CVE-2022-45061", "CVE-2019-19242", "CVE-2019-19244", "CVE-2019-19317", "CVE-2019-19603", "CVE-2019-19645", "CVE-2019-19646", "CVE-2019-19880", "CVE-2019-19923", "CVE-2019-19924", "CVE-2019-19925", "CVE-2019-19926", "CVE-2019-19959", "CVE-2019-20218", "CVE-2016-10228", "CVE-2020-10029", "CVE-2020-1752", "CVE-2020-6096", "CVE-2016-10739", "CVE-2019-6488", "CVE-2016-3189", "CVE-2019-12900", "CVE-2021-28363", "CVE-2021-45960", "CVE-2022-0778", "CVE-2022-25235", "CVE-2022-25236", "CVE-2022-25313", "CVE-2022-25314", "CVE-2022-25315", "CVE-2022-26488", "CVE-2016-3709", "CVE-2022-29824", "CVE-2016-4658", "CVE-2016-5131", "CVE-2016-9318", "CVE-2017-0663", "CVE-2017-9047", "CVE-2017-9048", "CVE-2017-9049", "CVE-2017-9050", "CVE-2017-16931", "CVE-2017-16932", "CVE-2017-17512", "CVE-2017-18258", "CVE-2017-7375", "CVE-2017-7376", "CVE-2018-0495", "CVE-2019-12904", "CVE-2019-13627", "CVE-2018-12886", "CVE-2018-14404", "CVE-2018-14567", "CVE-2018-19591", "CVE-2018-20482", "CVE-2018-20843", "CVE-2018-25032", "CVE-2019-1010022", "CVE-2019-1010023", "CVE-2019-1010024", "CVE-2019-1010025", "CVE-2019-1010180", "CVE-2019-10160", "CVE-2019-9636", "CVE-2019-9740", "CVE-2019-9947", "CVE-2019-9948", "CVE-2019-11360", "CVE-2019-12290", "CVE-2019-13057", "CVE-2019-13565", "CVE-2019-15847", "CVE-2019-15903", "CVE-2019-16056", "CVE-2019-16168", "CVE-2019-16905", "CVE-2019-17498", "CVE-2020-22218", "CVE-2019-17543", "CVE-2019-17594", "CVE-2019-17595", "CVE-2019-18224", "CVE-2019-18276", "CVE-2019-18348", "CVE-2020-8492", "CVE-2019-19126", "CVE-2020-1751", "CVE-2019-19906", "CVE-2019-19956", "CVE-2019-20367", "CVE-2019-20388", "CVE-2020-24977", "CVE-2020-7595", "CVE-2021-3516", "CVE-2021-3517", "CVE-2021-3518", "CVE-2021-3537", "CVE-2021-3541", "CVE-2019-20795", "CVE-2019-20907", "CVE-2020-14422", "CVE-2020-15523", "CVE-2020-15801", "CVE-2020-26116", "CVE-2019-25013", "CVE-2020-27618", "CVE-2020-29562", "CVE-2020-29573", "CVE-2021-27645", "CVE-2021-3326", "CVE-2019-3855", "CVE-2019-3856", "CVE-2019-3857", "CVE-2019-3858", "CVE-2019-3859", "CVE-2019-3860", "CVE-2019-3861", "CVE-2019-3862", "CVE-2019-3863", "CVE-2019-5018", "CVE-2019-8457", "CVE-2019-9936", "CVE-2019-9937", "CVE-2019-5094", "CVE-2019-5188", "CVE-2019-5435", "CVE-2019-5436", "CVE-2019-5443", "CVE-2019-5481", "CVE-2019-5482", "CVE-2020-19909", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111", "CVE-2019-7309", "CVE-2019-9169", "CVE-2019-9674", "CVE-2019-9923", "CVE-2020-10531", "CVE-2020-21913", "CVE-2020-10543", "CVE-2020-10878", "CVE-2020-12723", "CVE-2020-10735", "CVE-2021-28861", "CVE-2020-11501", "CVE-2020-11655", "CVE-2020-11656", "CVE-2020-13630", "CVE-2020-13631", "CVE-2020-13632", "CVE-2020-35525", "CVE-2020-35527", "CVE-2020-9327", "CVE-2020-12062", "CVE-2020-12243", "CVE-2020-12762", "CVE-2020-13434", "CVE-2020-13435", "CVE-2020-13529", "CVE-2023-26604", "CVE-2020-13776", "CVE-2020-13777", "CVE-2020-13871", "CVE-2020-15358", "CVE-2020-14145", "CVE-2021-28041", "CVE-2020-15778", "CVE-2020-1712", "CVE-2020-19185", "CVE-2020-19186", "CVE-2020-19187", "CVE-2020-19188", "CVE-2020-19189", "CVE-2020-19190", "CVE-2023-29491", "CVE-2020-21047", "CVE-2021-33294", "CVE-2020-24659", "CVE-2020-25692", "CVE-2020-25709", "CVE-2020-25710", "CVE-2020-28196", "CVE-2020-29361", "CVE-2020-29362", "CVE-2020-29363", "CVE-2020-36221", "CVE-2020-36222", "CVE-2020-36223", "CVE-2020-36224", "CVE-2020-36225", "CVE-2020-36226", "CVE-2020-36227", "CVE-2020-36228", "CVE-2020-36229", "CVE-2020-36230", "CVE-2020-8169", "CVE-2020-8177", "CVE-2020-8231", "CVE-2020-8284", "CVE-2020-8285", "CVE-2020-8286", "CVE-2020-8315", "CVE-2022-48560", "CVE-2021-20193", "CVE-2021-20227", "CVE-2021-20231", "CVE-2021-20232", "CVE-2021-20305", "CVE-2021-3580", "CVE-2021-22876", "CVE-2021-22890", "CVE-2021-22897", "CVE-2021-22898", "CVE-2021-22901", "CVE-2021-22922", "CVE-2021-22923", "CVE-2021-22924", "CVE-2021-22925", "CVE-2021-22926", "CVE-2021-22945", "CVE-2021-22946", "CVE-2021-22947", "CVE-2021-23336", "CVE-2021-3177", "CVE-2021-27212", "CVE-2021-27218", "CVE-2021-27219", "CVE-2021-28153", "CVE-2021-31239", "CVE-2021-32292", "CVE-2021-33560", "CVE-2021-33574", "CVE-2021-35942", "CVE-2021-33910", "CVE-2021-3426", "CVE-2021-3733", "CVE-2021-3737", "CVE-2021-4189", "CVE-2022-0391", "CVE-2021-3520", "CVE-2021-36084", "CVE-2021-36085", "CVE-2021-36086", "CVE-2021-36087", "CVE-2021-36222", "CVE-2021-36690", "CVE-2021-37600", "CVE-2021-37750", "CVE-2021-3826", "CVE-2021-46195", "CVE-2021-38604", "CVE-2021-3998", "CVE-2021-3999", "CVE-2021-43396", "CVE-2022-23218", "CVE-2022-23219", "CVE-2021-3997", "CVE-2021-4122", "CVE-2021-4209", "CVE-2021-43618", "CVE-2021-46143", "CVE-2022-22822", "CVE-2022-22823", "CVE-2022-22824", "CVE-2022-22825", "CVE-2022-22826", "CVE-2022-22827", "CVE-2021-46828", "CVE-2021-46848", "CVE-2022-0563", "CVE-2022-1271", "CVE-2022-1292", "CVE-2022-1343", "CVE-2022-1434", "CVE-2022-1473", "CVE-2022-1304", "CVE-2022-2068", "CVE-2022-2097", "CVE-2022-2274", "CVE-2022-22576", "CVE-2022-27774", "CVE-2022-27775", "CVE-2022-27776", "CVE-2022-23308", "CVE-2022-23852", "CVE-2022-23990", "CVE-2022-24407", "CVE-2022-2509", "CVE-2022-27778", "CVE-2022-27779", "CVE-2022-27780", "CVE-2022-27781", "CVE-2022-27782", "CVE-2022-30115", "CVE-2022-27943", "CVE-2022-28321", "CVE-2022-29155", "CVE-2022-32205", "CVE-2022-32206", "CVE-2022-32207", "CVE-2022-32208", "CVE-2022-32221", "CVE-2022-35260", "CVE-2022-42915", "CVE-2022-42916", "CVE-2022-35252", "CVE-2022-35737", "CVE-2022-3715", "CVE-2022-37434", "CVE-2022-3821", "CVE-2022-45873", "CVE-2022-40303", "CVE-2022-40304", "CVE-2022-40674", "CVE-2022-42898", "CVE-2022-4304", "CVE-2022-4450", "CVE-2023-0215", "CVE-2023-0286", "CVE-2022-43551", "CVE-2022-43552", "CVE-2022-46908", "CVE-2022-48303", "CVE-2022-48522", "CVE-2023-0464", "CVE-2023-24329", "CVE-2023-0361", "CVE-2023-0465", "CVE-2023-0466", "CVE-2023-2650", "CVE-2023-0687", "CVE-2023-25139", "CVE-2023-1077", "CVE-2023-1206", "CVE-2023-3212", "CVE-2023-34319", "CVE-2023-35001", "CVE-2023-3609", "CVE-2023-3611", "CVE-2023-3772", "CVE-2023-39189", "CVE-2023-39192", "CVE-2023-39193", "CVE-2023-39194", "CVE-2023-40283", "CVE-2023-42755", "CVE-2023-4623", "CVE-2023-4921", "CVE-2023-23914", "CVE-2023-23915", "CVE-2023-23916", "CVE-2023-29499", "CVE-2023-32611", "CVE-2023-32636", "CVE-2023-32643", "CVE-2023-32665", "CVE-2023-25136", "CVE-2023-27371", "CVE-2023-27533", "CVE-2023-27534", "CVE-2023-27535", "CVE-2023-27536", "CVE-2023-27537", "CVE-2023-27538", "CVE-2023-28484", "CVE-2023-29469", "CVE-2023-29383", "CVE-2023-2953", "CVE-2023-31085", "CVE-2023-42754", "CVE-2023-5717", "CVE-2023-3446", "CVE-2023-3817", "CVE-2023-34969", "CVE-2023-35945", "CVE-2023-38408", "CVE-2023-39128", "CVE-2023-39615", "CVE-2023-4016", "CVE-2023-4039", "CVE-2023-4813", "CVE-2023-5156", "CVE-2023-4807", "CVE-2023-5678", "CVE-2023-5981", "CVE-2021-44879", "CVE-2023-45898", "CVE-2023-46862", "CVE-2023-6121", "CVE-2023-6817", "CVE-2023-6931", "CVE-2023-6932", "CVE-2024-0584", "CVE-2023-45918", "CVE-2023-52425", "CVE-2023-52426", "CVE-2024-28757", "CVE-2024-2004", "CVE-2024-2379", "CVE-2024-2398", "CVE-2024-2466", "CVE-2024-2511", "CVE-2024-28182", "CVE-2024-28834", "CVE-2024-28835", "CVE-2024-34459", "CVE-2024-5535", "CVE-2024-5742", "CVE-2024-7264", "CVE-2024-6409", "CVE-2024-8096", "CVE-2024-9143", "CVE-2024-2236", "CVE-2024-50602", "CVE-2024-52533", "CVE-2024-11053", "CVE-2023-52444", "CVE-2023-52464", "CVE-2023-52612", "CVE-2023-52675", "CVE-2024-35809", "CVE-2024-35944", "CVE-2024-56433", "CVE-2024-26880", "CVE-2024-35807", "CVE-2024-26878", "CVE-2024-27074", "CVE-2023-52699", "CVE-2024-26898", "CVE-2024-26901", "CVE-2024-49982", "CVE-2024-38780", "CVE-2024-40959", "CVE-2024-33621", "CVE-2024-39292", "CVE-2024-39469", "CVE-2024-39489", "CVE-2024-40901", "CVE-2024-42070", "CVE-2024-26835", "CVE-2024-27065", "CVE-2024-38598", "CVE-2024-36286", "CVE-2024-38596", "CVE-2024-42096", "CVE-2024-38621", "CVE-2024-37356", "CVE-2024-38612", "CVE-2024-26973", "CVE-2024-35888", "CVE-2024-26957", "CVE-2024-35910", "CVE-2024-35925", "CVE-2024-26863", "CVE-2024-35830", "CVE-2017-15422", "CVE-2018-18928", "CVE-2023-52622", "CVE-2024-27020", "CVE-2024-27032", "CVE-2024-36017", "CVE-2024-36484", "CVE-2024-36904", "CVE-2024-26645", "CVE-2024-36905", "CVE-2024-26671", "CVE-2024-36934", "CVE-2024-26679", "CVE-2024-39487", "CVE-2024-26772", "CVE-2024-41046", "CVE-2024-26773", "CVE-2024-42106", "CVE-2024-26777", "CVE-2024-42131", "CVE-2024-26805", "CVE-2024-42154", "CVE-2024-26923", "CVE-2024-43871", "CVE-2024-44944", "CVE-2024-44965", "CVE-2024-46743", "CVE-2024-46745", "CVE-2024-46750", "CVE-2024-47684", "CVE-2024-47701", "CVE-2024-47737", "CVE-2024-49881", "CVE-2024-49884", "CVE-2024-49948", "CVE-2024-49949", "CVE-2024-49952", "CVE-2024-49997", "CVE-2024-50006", "CVE-2024-50040", "CVE-2024-50045", "CVE-2024-50251", "CVE-2024-50262", "CVE-2024-50299", "CVE-2024-50301", "CVE-2024-53057", "CVE-2024-53140", "CVE-2024-53165", "CVE-2024-53217", "CVE-2025-0167", "CVE-2025-0395", "CVE-2025-0665", "CVE-2025-0725", "CVE-2025-26466", "CVE-2024-8176", "CVE-2024-47707", "CVE-2024-53124", "CVE-2024-56569", "CVE-2024-56600", "CVE-2024-56770", "CVE-2024-57901", "CVE-2025-1390", "CVE-2025-21694", "CVE-2024-56780", "CVE-2024-56606", "CVE-2024-56779", "CVE-2024-57884", "CVE-2024-48881", "CVE-2024-52332", "CVE-2024-56650", "CVE-2024-56570", "CVE-2024-56601", "CVE-2024-53164", "CVE-2024-56644", "CVE-2025-29087", "CVE-2025-29088", "CVE-2025-3277", "CVE-2025-3360", "CVE-2025-32728", "CVE-2016-1839", "CVE-2015-8035", "CVE-2018-9251", "CVE-2019-11340", "CVE-2017-1000082", "CVE-2023-4806", "CVE-2016-10009", "CVE-2023-6270", "CVE-2023-46218", "CVE-2023-46219", "CVE-2023-48795", "CVE-2024-28085", "CVE-2024-2961", "CVE-2024-33599", "CVE-2024-33600", "CVE-2024-33601", "CVE-2024-33602", "CVE-2024-37370", "CVE-2024-37371", "CVE-2024-45490", "CVE-2024-45491", "CVE-2024-45492", "CVE-2024-12133", "CVE-2024-12243", "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-38545", "CVE-2023-38546", "CVE-2023-44487", "CVE-2023-4527", "CVE-2023-4911", "CVE-2025-26465", "CVE-2025-46836" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "title": "SSA-434797", "relatedCves": [ "CVE-2025-15467" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "SSA-457936", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2023-53292", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21863", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40196", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-3497", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23255", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23399", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31449", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31681", "CVE-2026-31682", "CVE-2026-31700", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46174", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-46333", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2025-38617" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "title": "SSA-493396", "relatedCves": [ "CVE-2025-40759" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "title": "SSA-508506", "relatedCves": [ "CVE-2026-89196", "CVE-2026-89197", "CVE-2026-89198", "CVE-2026-89199", "CVE-2026-89200", "CVE-2026-89201", "CVE-2026-89202", "CVE-2026-89203", "CVE-2026-89204", "CVE-2026-89205", "CVE-2026-89206" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "title": "SSA-545643", "relatedCves": [ "CVE-2025-40946", "CVE-2026-41125" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "title": "SSA-550198", "relatedCves": [ "CVE-2026-59241" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "title": "SSA-563922", "relatedCves": [ "CVE-2025-43715" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "title": "SSA-580366", "relatedCves": [ "CVE-2026-110936" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "title": "SSA-591731", "relatedCves": [ "CVE-2026-63350", "CVE-2026-63351", "CVE-2026-63352", "CVE-2026-63353", "CVE-2026-63354", "CVE-2026-63355", "CVE-2026-63356", "CVE-2026-63357" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "title": "SSA-628843", "relatedCves": [ "CVE-2025-2884" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "title": "SSA-693808", "relatedCves": [ "CVE-2024-54678" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "SSA-765416", "relatedCves": [ "CVE-2025-6965", "CVE-2026-11822", "CVE-2026-11824", "CVE-2025-70873", "CVE-2025-71316" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "title": "SSA-784472", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "title": "SSA-794185", "relatedCves": [ "CVE-2024-3596" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "title": "SSA-794697", "relatedCves": [ "CVE-2021-3759", "CVE-2021-4037", "CVE-2021-33655", "CVE-2022-0171", "CVE-2022-1012", "CVE-2022-1015", "CVE-2022-1184", "CVE-2022-1292", "CVE-2022-1343", "CVE-2022-1434", "CVE-2022-1462", "CVE-2022-1473", "CVE-2022-1679", "CVE-2022-1852", "CVE-2022-1882", "CVE-2022-2068", "CVE-2022-2078", "CVE-2022-2097", "CVE-2022-2153", "CVE-2022-2274", "CVE-2022-2327", "CVE-2022-2503", "CVE-2022-2586", "CVE-2022-2588", "CVE-2022-2602", "CVE-2022-2663", "CVE-2022-2905", "CVE-2022-2959", "CVE-2022-2978", "CVE-2022-3028", "CVE-2022-3104", "CVE-2022-3115", "CVE-2022-3169", "CVE-2022-3303", "CVE-2022-3521", "CVE-2022-3524", "CVE-2022-3534", "CVE-2022-3545", "CVE-2022-3564", "CVE-2022-3565", "CVE-2022-3586", "CVE-2022-3594", "CVE-2022-3606", "CVE-2022-3621", "CVE-2022-3625", "CVE-2022-3628", "CVE-2022-3629", "CVE-2022-3633", "CVE-2022-3635", "CVE-2022-3646", "CVE-2022-3649", "CVE-2022-4095", "CVE-2022-4129", "CVE-2022-4139", "CVE-2022-4269", "CVE-2022-4304", "CVE-2022-4450", "CVE-2022-4662", "CVE-2022-20421", "CVE-2022-20422", "CVE-2022-20566", "CVE-2022-20572", "CVE-2022-21123", "CVE-2022-21125", "CVE-2022-21166", "CVE-2022-21505", "CVE-2022-26373", "CVE-2022-32250", "CVE-2022-32296", "CVE-2022-34918", "CVE-2022-36123", "CVE-2022-36280", "CVE-2022-36879", "CVE-2022-36946", "CVE-2022-39188", "CVE-2022-39190", "CVE-2022-40307", "CVE-2022-40768", "CVE-2022-41218", "CVE-2022-41222", "CVE-2022-41674", "CVE-2022-41849", "CVE-2022-41850", "CVE-2022-42328", "CVE-2022-42329", "CVE-2022-42432", "CVE-2022-42703", "CVE-2022-42719", "CVE-2022-42720", "CVE-2022-42721", "CVE-2022-42722", "CVE-2022-42895", "CVE-2022-42896", "CVE-2022-43750", "CVE-2022-47518", "CVE-2022-47520", "CVE-2022-47929", "CVE-2022-47946", "CVE-2023-0215", "CVE-2023-0286", "CVE-2023-0464", "CVE-2023-0465", "CVE-2023-0466", "CVE-2023-0590", "CVE-2023-1077", "CVE-2023-1095", "CVE-2023-3141", "CVE-2023-3268", "CVE-2023-3338", "CVE-2023-3389", "CVE-2023-3446", "CVE-2023-3609", "CVE-2023-23454", "CVE-2023-23455", "CVE-2023-23559", "CVE-2023-26607", "CVE-2023-31436", "CVE-2023-32233", "CVE-2023-4911", "CVE-2023-37453", "CVE-2023-39192", "CVE-2023-39193", "CVE-2023-42753", "CVE-2023-42755", "CVE-2023-4623", "CVE-2023-4921", "CVE-2023-3610", "CVE-2023-35001", "CVE-2023-3611", "CVE-2023-2898", "CVE-2023-4004", "CVE-2023-3777", "CVE-2023-1206", "CVE-2023-4015", "CVE-2023-4273", "CVE-2023-39194", "CVE-2023-3772", "CVE-2023-3773", "CVE-2021-44879", "CVE-2023-5178", "CVE-2023-5197", "CVE-2023-5678", "CVE-2023-5717", "CVE-2023-31085", "CVE-2023-35827", "CVE-2023-39189", "CVE-2023-42754", "CVE-2023-45863", "CVE-2023-45871", "CVE-2023-48795", "CVE-2020-12762", "CVE-2023-6606", "CVE-2023-6931", "CVE-2023-6932", "CVE-2023-7008", "CVE-2023-7104", "CVE-2023-36660", "CVE-2023-50495", "CVE-2023-51384", "CVE-2023-51385", "CVE-2023-51767", "CVE-2024-0232", "CVE-2024-0553", "CVE-2024-0567", "CVE-2024-0584", "CVE-2024-0684", "CVE-2024-22365", "CVE-2024-25062", "CVE-2018-13405", "CVE-2023-3817", "CVE-2023-5981" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "title": "SSA-800126", "relatedCves": [ "CVE-2024-49849" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "title": "SSA-832641", "relatedCves": [ "CVE-2026-44414", "CVE-2026-44415" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "title": "SSA-858251", "relatedCves": [ "CVE-2024-42513", "CVE-2024-42512" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "title": "SSA-864900", "relatedCves": [ "CVE-2024-52963", "CVE-2024-32122", "CVE-2024-50562", "CVE-2025-22862", "CVE-2025-24471", "CVE-2025-25250", "CVE-2024-55599", "CVE-2025-25248", "CVE-2025-53744", "CVE-2025-57740", "CVE-2025-58903", "CVE-2025-31366", "CVE-2025-47890", "CVE-2025-25253", "CVE-2025-58413", "CVE-2025-53843", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-25249", "CVE-2025-31514", "CVE-2025-54821", "CVE-2025-53844", "CVE-2025-67862", "CVE-2026-59837", "CVE-2025-62826", "CVE-2025-62675", "CVE-2025-43892", "CVE-2026-59840", "CVE-2026-84392" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "title": "SSA-911336", "relatedCves": [ "CVE-2026-33387", "CVE-2026-33391", "CVE-2026-33920", "CVE-2026-33388", "CVE-2026-33389" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "title": "SSA-967325", "relatedCves": [ "CVE-2026-0300", "CVE-2026-0256", "CVE-2026-0261", "CVE-2026-0262", "CVE-2026-0257", "CVE-2026-0258", "CVE-2026-0264", "CVE-2026-0265", "CVE-2026-0269", "CVE-2026-0301" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "title": "SSA-968435", "relatedCves": [ "CVE-2026-78556", "CVE-2026-78557" ], "truncated": false }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "title": "SSB-091449", "relatedCves": [], "truncated": false } ] }, "relatedCves": [ "CVE-2024-3596", "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-3497", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-46174", "CVE-2026-46333", "CVE-2023-53292", "CVE-2025-21863", "CVE-2025-40196", "CVE-2026-23255", "CVE-2026-23399", "CVE-2026-31449", "CVE-2026-31681", "CVE-2026-31700", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2026-31431", "CVE-2026-43284", "CVE-2026-46300", "CVE-2025-38617", "CVE-2026-89208", "CVE-2024-58005", "CVE-2024-53166", "CVE-2025-21848", "CVE-2025-21712", "CVE-2025-21865", "CVE-2025-21862", "CVE-2025-21756", "CVE-2024-50246", "CVE-2024-24855", "CVE-2024-26596", "CVE-2025-21701", "CVE-2025-21767", "CVE-2025-21728", "CVE-2025-21766", "CVE-2025-21724", "CVE-2024-57996", "CVE-2023-4527", "CVE-2023-4806", "CVE-2023-4911", "CVE-2023-38545", "CVE-2023-38546", "CVE-2023-5363", "CVE-2023-44487", "CVE-2023-48795", "CVE-2023-51385", "CVE-2023-46218", "CVE-2023-46219", "CVE-2023-6246", "CVE-2023-6779", "CVE-2023-6780", "CVE-2024-28085", "CVE-2024-2961", "CVE-2024-33599", "CVE-2024-33600", "CVE-2024-33601", "CVE-2024-33602", "CVE-2024-34397", "CVE-2024-6387", "CVE-2024-37370", "CVE-2024-37371", "CVE-2024-6119", "CVE-2024-45490", "CVE-2024-45491", "CVE-2024-45492", "CVE-2024-12133", "CVE-2024-12243", "CVE-2025-26465", "CVE-2025-31115", "CVE-2025-46836", "CVE-2025-4598", "CVE-2025-4373", "CVE-2025-6395", "CVE-2025-32988", "CVE-2025-32989", "CVE-2025-3198", "CVE-2025-5244", "CVE-2025-5245", "CVE-2025-7425", "CVE-2025-7545", "CVE-2025-7546", "CVE-2025-8224", "CVE-2025-9230", "CVE-2025-9232", "CVE-2025-11082", "CVE-2025-11083", "CVE-2025-11412", "CVE-2025-11413", "CVE-2025-11414", "CVE-2025-11494", "CVE-2025-11495", "CVE-2025-11839", "CVE-2025-11840", "CVE-2025-39929", "CVE-2025-59375", "CVE-2025-66382", "CVE-2025-38685", "CVE-2025-38691", "CVE-2025-38701", "CVE-2025-38702", "CVE-2025-38708", "CVE-2025-38724", "CVE-2025-39683", "CVE-2025-39689", "CVE-2025-39697", "CVE-2025-39724", "CVE-2025-39783", "CVE-2025-39787", "CVE-2025-39798", "CVE-2025-38058", "CVE-2025-38063", "CVE-2025-38067", "CVE-2025-38071", "CVE-2025-38079", "CVE-2025-38083", "CVE-2025-38100", "CVE-2025-38111", "CVE-2025-38124", "CVE-2025-38167", "CVE-2025-38198", "CVE-2025-38212", "CVE-2025-38214", "CVE-2025-38215", "CVE-2025-38222", "CVE-2025-38231", "CVE-2025-38236", "CVE-2025-38280", "CVE-2025-38285", "CVE-2025-38312", "CVE-2025-38342", "CVE-2025-38350", "CVE-2025-38364", "CVE-2025-38393", "CVE-2025-38400", "CVE-2025-38430", "CVE-2025-38451", "CVE-2025-38457", "CVE-2025-38465", "CVE-2025-38466", "CVE-2025-38468", "CVE-2025-38470", "CVE-2025-38471", "CVE-2025-38477", "CVE-2025-38498", "CVE-2025-38499", "CVE-2026-32776", "CVE-2026-32777", "CVE-2026-32778", "CVE-2026-3904", "CVE-2026-4046", "CVE-2026-41080", "CVE-2026-4437", "CVE-2026-4438", "CVE-2026-45186", "CVE-2026-5435", "CVE-2026-5450", "CVE-2026-5928", "CVE-2026-6238", "CVE-2006-5051", "CVE-2025-32990", "CVE-2024-7322", "CVE-2026-0266", "CVE-2026-0272", "CVE-2026-0273", "CVE-2026-0279", "CVE-2026-0280", "CVE-2026-0281", "CVE-2026-0282", "CVE-2026-0283", "CVE-2026-0284", "CVE-2026-0285", "CVE-2026-0286", "CVE-2026-0287", "CVE-2026-0288", "CVE-2026-0308", "CVE-2026-0309", "CVE-2026-0310", "CVE-2026-23573", "CVE-2026-59839", "CVE-2026-71408", "CVE-2026-71407", "CVE-2026-84393", "CVE-2026-84854", "CVE-2026-72895", "CVE-2023-5678", "CVE-2024-0727", "CVE-2023-6121", "CVE-2023-45898", "CVE-2023-6932", "CVE-2023-6931", "CVE-2023-6817", "CVE-2024-2511", "CVE-2024-5535", "CVE-2024-9143", "CVE-2024-36484", "CVE-2024-36902", "CVE-2024-36904", "CVE-2024-36905", "CVE-2024-36916", "CVE-2024-36929", "CVE-2024-36939", "CVE-2024-36940", "CVE-2024-36959", "CVE-2024-44987", "CVE-2024-44989", "CVE-2024-44990", "CVE-2024-45016", "CVE-2024-45018", "CVE-2024-46679", "CVE-2024-46743", "CVE-2024-46744", "CVE-2024-46745", "CVE-2024-46750", "CVE-2024-46759", "CVE-2024-46783", "CVE-2024-47660", "CVE-2024-50299", "CVE-2024-50301", "CVE-2024-53101", "CVE-2024-50302", "CVE-2023-52447", "CVE-2024-22099", "CVE-2024-26651", "CVE-2024-26659", "CVE-2024-26787", "CVE-2024-26816", "CVE-2024-26820", "CVE-2024-26851", "CVE-2024-26852", "CVE-2024-26855", "CVE-2024-26859", "CVE-2024-26861", "CVE-2024-26863", "CVE-2024-26870", "CVE-2024-26872", "CVE-2024-26875", "CVE-2024-26877", "CVE-2024-26878", "CVE-2024-26880", "CVE-2024-26882", "CVE-2024-26883", "CVE-2024-26884", "CVE-2024-26889", "CVE-2024-26891", "CVE-2024-26894", "CVE-2024-26895", "CVE-2024-26897", "CVE-2024-26898", "CVE-2024-26901", "CVE-2024-26903", "CVE-2024-26906", "CVE-2024-26907", "CVE-2024-27024", "CVE-2024-27025", "CVE-2024-27038", "CVE-2024-27047", "CVE-2024-27052", "CVE-2024-27053", "CVE-2024-27065", "CVE-2024-27076", "CVE-2024-27077", "CVE-2024-27078", "CVE-2024-27419", "CVE-2024-27431", "CVE-2024-27436", "CVE-2024-35828", "CVE-2024-35845", "CVE-2024-35902", "CVE-2024-40961", "CVE-2022-48829", "CVE-2024-40934", "CVE-2024-36286", "CVE-2021-47107", "CVE-2024-38619", "CVE-2024-33847", "CVE-2024-39509", "CVE-2022-48827", "CVE-2024-40941", "CVE-2024-38596", "CVE-2024-38599", "CVE-2024-38565", "CVE-2024-42093", "CVE-2024-42097", "CVE-2024-39502", "CVE-2024-40995", "CVE-2024-40942", "CVE-2024-40960", "CVE-2024-38598", "CVE-2024-41004", "CVE-2024-26629", "CVE-2024-41006", "CVE-2024-36489", "CVE-2024-41005", "CVE-2024-39468", "CVE-2024-40984", "CVE-2024-38567", "CVE-2024-39489", "CVE-2024-38662", "CVE-2021-47316", "CVE-2024-39482", "CVE-2024-38552", "CVE-2024-42094", "CVE-2024-40958", "CVE-2024-38780", "CVE-2024-36894", "CVE-2024-40912", "CVE-2024-40905", "CVE-2024-36974", "CVE-2024-40971", "CVE-2021-47002", "CVE-2024-38558", "CVE-2024-38659", "CVE-2024-36270", "CVE-2024-38612", "CVE-2024-41000", "CVE-2024-42070", "CVE-2024-38547", "CVE-2024-38578", "CVE-2024-42090", "CVE-2024-42082", "CVE-2024-37356", "CVE-2024-33621", "CVE-2024-38615", "CVE-2024-38381", "CVE-2024-42096", "CVE-2024-40959", "CVE-2024-38589", "CVE-2024-38579", "CVE-2024-38560", "CVE-2024-34027", "CVE-2022-48828", "CVE-2024-40978", "CVE-2024-40993", "CVE-2024-40980", "CVE-2024-39503", "CVE-2024-38635", "CVE-2024-36978", "CVE-2021-4090", "CVE-2024-23848", "CVE-2024-50121", "CVE-2023-1652", "CVE-2024-42272", "CVE-2024-36288", "CVE-2021-38202", "CVE-2024-49977", "CVE-2022-43945", "CVE-2024-38559", "CVE-2024-50251", "CVE-2024-50262", "CVE-2024-53042", "CVE-2024-53057", "CVE-2024-53059", "CVE-2024-26885", "CVE-2024-27072", "CVE-2024-35965", "CVE-2024-41016", "CVE-2024-46854", "CVE-2024-46865", "CVE-2024-47684", "CVE-2024-47685", "CVE-2024-47692", "CVE-2024-47696", "CVE-2024-47697", "CVE-2024-47699", "CVE-2024-47701", "CVE-2024-47705", "CVE-2024-47706", "CVE-2024-47709", "CVE-2024-47710", "CVE-2024-47713", "CVE-2024-47718", "CVE-2024-47723", "CVE-2024-47735", "CVE-2024-47737", "CVE-2024-47747", "CVE-2024-49851", "CVE-2024-49889", "CVE-2024-49890", "CVE-2024-49892", "CVE-2024-49894", "CVE-2024-49900", "CVE-2024-49902", "CVE-2024-49903", "CVE-2024-49930", "CVE-2024-49938", "CVE-2024-49944", "CVE-2024-49948", "CVE-2024-49949", "CVE-2024-49952", "CVE-2024-49955", "CVE-2024-49973", "CVE-2024-49997", "CVE-2024-50001", "CVE-2024-50006", "CVE-2024-50008", "CVE-2024-50010", "CVE-2024-50015", "CVE-2024-50033", "CVE-2024-50035", "CVE-2024-50039", "CVE-2024-50040", "CVE-2024-50044", "CVE-2024-50045", "CVE-2024-50046", "CVE-2024-50058", "CVE-2024-50095", "CVE-2024-50127", "CVE-2024-50131", "CVE-2024-50134", "CVE-2024-50142", "CVE-2024-50148", "CVE-2024-50150", "CVE-2024-50151", "CVE-2024-50153", "CVE-2024-50188", "CVE-2024-50205", "CVE-2024-50210", "CVE-2022-38096", "CVE-2023-28746", "CVE-2023-47233", "CVE-2023-52458", "CVE-2023-52614", "CVE-2023-52620", "CVE-2024-23307", "CVE-2024-24857", "CVE-2024-24858", "CVE-2024-24859", "CVE-2024-25739", "CVE-2024-26642", "CVE-2024-26643", "CVE-2024-26810", "CVE-2024-26812", "CVE-2024-26920", "CVE-2024-26923", "CVE-2024-26925", "CVE-2024-26934", "CVE-2024-26935", "CVE-2024-26937", "CVE-2024-26950", "CVE-2024-26951", "CVE-2024-26958", "CVE-2024-26960", "CVE-2024-26961", "CVE-2024-26973", "CVE-2024-26974", "CVE-2024-26988", "CVE-2024-26993", "CVE-2024-27004", "CVE-2024-27013", "CVE-2024-27020", "CVE-2024-27059", "CVE-2024-27395", "CVE-2024-27396", "CVE-2024-27397", "CVE-2024-27437", "CVE-2024-35789", "CVE-2024-35805", "CVE-2024-35807", "CVE-2024-35811", "CVE-2024-35813", "CVE-2024-35815", "CVE-2024-35823", "CVE-2024-35849", "CVE-2024-35877", "CVE-2024-35884", "CVE-2024-35886", "CVE-2024-35888", "CVE-2024-35893", "CVE-2024-35895", "CVE-2024-35896", "CVE-2024-35897", "CVE-2024-35898", "CVE-2024-35899", "CVE-2024-35900", "CVE-2024-35905", "CVE-2024-35910", "CVE-2024-35915", "CVE-2024-35922", "CVE-2024-35925", "CVE-2024-35930", "CVE-2024-35933", "CVE-2024-35934", "CVE-2024-35935", "CVE-2024-35936", "CVE-2024-35940", "CVE-2024-35944", "CVE-2024-35950", "CVE-2024-35955", "CVE-2024-35958", "CVE-2024-35960", "CVE-2024-35962", "CVE-2024-35966", "CVE-2024-35967", "CVE-2024-35969", "CVE-2024-35973", "CVE-2024-35976", "CVE-2024-35978", "CVE-2024-35982", "CVE-2024-35983", "CVE-2024-35984", "CVE-2024-35988", "CVE-2024-35990", "CVE-2024-35996", "CVE-2024-35997", "CVE-2024-36004", "CVE-2024-36005", "CVE-2024-36006", "CVE-2024-36007", "CVE-2024-36008", "CVE-2024-36020", "CVE-2024-36899", "CVE-2024-38587", "CVE-2024-39493", "CVE-2024-40916", "CVE-2024-42114", "CVE-2024-42259", "CVE-2024-42265", "CVE-2024-42276", "CVE-2024-42281", "CVE-2024-42283", "CVE-2024-42292", "CVE-2024-42302", "CVE-2024-42304", "CVE-2024-42305", "CVE-2024-42306", "CVE-2024-42312", "CVE-2024-43828", "CVE-2024-43830", "CVE-2024-43834", "CVE-2024-43856", "CVE-2024-43858", "CVE-2024-43871", "CVE-2024-43879", "CVE-2024-43882", "CVE-2024-43889", "CVE-2024-43890", "CVE-2024-43893", "CVE-2024-44935", "CVE-2024-44944", "CVE-2024-44948", "CVE-2024-44960", "CVE-2024-47707", "CVE-2024-56672", "CVE-2024-57901", "CVE-2024-57902", "CVE-2024-57913", "CVE-2024-57929", "CVE-2024-57940", "CVE-2024-57948", "CVE-2024-57951", "CVE-2024-58051", "CVE-2024-58085", "CVE-2024-41996", "CVE-2023-6237", "CVE-2023-6129", "CVE-2023-50781", "CVE-2024-40945", "CVE-2025-21638", "CVE-2025-21639", "CVE-2025-21640", "CVE-2025-21653", "CVE-2025-21664", "CVE-2025-21666", "CVE-2025-21669", "CVE-2025-21678", "CVE-2025-21683", "CVE-2025-21692", "CVE-2025-21694", "CVE-2024-26982", "CVE-2024-57981", "CVE-2024-57986", "CVE-2024-58009", "CVE-2024-58014", "CVE-2024-58017", "CVE-2024-58063", "CVE-2024-58071", "CVE-2024-58072", "CVE-2025-21647", "CVE-2025-21704", "CVE-2025-21711", "CVE-2025-21719", "CVE-2025-21726", "CVE-2025-21727", "CVE-2025-21735", "CVE-2025-21744", "CVE-2025-21753", "CVE-2025-21761", "CVE-2025-21762", "CVE-2025-21763", "CVE-2025-21772", "CVE-2025-21776", "CVE-2025-21787", "CVE-2025-21806", "CVE-2025-21826", "CVE-2025-21835", "CVE-2025-21844", "CVE-2025-21858", "CVE-2025-21859", "CVE-2025-68160", "CVE-2025-69418", "CVE-2025-69419", "CVE-2025-69420", "CVE-2025-69421", "CVE-2026-22795", "CVE-2026-22796", "CVE-2026-28387", "CVE-2026-28388", "CVE-2026-28389", "CVE-2026-28390", "CVE-2023-3817", "CVE-2024-0584", "CVE-2024-47672", "CVE-2025-40815", "CVE-2025-40816", "CVE-2025-40817", "CVE-2025-30033", "CVE-2026-102075", "CVE-2026-102076", "CVE-2026-102074", "CVE-2026-102073", "CVE-2026-44414", "CVE-2026-44415", "CVE-2026-85114", "CVE-2026-85115", "CVE-2024-52051", "CVE-2023-45871", "CVE-2023-45853", "CVE-2023-45322", "CVE-2013-0340", "CVE-2013-4235", "CVE-2014-7209", "CVE-2015-20107", "CVE-2022-37454", "CVE-2022-43680", "CVE-2022-45061", "CVE-2019-19242", "CVE-2019-19244", "CVE-2019-19317", "CVE-2019-19603", "CVE-2019-19645", "CVE-2019-19646", "CVE-2019-19880", "CVE-2019-19923", "CVE-2019-19924", "CVE-2019-19925", "CVE-2019-19926", "CVE-2019-19959", "CVE-2019-20218", "CVE-2016-10228", "CVE-2020-10029", "CVE-2020-1752", "CVE-2020-6096", "CVE-2016-10739", "CVE-2019-6488", "CVE-2016-3189", "CVE-2019-12900", "CVE-2021-28363", "CVE-2021-45960", "CVE-2022-0778", "CVE-2022-25235", "CVE-2022-25236", "CVE-2022-25313", "CVE-2022-25314", "CVE-2022-25315", "CVE-2022-26488", "CVE-2016-3709", "CVE-2022-29824", "CVE-2016-4658", "CVE-2016-5131", "CVE-2016-9318", "CVE-2017-0663", "CVE-2017-9047", "CVE-2017-9048", "CVE-2017-9049", "CVE-2017-9050", "CVE-2017-16931", "CVE-2017-16932", "CVE-2017-17512", "CVE-2017-18258", "CVE-2017-7375", "CVE-2017-7376", "CVE-2018-0495", "CVE-2019-12904", "CVE-2019-13627", "CVE-2018-12886", "CVE-2018-14404", "CVE-2018-14567", "CVE-2018-19591", "CVE-2018-20482", "CVE-2018-20843", "CVE-2018-25032", "CVE-2019-1010022", "CVE-2019-1010023", "CVE-2019-1010024", "CVE-2019-1010025", "CVE-2019-1010180", "CVE-2019-10160", "CVE-2019-9636", "CVE-2019-9740", "CVE-2019-9947", "CVE-2019-9948", "CVE-2019-11360", "CVE-2019-12290", "CVE-2019-13057", "CVE-2019-13565", "CVE-2019-15847", "CVE-2019-15903", "CVE-2019-16056", "CVE-2019-16168", "CVE-2019-16905", "CVE-2019-17498", "CVE-2020-22218", "CVE-2019-17543", "CVE-2019-17594", "CVE-2019-17595", "CVE-2019-18224", "CVE-2019-18276", "CVE-2019-18348", "CVE-2020-8492", "CVE-2019-19126", "CVE-2020-1751", "CVE-2019-19906", "CVE-2019-19956", "CVE-2019-20367", "CVE-2019-20388", "CVE-2020-24977", "CVE-2020-7595", "CVE-2021-3516", "CVE-2021-3517", "CVE-2021-3518", "CVE-2021-3537", "CVE-2021-3541", "CVE-2019-20795", "CVE-2019-20907", "CVE-2020-14422", "CVE-2020-15523", "CVE-2020-15801", "CVE-2020-26116", "CVE-2019-25013", "CVE-2020-27618", "CVE-2020-29562", "CVE-2020-29573", "CVE-2021-27645", "CVE-2021-3326", "CVE-2019-3855", "CVE-2019-3856", "CVE-2019-3857", "CVE-2019-3858", "CVE-2019-3859", "CVE-2019-3860", "CVE-2019-3861", "CVE-2019-3862", "CVE-2019-3863", "CVE-2019-5018", "CVE-2019-8457", "CVE-2019-9936", "CVE-2019-9937", "CVE-2019-5094", "CVE-2019-5188", "CVE-2019-5435", "CVE-2019-5436", "CVE-2019-5443", "CVE-2019-5481", "CVE-2019-5482", "CVE-2020-19909", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111", "CVE-2019-7309", "CVE-2019-9169", "CVE-2019-9674", "CVE-2019-9923", "CVE-2020-10531", "CVE-2020-21913", "CVE-2020-10543", "CVE-2020-10878", "CVE-2020-12723", "CVE-2020-10735", "CVE-2021-28861", "CVE-2020-11501", "CVE-2020-11655", "CVE-2020-11656", "CVE-2020-13630", "CVE-2020-13631", "CVE-2020-13632", "CVE-2020-35525", "CVE-2020-35527", "CVE-2020-9327", "CVE-2020-12062", "CVE-2020-12243", "CVE-2020-12762", "CVE-2020-13434", "CVE-2020-13435", "CVE-2020-13529", "CVE-2023-26604", "CVE-2020-13776", "CVE-2020-13777", "CVE-2020-13871", "CVE-2020-15358", "CVE-2020-14145", "CVE-2021-28041", "CVE-2020-15778", "CVE-2020-1712", "CVE-2020-19185", "CVE-2020-19186", "CVE-2020-19187", "CVE-2020-19188", "CVE-2020-19189", "CVE-2020-19190", "CVE-2023-29491", "CVE-2020-21047", "CVE-2021-33294", "CVE-2020-24659", "CVE-2020-25692", "CVE-2020-25709", "CVE-2020-25710", "CVE-2020-28196", "CVE-2020-29361", "CVE-2020-29362", "CVE-2020-29363", "CVE-2020-36221", "CVE-2020-36222", "CVE-2020-36223", "CVE-2020-36224", "CVE-2020-36225", "CVE-2020-36226", "CVE-2020-36227", "CVE-2020-36228", "CVE-2020-36229", "CVE-2020-36230", "CVE-2020-8169", "CVE-2020-8177", "CVE-2020-8231", "CVE-2020-8284", "CVE-2020-8285", "CVE-2020-8286", "CVE-2020-8315", "CVE-2022-48560", "CVE-2021-20193", "CVE-2021-20227", "CVE-2021-20231", "CVE-2021-20232", "CVE-2021-20305", "CVE-2021-3580", "CVE-2021-22876", "CVE-2021-22890", "CVE-2021-22897", "CVE-2021-22898", "CVE-2021-22901", "CVE-2021-22922", "CVE-2021-22923", "CVE-2021-22924", "CVE-2021-22925", "CVE-2021-22926", "CVE-2021-22945", "CVE-2021-22946", "CVE-2021-22947", "CVE-2021-23336", "CVE-2021-3177", "CVE-2021-27212", "CVE-2021-27218", "CVE-2021-27219", "CVE-2021-28153", "CVE-2021-31239", "CVE-2021-32292", "CVE-2021-33560", "CVE-2021-33574", "CVE-2021-35942", "CVE-2021-33910", "CVE-2021-3426", "CVE-2021-3733", "CVE-2021-3737", "CVE-2021-4189", "CVE-2022-0391", "CVE-2021-3520", "CVE-2021-36084", "CVE-2021-36085", "CVE-2021-36086", "CVE-2021-36087", "CVE-2021-36222", "CVE-2021-36690", "CVE-2021-37600", "CVE-2021-37750", "CVE-2021-3826", "CVE-2021-46195", "CVE-2021-38604", "CVE-2021-3998", "CVE-2021-3999", "CVE-2021-43396", "CVE-2022-23218", "CVE-2022-23219", "CVE-2021-3997", "CVE-2021-4122", "CVE-2021-4209", "CVE-2021-43618", "CVE-2021-46143", "CVE-2022-22822", "CVE-2022-22823", "CVE-2022-22824", "CVE-2022-22825", "CVE-2022-22826", "CVE-2022-22827", "CVE-2021-46828", "CVE-2021-46848", "CVE-2022-0563", "CVE-2022-1271", "CVE-2022-1292", "CVE-2022-1343", "CVE-2022-1434", "CVE-2022-1473", "CVE-2022-1304", "CVE-2022-2068", "CVE-2022-2097", "CVE-2022-2274", "CVE-2022-22576", "CVE-2022-27774", "CVE-2022-27775", "CVE-2022-27776", "CVE-2022-23308", "CVE-2022-23852", "CVE-2022-23990", "CVE-2022-24407", "CVE-2022-2509", "CVE-2022-27778", "CVE-2022-27779", "CVE-2022-27780", "CVE-2022-27781", "CVE-2022-27782", "CVE-2022-30115", "CVE-2022-27943", "CVE-2022-28321", "CVE-2022-29155", "CVE-2022-32205", "CVE-2022-32206", "CVE-2022-32207", "CVE-2022-32208", "CVE-2022-32221", "CVE-2022-35260", "CVE-2022-42915", "CVE-2022-42916", "CVE-2022-35252", "CVE-2022-35737", "CVE-2022-3715", "CVE-2022-37434", "CVE-2022-3821", "CVE-2022-45873", "CVE-2022-40303", "CVE-2022-40304", "CVE-2022-40674", "CVE-2022-42898", "CVE-2022-4304", "CVE-2022-4450", "CVE-2023-0215", "CVE-2023-0286", "CVE-2022-43551", "CVE-2022-43552", "CVE-2022-46908", "CVE-2022-48303", "CVE-2022-48522", "CVE-2023-0464", "CVE-2023-24329", "CVE-2023-0361", "CVE-2023-0465", "CVE-2023-0466", "CVE-2023-2650", "CVE-2023-0687", "CVE-2023-25139", "CVE-2023-1077", "CVE-2023-1206", "CVE-2023-3212", "CVE-2023-34319", "CVE-2023-35001", "CVE-2023-3609", "CVE-2023-3611", "CVE-2023-3772", "CVE-2023-39189", "CVE-2023-39192", "CVE-2023-39193", "CVE-2023-39194", "CVE-2023-40283", "CVE-2023-42755", "CVE-2023-4623", "CVE-2023-4921", "CVE-2023-23914", "CVE-2023-23915", "CVE-2023-23916", "CVE-2023-29499", "CVE-2023-32611", "CVE-2023-32636", "CVE-2023-32643", "CVE-2023-32665", "CVE-2023-25136", "CVE-2023-27371", "CVE-2023-27533", "CVE-2023-27534", "CVE-2023-27535", "CVE-2023-27536", "CVE-2023-27537", "CVE-2023-27538", "CVE-2023-28484", "CVE-2023-29469", "CVE-2023-29383", "CVE-2023-2953", "CVE-2023-31085", "CVE-2023-42754", "CVE-2023-5717", "CVE-2023-3446", "CVE-2023-34969", "CVE-2023-35945", "CVE-2023-38408", "CVE-2023-39128", "CVE-2023-39615", "CVE-2023-4016", "CVE-2023-4039", "CVE-2023-4813", "CVE-2023-5156", "CVE-2023-4807", "CVE-2023-5981", "CVE-2021-44879", "CVE-2023-46862", "CVE-2023-45918", "CVE-2023-52425", "CVE-2023-52426", "CVE-2024-28757", "CVE-2024-2004", "CVE-2024-2379", "CVE-2024-2398", "CVE-2024-2466", "CVE-2024-28182", "CVE-2024-28834", "CVE-2024-28835", "CVE-2024-34459", "CVE-2024-5742", "CVE-2024-7264", "CVE-2024-6409", "CVE-2024-8096", "CVE-2024-2236", "CVE-2024-50602", "CVE-2024-52533", "CVE-2024-11053", "CVE-2023-52444", "CVE-2023-52464", "CVE-2023-52612", "CVE-2023-52675", "CVE-2024-35809", "CVE-2024-56433", "CVE-2024-27074", "CVE-2023-52699", "CVE-2024-49982", "CVE-2024-39292", "CVE-2024-39469", "CVE-2024-40901", "CVE-2024-26835", "CVE-2024-38621", "CVE-2024-26957", "CVE-2024-35830", "CVE-2017-15422", "CVE-2018-18928", "CVE-2023-52622", "CVE-2024-27032", "CVE-2024-36017", "CVE-2024-26645", "CVE-2024-26671", "CVE-2024-36934", "CVE-2024-26679", "CVE-2024-39487", "CVE-2024-26772", "CVE-2024-41046", "CVE-2024-26773", "CVE-2024-42106", "CVE-2024-26777", "CVE-2024-42131", "CVE-2024-26805", "CVE-2024-42154", "CVE-2024-44965", "CVE-2024-49881", "CVE-2024-49884", "CVE-2024-53140", "CVE-2024-53165", "CVE-2024-53217", "CVE-2025-0167", "CVE-2025-0395", "CVE-2025-0665", "CVE-2025-0725", "CVE-2025-26466", "CVE-2024-8176", "CVE-2024-56569", "CVE-2024-56600", "CVE-2024-56770", "CVE-2025-1390", "CVE-2024-56780", "CVE-2024-56606", "CVE-2024-56779", "CVE-2024-57884", "CVE-2024-48881", "CVE-2024-52332", "CVE-2024-56650", "CVE-2024-56570", "CVE-2024-56601", "CVE-2024-53164", "CVE-2024-56644", "CVE-2025-29087", "CVE-2025-29088", "CVE-2025-3277", "CVE-2025-3360", "CVE-2025-32728", "CVE-2016-1839", "CVE-2015-8035", "CVE-2018-9251", "CVE-2019-11340", "CVE-2017-1000082", "CVE-2016-10009", "CVE-2023-6270", "CVE-2025-15467", "CVE-2025-40759", "CVE-2026-89196", "CVE-2026-89197", "CVE-2026-89198", "CVE-2026-89199", "CVE-2026-89200", "CVE-2026-89201", "CVE-2026-89202", "CVE-2026-89203", "CVE-2026-89204", "CVE-2026-89205", "CVE-2026-89206", "CVE-2025-40946", "CVE-2026-41125", "CVE-2026-59241", "CVE-2025-43715", "CVE-2026-110936", "CVE-2026-63350", "CVE-2026-63351", "CVE-2026-63352", "CVE-2026-63353", "CVE-2026-63354", "CVE-2026-63355", "CVE-2026-63356", "CVE-2026-63357", "CVE-2025-2884", "CVE-2024-54678", "CVE-2025-6965", "CVE-2026-11822", "CVE-2026-11824", "CVE-2025-70873", "CVE-2025-71316", "CVE-2024-58002", "CVE-2024-58079", "CVE-2025-21838", "CVE-2025-21725", "CVE-2024-58077", "CVE-2024-58013", "CVE-2025-21703", "CVE-2025-21738", "CVE-2025-21779", "CVE-2025-21790", "CVE-2025-21791", "CVE-2024-57993", "CVE-2025-21700", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-57980", "CVE-2025-21830", "CVE-2026-23253", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-38250", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23396", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23357", "CVE-2026-23352", "CVE-2026-23291", "CVE-2026-23318", "CVE-2026-23296", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23315", "CVE-2025-39863", "CVE-2025-68239", "CVE-2025-38105", "CVE-2026-23364", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46161", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-31699", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46051", "CVE-2026-45838", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43094", "CVE-2026-46195", "CVE-2026-46044", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2023-54271", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-46322", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53253", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2025-37780", "CVE-2021-3759", "CVE-2021-4037", "CVE-2021-33655", "CVE-2022-0171", "CVE-2022-1012", "CVE-2022-1015", "CVE-2022-1184", "CVE-2022-1462", "CVE-2022-1679", "CVE-2022-1852", "CVE-2022-1882", "CVE-2022-2078", "CVE-2022-2153", "CVE-2022-2327", "CVE-2022-2503", "CVE-2022-2586", "CVE-2022-2588", "CVE-2022-2602", "CVE-2022-2663", "CVE-2022-2905", "CVE-2022-2959", "CVE-2022-2978", "CVE-2022-3028", "CVE-2022-3104", "CVE-2022-3115", "CVE-2022-3169", "CVE-2022-3303", "CVE-2022-3521", "CVE-2022-3524", "CVE-2022-3534", "CVE-2022-3545", "CVE-2022-3564", "CVE-2022-3565", "CVE-2022-3586", "CVE-2022-3594", "CVE-2022-3606", "CVE-2022-3621", "CVE-2022-3625", "CVE-2022-3628", "CVE-2022-3629", "CVE-2022-3633", "CVE-2022-3635", "CVE-2022-3646", "CVE-2022-3649", "CVE-2022-4095", "CVE-2022-4129", "CVE-2022-4139", "CVE-2022-4269", "CVE-2022-4662", "CVE-2022-20421", "CVE-2022-20422", "CVE-2022-20566", "CVE-2022-20572", "CVE-2022-21123", "CVE-2022-21125", "CVE-2022-21166", "CVE-2022-21505", "CVE-2022-26373", "CVE-2022-32250", "CVE-2022-32296", "CVE-2022-34918", "CVE-2022-36123", "CVE-2022-36280", "CVE-2022-36879", "CVE-2022-36946", "CVE-2022-39188", "CVE-2022-39190", "CVE-2022-40307", "CVE-2022-40768", "CVE-2022-41218", "CVE-2022-41222", "CVE-2022-41674", "CVE-2022-41849", "CVE-2022-41850", "CVE-2022-42328", "CVE-2022-42329", "CVE-2022-42432", "CVE-2022-42703", "CVE-2022-42719", "CVE-2022-42720", "CVE-2022-42721", "CVE-2022-42722", "CVE-2022-42895", "CVE-2022-42896", "CVE-2022-43750", "CVE-2022-47518", "CVE-2022-47520", "CVE-2022-47929", "CVE-2022-47946", "CVE-2023-0590", "CVE-2023-1095", "CVE-2023-3141", "CVE-2023-3268", "CVE-2023-3338", "CVE-2023-3389", "CVE-2023-23454", "CVE-2023-23455", "CVE-2023-23559", "CVE-2023-26607", "CVE-2023-31436", "CVE-2023-32233", "CVE-2023-37453", "CVE-2023-42753", "CVE-2023-3610", "CVE-2023-2898", "CVE-2023-4004", "CVE-2023-3777", "CVE-2023-4015", "CVE-2023-4273", "CVE-2023-3773", "CVE-2023-5178", "CVE-2023-5197", "CVE-2023-35827", "CVE-2023-45863", "CVE-2023-6606", "CVE-2023-7008", "CVE-2023-7104", "CVE-2023-36660", "CVE-2023-50495", "CVE-2023-51767", "CVE-2024-0232", "CVE-2024-0553", "CVE-2024-0567", "CVE-2024-0684", "CVE-2024-22365", "CVE-2024-25062", "CVE-2018-13405", "CVE-2024-49849", "CVE-2024-42513", "CVE-2024-42512", "CVE-2024-52963", "CVE-2024-32122", "CVE-2024-50562", "CVE-2025-22862", "CVE-2025-24471", "CVE-2025-25250", "CVE-2024-55599", "CVE-2025-25248", "CVE-2025-53744", "CVE-2025-57740", "CVE-2025-58903", "CVE-2025-31366", "CVE-2025-47890", "CVE-2025-25253", "CVE-2025-58413", "CVE-2025-53843", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-25249", "CVE-2025-31514", "CVE-2025-54821", "CVE-2025-53844", "CVE-2025-67862", "CVE-2026-59837", "CVE-2025-62826", "CVE-2025-62675", "CVE-2025-43892", "CVE-2026-59840", "CVE-2026-84392", "CVE-2026-33387", "CVE-2026-33391", "CVE-2026-33920", "CVE-2026-33388", "CVE-2026-33389", "CVE-2026-0300", "CVE-2026-0256", "CVE-2026-0261", "CVE-2026-0262", "CVE-2026-0257", "CVE-2026-0258", "CVE-2026-0264", "CVE-2026-0265", "CVE-2026-0269", "CVE-2026-0301", "CVE-2026-78556", "CVE-2026-78557" ], "sourceSummary": "Siemensから各製品向けのアドバイザリが公表されました。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T03:49:22.000Z", "reviewState": "current", "summary": "Siemensの産業機器・管理ソフトについて、39件の個別告知を製品と版ごとに整理しました。機器ラベルや管理画面の完全な型番・版を控え、下の該当する告知を照合します。同じ製品でも複数の告知があるため、一つの更新だけで全件解決とは判断しません。", "risk": "ネットワーク機器の停止、管理情報の露出、認証の回避、不正な処理の実行など、製品ごとに影響と必要な条件が違います。インストール時だけの問題、ログイン済み利用者が必要な問題、GNU/Linux部分だけの問題を分けて記載しています。", "applicability": [ { "text": "SSA-019113：CPU 1518(F)のGNU/Linux subsystem V3.1.6に含まれる外部部品の問題です。一部のCVEにV3.1.7の修正がありますが、修正未提供のCVEも別の行で示されています。V3.1.6系列は保守されていません。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)：V3.1.6以降。CVEの範囲はこの製品行に割り当てられた項目に限ります。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)：V3.1.6以降、V3.1.7より前。対象はCVE-2026-31431・CVE-2026-43284・CVE-2026-46300。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)：V3.1.6以降。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" ], "evidenceIds": [ "E1", "E2", "E3", "E4" ] }, { "text": "SSA-055299：Capital Embedded AR Classicのメモリー読み取り範囲の誤りにより、動作が不安定になったり停止したりする問題です。431-422とR20-11で修正の有無が違います。\nCapital Embedded AR Classic 431-422：掲載されたこの製品系列のすべての版。対象はCVE-2026-89208。\nCapital Embedded AR Classic R20-11：V2303より前。対象はCVE-2026-89208。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-055299.html" ], "evidenceIds": [ "E5", "E6" ] }, { "text": "SSA-082556：CPU 1518(F)のGNU/Linux subsystem V3.1.5に含まれる部品の問題です。一部はV3.1.6で修正、別の問題は修正未提供です。V3.1.5系列は保守されていません。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)：V3.1.5以降。CVEの範囲はこの製品行に割り当てられた項目に限ります。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)：V3.1.5以降、V3.1.6より前。CVEの範囲はこの製品行に割り当てられた項目に限ります。\nSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)：V3.1.5以降。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" ], "evidenceIds": [ "E7", "E8", "E9", "E10" ] }, { "text": "SSA-099819：SENTRON 3NA COM Fuseのネットワーク管理処理が停止し、接続を確立し直す必要が生じる問題です。\nSENTRON 3NA COM Fuse：V5.2より前。対象はCVE-2024-7322。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-099819.html" ], "evidenceIds": [ "E11", "E12" ] }, { "text": "SSA-104023：RUGGEDCOM APE1808にPalo Alto Networks Virtual NGFWを載せた構成のPAN-OSの問題です。APE1808を使うだけで一律に該当するわけではありません。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWを搭載した構成。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-104023.html" ], "evidenceIds": [ "E13" ] }, { "text": "SSA-127084：RUGGEDCOM APE1808にFortinet NGFWを載せた構成のFortiOSの複数の問題です。機器の提供元が案内する安全な更新手順を使用します。\nRUGGEDCOM APE1808：Fortinet NGFWを搭載した構成。対象はCVE-2026-23573・CVE-2026-59839・CVE-2026-71408・CVE-2026-71407・CVE-2026-84393。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-127084.html" ], "evidenceIds": [ "E14", "E15" ] }, { "text": "SSA-148322：PSS SINCALの旧WibuKeyドングルによるライセンス機構で、処理が終了・停止する問題です。この旧機構を使っているか確認します。\nPSS(R)SINCAL V21.5／PSS(R)SINCAL V22.0：掲載されたこの製品系列のすべての版。対象はCVE-2026-84854。\nPSS(R)SINCAL V22.5：V22.5 Update 5より前。対象はCVE-2026-84854。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-148322.html" ], "evidenceIds": [ "E16", "E17" ] }, { "text": "SSA-159454：一部のSIMATIC IPCのBIOSにテスト用のSecure Boot鍵が含まれ、起動時の検証を回避される問題です。BIOSの番号と機種を組にして照合します。\nSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G：V28.01.15より前。対象はCVE-2026-72895。\nSIMATIC IPC BX-21A：V31.01.13より前。対象はCVE-2026-72895。\nSIMATIC IPC RW-543A：V1.1.4より前。対象はCVE-2026-72895。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-159454.html" ], "evidenceIds": [ "E18", "E19" ] }, { "text": "SSA-265688：TM MFPのGNU/Linux subsystem V1.1の複数の問題です。一部はV1.1.1で修正され、ほかに修正未提供の問題があります。V1.1系列は保守されていません。\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem：V1.1.1より前。CVEの範囲はこの製品行に割り当てられた項目に限ります。\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem：掲載されたこの製品系列のすべての版。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" ], "evidenceIds": [ "E20", "E21", "E22", "E23" ] }, { "text": "SSA-267056：LOGO! 8 BMと掲載されたSIPLUS型番で、外部からのコード実行、機器の到達不能、時刻変更による動作への影響が起こる問題です。コード実行と認証不要のネットワーク操作は条件が異なります。\nLOGO! 12/24RCE (6ED1052-1MD08-0BA2)／LOGO! 12/24RCEo (6ED1052-2MD08-0BA2)／LOGO! 24CE (6ED1052-1CC08-0BA2)／LOGO! 24CEo (6ED1052-2CC08-0BA2)／LOGO! 24RCE (6ED1052-1HB08-0BA2)／LOGO! 24RCEo (6ED1052-2HB08-0BA2)／LOGO! 230RCE (6ED1052-1FB08-0BA2)／LOGO! 230RCEo (6ED1052-2FB08-0BA2)／SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2)／SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2)／SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2)／SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2)／SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2)／SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2)／SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2)／SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2)：V1.84.05より前。対象はCVE-2025-40815・CVE-2025-40816・CVE-2025-40817。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-267056.html" ], "evidenceIds": [ "E24", "E25" ] }, { "text": "SSA-282044：複数製品に使うSiemens Web Installerが、インストール中に不正なDLLを読み込む問題です。対象はセットアップを実行する場面であり、各製品の通常稼働に同じ条件を当てはめません。\nAutomation License Manager V6.0／CEMAT V10.0／Energy Support Library (EnSL)／OpenPCS 7 V9.1／OpenPCS 7 V10.0／SIMATIC BATCH V9.1／SIMATIC BATCH V10.0／SIMATIC Logon V1.6／SIMATIC ODK 1500S／SIMATIC PCS 7 Advanced Process Functions V2.1／SIMATIC PCS 7 Advanced Process Functions V2.2／SIMATIC PCS 7 Advanced Process Graphics V9.1／SIMATIC PCS 7 Advanced Process Graphics V10.0／SIMATIC PCS 7 Advanced Process Library incl. Faceplates V10.0／SIMATIC PCS 7 Industry Library V9.0／SIMATIC PCS 7 Industry Library V9.1／SIMATIC PCS 7 Industry Library V10.0／SIMATIC PCS 7 Logic Matrix V10.0／SIMATIC PCS 7 PowerControl V9.1／SIMATIC PCS 7 Standard Chemical Library V9.1／SIMATIC PCS 7 Standard Chemical Library V10.0／SIMATIC PCS 7 TeleControl V9.1／SIMATIC PCS 7/OPEN OS V9.1／SIMATIC PCS neo V5.0／SIMATIC PDM V9.2／SIMATIC PDM Maintenance Station V5.0／SIMATIC Process Function Library (PFL) V4.0／SIMATIC Process Historian 2020／SIMATIC Process Historian 2022／SIMATIC ProSave V18／SIMATIC S7 F Systems V6.3／SIMATIC S7 F Systems V6.4／SIMATIC S7-1500 Software Controller V2／SIMATIC S7-PLCSIM V17／SIMATIC S7-PLCSIM V18／SIMATIC S7-PLCSIM V19／SIMATIC Safety Matrix V6.3／SIMATIC STEP 7 CFC V19／SIMATIC STEP 7 CFC V20／SIMATIC WinCC flexible ES／TIA Project-Server V17／SIMATIC Control Function Library (CFL) V1.x／TIA Portal Test Suite V17：掲載されたこの製品系列のすべての版。対象はCVE-2025-30033。\nAutomation License Manager V6.2：V6.2 Upd3より前。対象はCVE-2025-30033。\nCP PtP Param configuring interface／FM Configuration Package／Modular PID CTRL Tool／SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)／SIMATIC eaSie Document Skills／SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)／SIMATIC eaSie Workflow Skills／SIMATIC NET PC Software V16／SIMATIC NET PC Software V17／SIMATIC NET PC Software V18／SIMATIC NET PC Software V19／SIMATIC PCS 7 MPC Configurator／SIMATIC ProSave V20／SIMATIC Route Control V9.1／SIMATIC Route Control V10.0／SIMATIC STEP 7 V5.7／SIMATIC WinCC Runtime Professional V20／SIMATIC WinCC TeleControl／SIMIT Rapid Tester／SIMIT Simulation Platform／SINEMA Remote Connect Client／SITRANS／Standard PID CTRL Tool／SIMATIC Energy Suite V17／SINAMICS Startdrive V17：掲載されたこの製品系列のすべての版。対象はCVE-2025-30033。\nCreate MyConfig (CMC)：V6.9より前。対象はCVE-2025-30033。\nMultiFieldbus Configuration Tool (MFCT)：V1.5.5.0より前。対象はCVE-2025-30033。\nSiemens Network Planner (SINETPLAN)：V2.0 SP2より前。対象はCVE-2025-30033。\nSIMATIC Automation Tool／SIMATIC Automation Tool SDK Windows：V5.0 SP4より前。対象はCVE-2025-30033。\nSIMATIC Logon V2.0：V2.0 Upd3より前。対象はCVE-2025-30033。\nSIMATIC Management Agent／SIMATIC Management Console：V9.1 SP1 Upd8より前。対象はCVE-2025-30033。\nSIMATIC NET PC Software V20：V20.0 Update 1より前。対象はCVE-2025-30033。\nSIMATIC PCS 7 V9.1：V9.1 SP1 UC08より前。対象はCVE-2025-30033。\nSIMATIC PCS 7 V10.0：V10.0 SP1 UC01より前。対象はCVE-2025-30033。\nSIMATIC PCS 7 Advanced Process Faceplates V9.1：V9.1 SP2 Upd4より前。対象はCVE-2025-30033。\nSIMATIC PCS 7 Advanced Process Library V9.1：V9.1 SP2 Upd6より前。対象はCVE-2025-30033。\nSIMATIC PCS 7 Basis Faceplates V9.1：V9.1 SP2 Upd2より前。対象はCVE-2025-30033。\nSIMATIC PCS 7 Basis Library V9.1：V9.1 SP2 Upd8より前。対象はCVE-2025-30033。\nSIMATIC PCS 7 Basis Library V10.0：V10.0 SP1 Upd2より前。対象はCVE-2025-30033。\nSIMATIC PCS 7 Logic Matrix V9.1：V9.1 Upd8より前。対象はCVE-2025-30033。\nSIMATIC PCS neo V6.0：V6.0 SP1より前。対象はCVE-2025-30033。\nSIMATIC PDM V9.3：V9.3 SP1 Upd2より前。対象はCVE-2025-30033。\nSIMATIC Process Historian 2024：V2024 SP1 Upd2より前。対象はCVE-2025-30033。\nSIMATIC ProSave V17／SIMATIC WinCC Runtime Advanced／Totally Integrated Automation Portal (TIA Portal) V17／SIMATIC WinCC Visualization Architect (SiVArc) V17：V17 Update 9より前。対象はCVE-2025-30033。\nSIMATIC ProSave V19：V19 Update 4より前。対象はCVE-2025-30033。\nSIMATIC S7-1500 Software Controller V3：V31.1.5より前。対象はCVE-2025-30033。\nSIMATIC S7-Fail-safe Configuration Tool (S7-FCT)：V4.0.1より前。対象はCVE-2025-30033。\nSIMATIC S7-PCT：V3.5 SP4 Update 1より前。対象はCVE-2025-30033。\nSIMATIC S7-PLCSIM V20：V20 Update 1より前。対象はCVE-2025-30033。\nSIMATIC S7-PLCSIM Advanced：V7.0 Update 1より前。対象はCVE-2025-30033。\nSIMATIC Target：V6.0 SP3より前。対象はCVE-2025-30033。\nSIMATIC WinCC V7.5：V7.5 SP2 Update 20より前。対象はCVE-2025-30033。\nSIMATIC WinCC V8.0：V8.0 Update 8より前。対象はCVE-2025-30033。\nSIMATIC WinCC V8.1：V8.1 Update 3より前。対象はCVE-2025-30033。\nSIMATIC WinCC Runtime Professional：V21より前。対象はCVE-2025-30033。\nSIMATIC WinCC Unified Line Coordination／SIMATIC WinCC Unified Sequence：V20より前。対象はCVE-2025-30033。\nSIMATIC D7-SYS：V10.0 SP1より前。対象はCVE-2025-30033。\nSINEC NMS：V4.0より前。対象はCVE-2025-30033。\nTeleControl Server Basic V3.1：V3.1.2.2より前。対象はCVE-2025-30033。\nTIA Administrator：V3.0.6より前。対象はCVE-2025-30033。\nTIA Portal Cloud Connector：V2.3より前。対象はCVE-2025-30033。\nTIA Project-Server：V2.2より前。対象はCVE-2025-30033。\nSIMATIC MTP CREATOR V2.x：V2.1より前。対象はCVE-2025-30033。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-282044.html" ], "evidenceIds": [ "E26", "E27", "E28", "E29", "E30", "E31", "E32", "E33", "E34", "E35", "E36", "E37", "E38" ] }, { "text": "SSA-333035：APOGEE/TALON/Desigoの掲載機種が、BACnetなどの通信によって停止する問題です。P2/BACnet方式と型番の区別が必要です。\nAPOGEE MBC (PPC) (BACnet)：掲載されたこの製品系列のすべての版。対象はCVE-2026-102075・CVE-2026-102076・CVE-2026-102074・CVE-2026-102073。\nAPOGEE MBC (PPC) (P2 Ethernet)／APOGEE MEC (PPC) (BACnet)／APOGEE MEC (PPC) (P2 Ethernet)：掲載されたこの製品系列のすべての版。対象はCVE-2026-102074・CVE-2026-102075・CVE-2026-102076・CVE-2026-102073。\nAPOGEE PXC Compact (BACnet)／APOGEE PXC Modular (BACnet)／TALON TC Compact (BACnet)／TALON TC Modular (BACnet)：V3.5.7より前。対象はCVE-2026-102074・CVE-2026-102075・CVE-2026-102076・CVE-2026-102073。\nAPOGEE PXC Compact (P2 Ethernet)／APOGEE PXC Modular (P2 Ethernet)：V2.8.21より前。対象はCVE-2026-102074・CVE-2026-102075・CVE-2026-102076・CVE-2026-102073。\nDesigo PXC00-E.D／Desigo PXC00-U／Desigo PXC001-E.D／Desigo PXC12-E.D／Desigo PXC22-E.D／Desigo PXC22.1-E.D／Desigo PXC36.1-E.D／Desigo PXC50-E.D／Desigo PXC64-U／Desigo PXC100-E.D／Desigo PXC128-U／Desigo PXC200-E.D／Desigo PXM20-E：V2.3以降。対象はCVE-2026-89208。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-333035.html" ], "evidenceIds": [ "E39", "E40", "E41", "E42", "E43", "E44" ] }, { "text": "SSA-377139：Industrial Edge Device Kitのログイン済み利用者が、許可された場所の外側にある情報を読む問題です。arm64/x86-64と系列で更新先を分けます。\nIndustrial Edge Device Kit - arm64 V1.5／Industrial Edge Device Kit - arm64 V1.6／Industrial Edge Device Kit - arm64 V1.7／Industrial Edge Device Kit - arm64 V1.8／Industrial Edge Device Kit - arm64 V1.9／Industrial Edge Device Kit - arm64 V1.10／Industrial Edge Device Kit - arm64 V1.11／Industrial Edge Device Kit - arm64 V1.12／Industrial Edge Device Kit - arm64 V1.13／Industrial Edge Device Kit - arm64 V1.14／Industrial Edge Device Kit - arm64 V1.15／Industrial Edge Device Kit - arm64 V1.16／Industrial Edge Device Kit - arm64 V1.17／Industrial Edge Device Kit - arm64 V1.18／Industrial Edge Device Kit - arm64 V1.19／Industrial Edge Device Kit - arm64 V1.20／Industrial Edge Device Kit - arm64 V1.21／Industrial Edge Device Kit - arm64 V1.22／Industrial Edge Device Kit - arm64 V1.23／Industrial Edge Device Kit - arm64 V1.24／Industrial Edge Device Kit - arm64 V1.25／Industrial Edge Device Kit - x86-64 V1.5／Industrial Edge Device Kit - x86-64 V1.6／Industrial Edge Device Kit - x86-64 V1.7／Industrial Edge Device Kit - x86-64 V1.8／Industrial Edge Device Kit - x86-64 V1.9／Industrial Edge Device Kit - x86-64 V1.10／Industrial Edge Device Kit - x86-64 V1.11／Industrial Edge Device Kit - x86-64 V1.12／Industrial Edge Device Kit - x86-64 V1.13／Industrial Edge Device Kit - x86-64 V1.14／Industrial Edge Device Kit - x86-64 V1.15／Industrial Edge Device Kit - x86-64 V1.16／Industrial Edge Device Kit - x86-64 V1.17／Industrial Edge Device Kit - x86-64 V1.18／Industrial Edge Device Kit - x86-64 V1.19／Industrial Edge Device Kit - x86-64 V1.20／Industrial Edge Device Kit - x86-64 V1.21／Industrial Edge Device Kit - x86-64 V1.22／Industrial Edge Device Kit - x86-64 V1.23／Industrial Edge Device Kit - x86-64 V1.24／Industrial Edge Device Kit - x86-64 V1.25：掲載されたこの製品系列のすべての版。対象はCVE-2026-44414・CVE-2026-44415。\nIndustrial Edge Device Kit - arm64 V1.26／Industrial Edge Device Kit - x86-64 V1.26：V1.26.2-1より前。対象はCVE-2026-44414・CVE-2026-44415。\nIndustrial Edge Device Kit - arm64 V1.27／Industrial Edge Device Kit - x86-64 V1.27：V1.27.1-1より前。対象はCVE-2026-44414・CVE-2026-44415。\nIndustrial Edge Device Kit - arm64 V1.28／Industrial Edge Device Kit - x86-64 V1.28：V1.28.0-6より前。対象はCVE-2026-44414・CVE-2026-44415。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-377139.html" ], "evidenceIds": [ "E45", "E46", "E47", "E48" ] }, { "text": "SSA-390352：.NET Client Library for S7 Webserver APIの、秘密情報の扱いとダウンロード先ファイルへの書き込みの問題です。2件の修正番号が異なります。\n.NET Client Library for SIMATIC S7 Webserver API：V3.3.61より前。対象はCVE-2026-85114。\n.NET Client Library for SIMATIC S7 Webserver API：V3.3.62より前。対象はCVE-2026-85115。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-390352.html" ], "evidenceIds": [ "E49", "E50" ] }, { "text": "SSA-392859：複数のエンジニアリング製品で、同じ端末にアクセスできる攻撃者が不正な処理を実行する問題です。TIA Portal V20はCVE-2024-52051の影響を受けないという注記があり、同告知の全CVEが各製品に共通とは限りません。\nSIMATIC S7-PLCSIM V17／SIMATIC S7-PLCSIM V18：掲載されたこの製品系列のすべての版。対象はCVE-2024-52051。\nSIMATIC STEP 7 Safety V17／SIMATIC STEP 7 V17／SIMATIC WinCC Unified V17／SIMATIC WinCC V17：V17 Update 9より前。対象はCVE-2024-52051。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMATIC WinCC Unified PC Runtime V18／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)／TIA Portal Cloud V18／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)：掲載されたこの製品系列のすべての版。対象はCVE-2024-52051。\nSIMATIC STEP 7 Safety V18／SIMATIC STEP 7 V18／SIMATIC WinCC Unified V18／SIMATIC WinCC V18：V18 Update 6より前。対象はCVE-2024-52051。\nSIMATIC STEP 7 Safety V19／SIMATIC STEP 7 V19／SIMATIC WinCC Unified PC Runtime V19／SIMATIC WinCC Unified V19／SIMATIC WinCC V19：V19 Update 4より前。対象はCVE-2024-52051。\nSIMOTION SCOUT TIA V5.6：V5.6 SP1 HF7より前。対象はCVE-2024-52051。\nTIA Portal Cloud V19：V5.2.1.1より前。対象はCVE-2024-52051。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-392859.html" ], "evidenceIds": [ "E51", "E52", "E53", "E54", "E55", "E56" ] }, { "text": "SSA-398330：CPU 1518(F)のGNU/Linux subsystemのV3.1.0以降V3.1.5より前に含まれる複数の部品の問題です。この旧系列は保守されていません。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)：V3.1.0以降、V3.1.5より前。CVEの範囲はこの製品行に割り当てられた項目に限ります。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)：V3.1.0以降、V3.1.5より前。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" ], "evidenceIds": [ "E57", "E58" ] }, { "text": "SSA-434797：一部製品に含まれるOpenSSLの問題で、停止や不正なコード実行につながる可能性があります。OpenSSLの版と機器の版を混同せず、製品ごとの修正を適用します。\nAI Lightweight Inference Server／SCALANCE LPE9413 (6GK5998-3GS01-2AC2)／SCALANCE LPE9433 (6GK5998-3GS11-2AC2)／SIMATIC Logon V2.0／SIMATIC PCS neo V6.0：掲載されたこの製品系列のすべての版。対象はCVE-2025-15467。\nConnector for Azure：V1.8.0より前。対象はCVE-2025-15467。\nDatabus／SIMOVE Fleetmanager V3.3：V3.3.2より前。対象はCVE-2025-15467。\nHiMed Cockpit／SCALANCE LPE9403 (6GK5998-3GS00-2AC2)／RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)／RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)／SCALANCE M804PB (6GK5804-0AP00-2AA2)／SCALANCE M812-1 ADSL-Router family／SCALANCE M816-1 ADSL-Router family／SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)／SCALANCE M874-2 (6GK5874-2AA00-2AA2)／SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2)／SCALANCE M874-3 (6GK5874-3AA00-2AA2)／SCALANCE M876-3 (6GK5876-3AA02-2BA2)／SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)／SCALANCE M876-4 (6GK5876-4AA10-2BA2)／SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)／SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)／SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1)／SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1)／SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1)／SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1)／SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)／SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1)／SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1)／SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1)／SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)／SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)／SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2)／SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)／SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)／SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)／SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0)／SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0)／SCALANCE WAM766-1 (6GK5766-1GE00-7DA0)／SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0)／SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)／SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0)／SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0)／SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)／SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0)／SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0)／SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)／SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)／SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0)／SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0)／SCALANCE WUM766-1 (6GK5766-1GE00-3DA0)／SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0)／SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)／SCALANCE XC316-8 (6GK5324-8TS00-2AC2)／SCALANCE XC324-4 (6GK5328-4TS00-2AC2)／SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2)／SCALANCE XC332 (6GK5332-0GA00-2AC2)／SCALANCE XC416-8 (6GK5424-8TR00-2AC2)／SCALANCE XC424-4 (6GK5428-4TR00-2AC2)／SCALANCE XC432 (6GK5432-0GR00-2AC2)／SCALANCE XR302-32 (6GK5334-5TS00-2AR3)／SCALANCE XR302-32 (6GK5334-5TS00-3AR3)／SCALANCE XR302-32 (6GK5334-5TS00-4AR3)／SCALANCE XR322-12 (6GK5334-3TS00-2AR3)／SCALANCE XR322-12 (6GK5334-3TS00-3AR3)／SCALANCE XR322-12 (6GK5334-3TS00-4AR3)／SCALANCE XR326-8 (6GK5334-2TS00-2AR3)／SCALANCE XR326-8 (6GK5334-2TS00-3AR3)／SCALANCE XR326-8 (6GK5334-2TS00-4AR3)／SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3)／SCALANCE XR502-32 (6GK5534-5TR00-2AR3)／SCALANCE XR502-32 (6GK5534-5TR00-3AR3)／SCALANCE XR502-32 (6GK5534-5TR00-4AR3)／SCALANCE XR522-12 (6GK5534-3TR00-2AR3)／SCALANCE XR522-12 (6GK5534-3TR00-3AR3)／SCALANCE XR522-12 (6GK5534-3TR00-4AR3)／SCALANCE XR526-8 (6GK5534-2TR00-2AR3)／SCALANCE XR526-8 (6GK5534-2TR00-3AR3)／SCALANCE XR526-8 (6GK5534-2TR00-4AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-2AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-2RR3)／SCALANCE XR524-8WG (6GK5532-2SR00-3AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-3RR3)／Shopfloor IT Suite／Siemens OPC UA Modelling Editor (SiOME)／SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)／SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)／SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)／SIMATIC IPC BX-21A／SIMATIC IPC MD-57A／SIMATIC IPC ORCLA／SIMATIC MV530 H (6GF3530-0GE10)／SIMATIC MV530 S (6GF3530-0CD10)／SIMATIC MV540 H (6GF3540-0GE10)／SIMATIC MV540 H CRANES (6GF3540-0GE30)／SIMATIC MV540 S (6GF3540-0CD10)／SIMATIC MV550 H (6GF3550-0GE10)／SIMATIC MV550 S (6GF3550-0CD10)／SIMATIC MV560 U (6GF3560-0LE10)／SIMATIC MV560 X (6GF3560-0HE10)／SIMATIC RTLS Locating Manager (6GT2780-0DA00)／SIMATIC RTLS Locating Manager (6GT2780-0DA10)／SIMATIC RTLS Locating Manager (6GT2780-0DA20)／SIMATIC RTLS Locating Manager (6GT2780-0DA30)／SIMATIC RTLS Locating Manager (6GT2780-1EA10)：掲載されたこの製品系列のすべての版。対象はCVE-2025-15467。\nSIMOVE Fleetmanager V3.1：V3.1.13より前。対象はCVE-2025-15467。\nSIMOVE Fleetmanager V3.2：V3.2.4より前。対象はCVE-2025-15467。\nSIPLANT：掲載されたこの製品系列のすべての版。対象はCVE-2025-15467。\nSIDIS Prime：V4.0.700以降。対象はCVE-2025-15467。\nSIMATIC Logon V1.6：V1.6 Upd12より前。対象はCVE-2025-15467。\nSIMATIC PDM V9.3：V9.3 SP2より前。対象はCVE-2025-15467。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-434797.html" ], "evidenceIds": [ "E59", "E60", "E61", "E62", "E63", "E64" ] }, { "text": "SSA-457936：CPU 1518(F)のGNU/Linux subsystem V3.1.7以降に含まれる複数の外部部品の問題です。この告知には修正未提供の区分があります。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)：V3.1.7以降。CVEの範囲はこの製品行に割り当てられた項目に限ります。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)：V3.1.7以降。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" ], "evidenceIds": [ "E65", "E66", "E67" ] }, { "text": "SSA-493396：エンジニアリング製品で細工されたプロジェクトファイルを処理すると、不正なコードが実行される問題です。信頼できないファイルを扱う場面が関係します。\nSIMATIC S7-PLCSIM V17：掲載されたこの製品系列のすべての版。対象はCVE-2025-40759。\nSIMATIC STEP 7 V17／SIMATIC WinCC V17：V17 Update 9より前。対象はCVE-2025-40759。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)／TIA Portal Cloud V18／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)／SIMOCODE ES V20／SIMOTION SCOUT TIA V5.7／SINAMICS Startdrive V20／SIRIUS Safety ES V20 (TIA Portal)／SIRIUS Soft Starter ES V20 (TIA Portal)：掲載されたこの製品系列のすべての版。対象はCVE-2025-40759。\nSIMATIC STEP 7 V18／SIMATIC WinCC V18：V18 Update 6より前。対象はCVE-2025-40759。\nSIMATIC STEP 7 V19／SIMATIC WinCC V19：V19 Update 4より前。対象はCVE-2025-40759。\nSIMOTION SCOUT TIA V5.6：V5.6 SP1 HF7より前。対象はCVE-2025-40759。\nTIA Portal Cloud V19：V5.2.1.1より前。対象はCVE-2025-40759。\nSIMATIC STEP 7 V20／SIMATIC WinCC V20：V20 Update 4より前。対象はCVE-2025-40759。\nTIA Portal Cloud V20：V5.2.2.2より前。対象はCVE-2025-40759。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-493396.html" ], "evidenceIds": [ "E68", "E69", "E70", "E71", "E72", "E73", "E74", "E75" ] }, { "text": "SSA-508506：RUGGEDCOM CROSSBOWの管理・データベース処理に、SQL命令の不正実行、管理認証情報や権限、停止などの複数の問題があります。\nRUGGEDCOM CROSSBOW：V6.0より前。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-508506.html" ], "evidenceIds": [ "E76", "E77" ] }, { "text": "SSA-545643：KACO blueplanetの一部機種では認証情報が機器のシリアル番号から決まるため、正規の利用者になりすまされる問題があります。型番ごとにファームウェアの番号が違います。\nblueplanet 3.0 TL3-60.0 TL3：掲載されたこの製品系列のすべての版。対象はCVE-2025-40946。\nblueplanet 87.0 TL3／blueplanet 92.0 TL3／blueplanet 105 TL3／blueplanet 110 TL3／blueplanet 125 TL3／blueplanet 137 TL3／blueplanet 150 TL3／blueplanet 155 TL3／blueplanet 165 TL3：V3.92より前。対象はCVE-2026-41125・CVE-2025-40946。\nblueplanet 87.0 TL3 GEN2／blueplanet 92.0 TL3 GEN2／blueplanet 100 TL3 GEN2／blueplanet 105 TL3 GEN2／blueplanet 125 TL3 GEN2／blueplanet 150 TL3 GEN2／blueplanet 155 TL3 GEN2／blueplanet 165 TL3 GEN2：掲載されたこの製品系列のすべての版。対象はCVE-2026-41125。\nblueplanet 87.0 TL3 GEN2／blueplanet 92.0 TL3 GEN2／blueplanet 100 TL3 GEN2／blueplanet 105 TL3 GEN2／blueplanet 125 TL3 GEN2／blueplanet 150 TL3 GEN2／blueplanet 155 TL3 GEN2／blueplanet 165 TL3 GEN2：V6.1.4.9より前。対象はCVE-2025-40946。\nblueplanet 100 NX3 M8／blueplanet 125 NX3 M10：掲載されたこの製品系列のすべての版。対象はCVE-2026-41125・CVE-2025-40946。\nblueplanet gridsave 92.0 TL3-S／blueplanet gridsave 110 TL3-S／blueplanet gridsave 137 TL3-S：V3.92より前。対象はCVE-2026-41125。\nblueplanet gridsave 92.0 TL3-S／blueplanet gridsave 110 TL3-S／blueplanet gridsave 137 TL3-S：V3.91より前。対象はCVE-2025-40946。\nblueplanet 3.0 NX3-20.0 NX3／blueplanet 3.0-5.0 NX1／blueplanet 25.0 NX3-33.0 NX3／blueplanet 50.0 NX3-60.0 NX3／blueplanet 360 NX3 M6／blueplanet hybrid 6.0 NH3-12.0 NH3／blueplanet hybrid 10.0 TL3：掲載されたこの製品系列のすべての版。対象はCVE-2025-40946・CVE-2026-41125。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-545643.html" ], "evidenceIds": [ "E78", "E79", "E80", "E81" ] }, { "text": "SSA-550198：WinCCのデータベースに認証済みでアクセスできる攻撃者が、ホスト上で不正な命令を実行する問題です。誰でもログインなしで同じ操作ができるという公表ではありません。\nSIMATIC WinCC V7.5：掲載されたこの製品系列のすべての版。対象はCVE-2026-59241。\nSIMATIC WinCC V8.0：V8.0 Update 11より前。対象はCVE-2026-59241。\nSIMATIC WinCC V8.1：V8.1 Update 7より前。対象はCVE-2026-59241。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-550198.html" ], "evidenceIds": [ "E82", "E83" ] }, { "text": "SSA-563922：SIMOTIONの複数のツールで、セットアップやインストールのときに不正なDLLを読み込み、SYSTEMの権限で動かされる問題です。通常稼働中の条件とは分けます。\nSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)：V1.3.1より前。対象はCVE-2025-43715。\nSIMOTION OA MIIF (6AU1820-3DA20-0AB0)／SIMOTION OACAMGEN (6AU1820-3EA20-0AB0)／SIMOTION OALECO (6AU1820-3HA20-0AB0)／SIMOTION OAVIBX (6AU1820-3CA20-0AB0)：掲載されたこの製品系列のすべての版。対象はCVE-2025-43715。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-563922.html" ], "evidenceIds": [ "E84", "E85" ] }, { "text": "SSA-580366：Siemens Software Centerに、ログイン済みのローカル利用者が置いたDLLを読み込んで、アプリの権限で不正な処理が動く問題があります。\nSiemens Software Center：V4.0.9.8より前。対象はCVE-2026-110936。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-580366.html" ], "evidenceIds": [ "E86", "E87" ] }, { "text": "SSA-591731：S7のWebサーバーで、権限のある利用者のブラウザー上で不正なスクリプトが動き、その利用者に許された範囲でPLCを操作される問題です。掲載モデルごとに確認します。\nSIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0)／SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0)／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs／SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)／SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0)／SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0)／SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0)／SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0)／SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0)／SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0)／SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0)／SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0)／SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0)／SIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0)／SIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0)／SIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0)／SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0)／SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0)／SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0)／SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0)／SIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0)／SIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0)／SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0)／SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0)／SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0)／SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0)／SIMATIC S7-1500 CPU 1516pro F-2 PN (6ES7516-2GP03-0AB0)／SIMATIC S7-1500 CPU 1516pro-2 PN (6ES7516-2PP03-0AB0)／SIMATIC S7-1500 CPU 1516T-3 PN (6ES7516-3TP10-0AB0)／SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0)／SIMATIC S7-1500 CPU 1516TF-3 PN (6ES7516-3UP10-0AB0)／SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0)／SIMATIC S7-1500 CPU 1517-3 PN (6ES7517-3AQ10-0AB0)／SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN (6ES7517-3FQ10-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP01-0AB0)／SIMATIC S7-1500 CPU 1517T-3 PN (6ES7517-3TQ10-0AB0)／SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0)／SIMATIC S7-1500 CPU 1517TF-3 PN (6ES7517-3UQ10-0AB0)：掲載されたこの製品系列のすべての版。対象はCVE-2026-63350・CVE-2026-63351・CVE-2026-63352・CVE-2026-63353・CVE-2026-63354・CVE-2026-63355・CVE-2026-63356・CVE-2026-63357。\nSIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0)：掲載されたこの製品系列のすべての版。対象はCVE-2026-63350・CVE-2026-63351。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-591731.html" ], "evidenceIds": [ "E88", "E89" ] }, { "text": "SSA-628843：TPM 2.0部品の処理範囲の誤りにより、情報の露出や停止につながる問題です。IPCは機種別のBIOS、CN 4100はハードウェアの版も関係します。\nSIMATIC CN 4100：ハードウェアがFS 05より前の製品。対象はCVE-2025-2884。\nSIMATIC Field PG M5／SIMATIC IPC227E／SIMATIC IPC277E／SIMATIC ITP1000：掲載されたこの製品系列のすべての版。対象はCVE-2025-2884。\nSIMATIC Field PG M6：V26.01.14より前。対象はCVE-2025-2884。\nSIMATIC IPC427E／SIMATIC IPC477E／SIMATIC IPC477E PRO／SIPLUS IPC427E：V21.01.20より前。対象はCVE-2025-2884。\nSIMATIC IPC627E／SIMATIC IPC647E／SIMATIC IPC677E／SIMATIC IPC847E：V25.02.16より前。対象はCVE-2025-2884。\nSIMATIC IPC BX-32A／SIMATIC IPC BX-39A／SIMATIC IPC PX-39A／SIMATIC IPC PX-39A PRO／SIMATIC IPC PX-32A：V29.01.09より前。対象はCVE-2025-2884。\nSIMATIC IPC BX-56A／SIMATIC IPC BX-59A：V32.01.09より前。対象はCVE-2025-2884。\nSIMATIC IPC RW-528A／SIMATIC IPC RW-548A：V34.01.02より前。対象はCVE-2025-2884。\nSIMATIC IPC MD-57A：V30.01.10より前。対象はCVE-2025-2884。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-628843.html" ], "evidenceIds": [ "E90", "E91", "E92", "E93", "E94", "E95", "E96" ] }, { "text": "SSA-693808：複数のエンジニアリング製品で、ログイン済みのローカル利用者がWindows Named Pipe経由で不正な処理を実行する問題です。端末上の利用権限が条件です。\nSIMATIC PCS neo V4.1／SIMATIC PCS neo V5.0／SIMATIC S7-PLCSIM V17：掲載されたこの製品系列のすべての版。対象はCVE-2024-54678。\nSIMATIC PCS neo V6.0：V6.0 SP1 Update 1より前。対象はCVE-2024-54678。\nSIMATIC STEP 7 V17／SIMATIC WinCC V17：V17 Update 9より前。対象はCVE-2024-54678。\nSIMOCODE ES V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)／SIMOCODE ES V20／SIMOTION SCOUT TIA V5.7／SINAMICS Startdrive V20／SIRIUS Safety ES V20 (TIA Portal)／SIRIUS Soft Starter ES V20 (TIA Portal)：掲載されたこの製品系列のすべての版。対象はCVE-2024-54678。\nSIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)：掲載されたこの製品系列のすべての版。対象はCVE-2024-54678。\nSIMATIC STEP 7 V18／SIMATIC WinCC V18：V18 Update 6より前。対象はCVE-2024-54678。\nTIA Portal Cloud V18：V6.3.0.2より前。対象はCVE-2024-54678。\nSIMATIC STEP 7 V19／SIMATIC WinCC V19：V19 Update 4より前。対象はCVE-2024-54678。\nSIMOTION SCOUT TIA V5.6：V5.6 SP1 HF7より前。対象はCVE-2024-54678。\nTIA Portal Cloud V19：V5.2.1.1より前。対象はCVE-2024-54678。\nSIMATIC STEP 7 V20／SIMATIC WinCC V20／TIA Portal Test Suite V20：V20 Update 4より前。対象はCVE-2024-54678。\nTIA Portal Cloud V20：V5.2.2.2より前。対象はCVE-2024-54678。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-693808.html" ], "evidenceIds": [ "E97", "E98", "E99", "E100", "E101", "E102", "E103", "E104", "E105" ] }, { "text": "SSA-765416：RUGGEDCOM CROSSBOW SACに含まれるSQLiteの問題で、不正なコード実行、停止、情報の露出などの可能性があります。製品の更新を適用します。\nRUGGEDCOM CROSSBOW Station Access Controller (SAC)：V6.0より前。対象はCVE-2025-6965・CVE-2026-11822・CVE-2026-11824・CVE-2025-70873・CVE-2025-71316。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" ], "evidenceIds": [ "E106", "E107" ] }, { "text": "SSA-784472：SIMATIC S7-1500 TM MFP V1.1.1のGNU/Linux subsystemに含まれる部品の問題です。告知の対象はこのサブシステムです。\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem：掲載されたこの製品系列のすべての版。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" ], "evidenceIds": [ "E108", "E109" ] }, { "text": "SSA-794185：RADIUS認証のBlastRADIUS問題です。接続装置とRADIUSサーバーの間の通信に割り込める攻撃者が、認証拒否を許可に変えてアクセスできる可能性があります。更新と認証通信の設定を併せて確認します。\nCPC80 Central Processing/Communication：V16.51より前。対象はCVE-2024-3596。\nCPCI85 Central Processing/Communication：V6.20より前。対象はCVE-2024-3596。\nPOWER METER SICAM Q100 family：V2.70より前。対象はCVE-2024-3596。\nPOWER METER SICAM Q200 family：V2.83より前。対象はCVE-2024-3596。\nPowerlink IP：V4.23より前。対象はCVE-2024-3596。\nSICAM GridPass：V2.50より前。対象はCVE-2024-3596。\nSICORE Base system：V2.20.0より前。対象はCVE-2024-3596。\nSIPROTEC 5 7SA82 (CP100)／SIPROTEC 5 7SD82 (CP100)／SIPROTEC 5 7SJ81 (CP100)／SIPROTEC 5 7SJ82 (CP100)／SIPROTEC 5 7SK82 (CP100)／SIPROTEC 5 7SL82 (CP100)／SIPROTEC 5 7UT82 (CP100)：V7.80以降、V8.90より前。対象はCVE-2024-3596。\nSIPROTEC 5 7SA82 (CP150)／SIPROTEC 5 7SD82 (CP150)／SIPROTEC 5 7SJ81 (CP150)／SIPROTEC 5 7SJ82 (CP150)／SIPROTEC 5 7SK82 (CP150)／SIPROTEC 5 7SL82 (CP150)／SIPROTEC 5 7SX82 (CP150)／SIPROTEC 5 7SY82 (CP150)／SIPROTEC 5 7UT82 (CP150)／SIPROTEC 5 6MD84 (CP300)／SIPROTEC 5 6MU85 (CP300)／SIPROTEC 5 7ST86 (CP300)／SIPROTEC 5 7SX85 (CP300)／SIPROTEC 5 7VU85 (CP300)／SIPROTEC 5 Compact 7SX800 (CP050)：V10.0より前。対象はCVE-2024-3596。\nSIPROTEC 5 6MD85 (CP300)／SIPROTEC 5 6MD86 (CP300)／SIPROTEC 5 6MD89 (CP300)／SIPROTEC 5 7KE85 (CP300)／SIPROTEC 5 7SA86 (CP300)／SIPROTEC 5 7SA87 (CP300)／SIPROTEC 5 7SD86 (CP300)／SIPROTEC 5 7SD87 (CP300)／SIPROTEC 5 7SJ85 (CP300)／SIPROTEC 5 7SJ86 (CP300)／SIPROTEC 5 7SK85 (CP300)／SIPROTEC 5 7SL86 (CP300)／SIPROTEC 5 7SL87 (CP300)／SIPROTEC 5 7SS85 (CP300)／SIPROTEC 5 7ST85 (CP300)／SIPROTEC 5 7UM85 (CP300)／SIPROTEC 5 7UT85 (CP300)／SIPROTEC 5 7UT86 (CP300)／SIPROTEC 5 7UT87 (CP300)／SIPROTEC 5 7VE85 (CP300)／SIPROTEC 5 7VK87 (CP300)：V7.80以降、V10.0より前。対象はCVE-2024-3596。\nSIPROTEC 5 6MD89 (CP300) V9.6x／SIPROTEC 5 7ST85 (CP300) V9.6x：V9.68より前。対象はCVE-2024-3596。\nSIPROTEC 5 7ST86 (CP300) V9.8x：V9.83より前。対象はCVE-2024-3596。\nSICAM AK 3／SICAM BC／SICAM GridEdge (Classic)／SICAM GridEdge Applications for SICAM 8 Platform／SICAM TM／SIPROTEC 5 - CP200 Devices：掲載されたこの製品系列のすべての版。対象はCVE-2024-3596。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-794185.html" ], "evidenceIds": [ "E110", "E111", "E112", "E113", "E114", "E115", "E116" ] }, { "text": "SSA-794697：TM MFPのGNU/Linux subsystem V1.0に含まれる複数の部品の問題です。旧V1.0系列は保守されておらず、V1.1への更新が示されていますが、V1.1以降にも別告知があります。\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem：V1.1より前。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-794697.html" ], "evidenceIds": [ "E117", "E118", "E119" ] }, { "text": "SSA-800126：エンジニアリング製品のファイル読み込みで不正な処理が動く問題です。TIA Portal V20はCVE-2024-49849の影響を受けないという注記があり、製品とCVEの対応を分けます。\nSIMATIC S7-PLCSIM V16／SIMATIC S7-PLCSIM V17／SIMATIC STEP 7 Safety V16／SIMATIC STEP 7 V16／SIMATIC WinCC Unified V16／SIMATIC WinCC V16／SIMOCODE ES V16／SINAMICS Startdrive V16／TIA Portal Cloud V16：掲載されたこの製品系列のすべての版。対象はCVE-2024-49849。\nSIMATIC STEP 7 Safety V17／SIMATIC STEP 7 V17／SIMATIC WinCC Unified V17／SIMATIC WinCC V17：V17 Update 9より前。対象はCVE-2024-49849。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Soft Starter ES V18 (TIA Portal)／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)：掲載されたこの製品系列のすべての版。対象はCVE-2024-49849。\nSIMATIC STEP 7 Safety V18／SIMATIC STEP 7 V18／SIMATIC WinCC Unified V18／SIMATIC WinCC V18／SIRIUS Safety ES V18 (TIA Portal)：V18 Update 6より前。対象はCVE-2024-49849。\nTIA Portal Cloud V18：V6.3.0.2より前。対象はCVE-2024-49849。\nSIMATIC STEP 7 Safety V19／SIMATIC STEP 7 V19／SIMATIC WinCC Unified V19／SIMATIC WinCC V19：V19 Update 4より前。対象はCVE-2024-49849。\nSIMOTION SCOUT TIA V5.6：V5.6 SP1 HF7より前。対象はCVE-2024-49849。\nTIA Portal Cloud V19：V5.2.1.1より前。対象はCVE-2024-49849。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-800126.html" ], "evidenceIds": [ "E120", "E121", "E122", "E123", "E124", "E125", "E126" ] }, { "text": "SSA-832641：Industrial Edge Devicesで、ログイン済みの利用者が本来読めない機密情報を読める問題です。ソフトウェア型と各IPC・HMI・SCALANCE機器で更新先が違います。\nIndustrial Edge Cloud Device (IECD)／Industrial Edge Own Device (IEOD)／Industrial Edge Virtual Device (IEVD)：V1.28.1より前。対象はCVE-2026-44414。\nSCALANCE LPE9413 (6GK5998-3GS01-2AC2)／SCALANCE LPE9433 (6GK5998-3GS11-2AC2)：掲載されたこの製品系列のすべての版。対象はCVE-2026-44414。\nSIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0)／SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0)／SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0)／SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0)／SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0)／SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0)／SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0)／SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0)／SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0)／SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0)／SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0)／SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0)／SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0)／SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0)／SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0)／SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0)／SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0)／SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0)／SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0)／SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0)／SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0)／SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0)／SIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0)／SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0)／SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1)／SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1)／SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1)／SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1)／SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1)／SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1)／SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1)／SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1)／SIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1)／SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1)／SIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1)／SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1)／SIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1)／SIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1)／SIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1)：掲載されたこの製品系列のすべての版。対象はCVE-2026-44415。\nSIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2)／SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2)／SIMATIC IPC BX-21A Industrial Edge Device：V1.28.1-2より前。対象はCVE-2026-44414。\nSIMATIC IPC127E Industrial Edge Device／SIMATIC IPC227E Industrial Edge Device／SIMATIC IPC227G Industrial Edge Device／SIMATIC IPC427E Industrial Edge Device／SIMATIC IPC847E Industrial Edge Device／SIMATIC IPC BX-39A Industrial Edge Device／SIMATIC IPC BX-59A Industrial Edge Device：V3.2.0-17より前。対象はCVE-2026-44414。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-832641.html" ], "evidenceIds": [ "E127", "E128", "E129", "E130", "E131", "E132" ] }, { "text": "SSA-858251：複数の製品に含まれるOPC UAの認証を回避される問題です。Energy Manager、BRAUMAT、SISTARなどで提供される修正や対応方法を別々に確認します。\nIndustrial Edge for Machine Tools (formerly known as \"SINUMERIK Edge\")／SIMATIC IPC DiagMonitor：掲載されたこの製品系列のすべての版。対象はCVE-2024-42513。\nSIMATIC Energy Manager PRO V7.2／SIMATIC Energy Manager PRO V7.3：掲載されたこの製品系列のすべての版。対象はCVE-2024-42512・CVE-2024-42513。\nSIMATIC Energy Manager PRO V7.4：V7.4 Update 0以降、V7.4 Update 7より前。対象はCVE-2024-42512・CVE-2024-42513。\nSIMATIC Energy Manager PRO V7.5：V7.5 Update 0以降、V7.5 Update 2より前。対象はCVE-2024-42512・CVE-2024-42513。\nSIMATIC WinCC V8.0：V8.0 Update 3より前。対象はCVE-2024-42513。\nSIMIT V11：V11.3より前。対象はCVE-2024-42512。\nSIMATIC WinCC Unified V18：V18 Update 6より前。対象はCVE-2024-42513。\nSIMATIC WinCC Unified V19：V19 Update 4より前。対象はCVE-2024-42513。\nSIMATIC BRAUMAT／SIMATIC SISTAR：掲載されたこの製品系列のすべての版。対象はCVE-2024-42513。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-858251.html" ], "evidenceIds": [ "E133", "E134", "E135" ] }, { "text": "SSA-864900：RUGGEDCOM APE1808のFortinet NGFWで、FortiOSに含まれる複数の問題です。V7.4.9系とV7.6.6系の表が対象にするCVEは異なり、1つの修正番号へまとめません。\nRUGGEDCOM APE1808：Fortinet NGFWがV7.4.9より前の構成。CVEの範囲はこの製品行に割り当てられた項目に限ります。\nRUGGEDCOM APE1808：Fortinet NGFWがV7.6.6より前の構成。CVEの範囲はこの製品行に割り当てられた項目に限ります。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-864900.html" ], "evidenceIds": [ "E136", "E137", "E138", "E139" ] }, { "text": "SSA-911336：Nozomi Guardian/CMCを載せたRUGGEDCOM APE1808に、細工したダッシュボード、接続先確認、制限された認証情報・設定操作などの問題があります。\nRUGGEDCOM APE1808：公式に示された構成条件：with Nozomi Guardian/CMC。対象はCVE-2026-33387・CVE-2026-33391・CVE-2026-33920・CVE-2026-33388・CVE-2026-33389。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-911336.html" ], "evidenceIds": [ "E140", "E141" ] }, { "text": "SSA-967325：Palo Alto Networks Virtual NGFW搭載APE1808の複数の問題です。User-ID認証ポータル、GlobalProtectの認証Cookie、IKEv2、DNS Proxy、CAS、URL filteringなど、問題ごとに必要な機能設定が異なります。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWでUser-ID認証ポータルを設定し、管理プロファイルのResponse Pagesを有効にした構成。対象はCVE-2026-0300。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWを搭載した構成。対象はCVE-2026-0256・CVE-2026-0261・CVE-2026-0262。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWのGlobalProtect portal/gatewayで認証上書きCookieを有効にし、特定の証明書設定を使う構成。対象はCVE-2026-0257。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWでIKEv2の拠点間VPNを設定した構成。対象はCVE-2026-0258。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWでDNS Proxyを有効にし、network proxyを接続した構成。対象はCVE-2026-0264。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWでCASを有効にした認証プロファイルをログイン画面に適用した構成。対象はCVE-2026-0265。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWを搭載した構成。対象はCVE-2026-0269。\nRUGGEDCOM APE1808：Palo Alto Networks Virtual NGFWでURL filteringを有効にし、応答ページを変更した構成。対象はCVE-2026-0301。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-967325.html" ], "evidenceIds": [ "E142", "E143" ] }, { "text": "SSA-968435：Industrial Edge App Publisherが接続先証明書と応答内容を十分に検証せず、ネットワーク上の攻撃者が管理サーバーを装って不正な処理を動かす問題です。\nIndustrial Edge App Publisher：V1.27.9より前。対象はCVE-2026-78556・CVE-2026-78557。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-968435.html" ], "evidenceIds": [ "E144", "E145" ] }, { "text": "SSB-091449：PLCのアクセス制限に関する文書上の注意です。PG/HMI接続はPLCのprotection levelで制御し、変数ごとのAccessible/Writable設定はOPC UA/Web API向けです。別の接続経路まで同じ設定で制限できると判断しないでください。", "kind": "fact", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssb-091449.html" ], "evidenceIds": [ "E146" ] }, { "text": "利用中の製品名・型番・完全な版番号を確認し、自分の製品の項目だけを照合してください。複数製品をまとめた告知では、別製品の修正版や対策を流用しません。分からない項目は管理担当者にこのページを渡して確認します。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU90141693/" ], "evidenceIds": [ "E147", "E148", "E149", "E150", "E151" ] }, { "text": "最初に「Siemens製品に対するアップデート（2026年10月）」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://jvn.jp/vu/JVNVU90141693/" ] } ], "versionChecks": [ { "text": "「Siemens製品に対するアップデート（2026年10月）」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU90141693/" ] } ], "actions": [ { "text": "SSA-019113の対応：\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)（V3.1.6以降）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)（V3.1.6以降、V3.1.7より前）：V3.1.7以降へ更新します。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)（V3.1.6以降）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" ], "evidenceIds": [ "E1", "E2", "E3", "E4" ] }, { "text": "SSA-055299の対応：\nCapital Embedded AR Classic 431-422（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nCapital Embedded AR Classic R20-11（V2303より前）：V2303以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-055299.html" ], "evidenceIds": [ "E5", "E152" ] }, { "text": "SSA-082556の対応：\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)（V3.1.5以降）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)（V3.1.5以降、V3.1.6より前）：V3.1.6以降へ更新します。\nSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)（V3.1.5以降）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" ], "evidenceIds": [ "E7", "E8", "E9", "E10" ] }, { "text": "SSA-099819の対応：\nSENTRON 3NA COM Fuse（V5.2より前）：V5.2以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-099819.html" ], "evidenceIds": [ "E11", "E12" ] }, { "text": "SSA-104023の対応：\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWを搭載した構成）：Siemensの顧客サポートへ、該当製品のパッチと更新・対応方法を依頼します。", "kind": "procedure", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-104023.html" ], "evidenceIds": [ "E13", "E153" ] }, { "text": "SSA-127084の対応：\nRUGGEDCOM APE1808（Fortinet NGFWを搭載した構成）：Fortigate NGFWをV7.6.7以降へ、Siemensの安全な更新手順に沿って更新します。手順の詳細は顧客サポートへ依頼します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-127084.html" ], "evidenceIds": [ "E14", "E154", "E155" ] }, { "text": "SSA-148322の対応：\nPSS(R)SINCAL V21.5／PSS(R)SINCAL V22.0（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nPSS(R)SINCAL V22.5（V22.5 Update 5より前）：V22.5 Update 5以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-148322.html" ], "evidenceIds": [ "E16", "E17" ] }, { "text": "SSA-159454の対応：\nSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G（V28.01.15より前）：V28.01.15以降へ更新します。\nSIMATIC IPC BX-21A（V31.01.13より前）：V31.01.13以降へ更新します。\nSIMATIC IPC RW-543A（V1.1.4より前）：V1.1.4以降へ更新します。\n修正版BIOSへ更新した後は、BIOSの既定設定を読み込みます。Secure Boot鍵を登録済みだった場合は、鍵を登録し直します。担当者が起動設定と鍵の復元手順を確認して実施してください。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-159454.html" ], "evidenceIds": [ "E18", "E156" ] }, { "text": "SSA-265688の対応：\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem（V1.1.1より前）：V1.1.1以降へ更新します。\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" ], "evidenceIds": [ "E20", "E22", "E23" ] }, { "text": "SSA-267056の対応：\nLOGO! 12/24RCE (6ED1052-1MD08-0BA2)／LOGO! 12/24RCEo (6ED1052-2MD08-0BA2)／LOGO! 24CE (6ED1052-1CC08-0BA2)／LOGO! 24CEo (6ED1052-2CC08-0BA2)／LOGO! 24RCE (6ED1052-1HB08-0BA2)／LOGO! 24RCEo (6ED1052-2HB08-0BA2)／LOGO! 230RCE (6ED1052-1FB08-0BA2)／LOGO! 230RCEo (6ED1052-2FB08-0BA2)／SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2)／SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2)／SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2)／SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2)／SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2)／SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2)／SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2)／SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2)（V1.84.05より前）：V1.84.05以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-267056.html" ], "evidenceIds": [ "E24", "E157", "E158" ] }, { "text": "SSA-282044の対応：\nAutomation License Manager V6.0／CEMAT V10.0／Energy Support Library (EnSL)／OpenPCS 7 V9.1／OpenPCS 7 V10.0／SIMATIC BATCH V9.1／SIMATIC BATCH V10.0／SIMATIC Logon V1.6／SIMATIC ODK 1500S／SIMATIC PCS 7 Advanced Process Functions V2.1／SIMATIC PCS 7 Advanced Process Functions V2.2／SIMATIC PCS 7 Advanced Process Graphics V9.1／SIMATIC PCS 7 Advanced Process Graphics V10.0／SIMATIC PCS 7 Advanced Process Library incl. Faceplates V10.0／SIMATIC PCS 7 Industry Library V9.0／SIMATIC PCS 7 Industry Library V9.1／SIMATIC PCS 7 Industry Library V10.0／SIMATIC PCS 7 Logic Matrix V10.0／SIMATIC PCS 7 PowerControl V9.1／SIMATIC PCS 7 Standard Chemical Library V9.1／SIMATIC PCS 7 Standard Chemical Library V10.0／SIMATIC PCS 7 TeleControl V9.1／SIMATIC PCS 7/OPEN OS V9.1／SIMATIC PCS neo V5.0／SIMATIC PDM V9.2／SIMATIC PDM Maintenance Station V5.0／SIMATIC Process Function Library (PFL) V4.0／SIMATIC Process Historian 2020／SIMATIC Process Historian 2022／SIMATIC ProSave V18／SIMATIC S7 F Systems V6.3／SIMATIC S7 F Systems V6.4／SIMATIC S7-1500 Software Controller V2／SIMATIC S7-PLCSIM V17／SIMATIC S7-PLCSIM V18／SIMATIC S7-PLCSIM V19／SIMATIC Safety Matrix V6.3／SIMATIC STEP 7 CFC V19／SIMATIC STEP 7 CFC V20／SIMATIC WinCC flexible ES／TIA Project-Server V17／SIMATIC Control Function Library (CFL) V1.x／TIA Portal Test Suite V17（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nAutomation License Manager V6.2（V6.2 Upd3より前）：V6.2 Upd3以降へ更新します。\nCP PtP Param configuring interface／FM Configuration Package／Modular PID CTRL Tool／SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)／SIMATIC eaSie Document Skills／SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)／SIMATIC eaSie Workflow Skills／SIMATIC NET PC Software V16／SIMATIC NET PC Software V17／SIMATIC NET PC Software V18／SIMATIC NET PC Software V19／SIMATIC PCS 7 MPC Configurator／SIMATIC ProSave V20／SIMATIC Route Control V9.1／SIMATIC Route Control V10.0／SIMATIC STEP 7 V5.7／SIMATIC WinCC Runtime Professional V20／SIMATIC WinCC TeleControl／SIMIT Rapid Tester／SIMIT Simulation Platform／SINEMA Remote Connect Client／SITRANS／Standard PID CTRL Tool／SIMATIC Energy Suite V17／SINAMICS Startdrive V17（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nCreate MyConfig (CMC)（V6.9より前）：V6.9以降へ更新します。\nMultiFieldbus Configuration Tool (MFCT)（V1.5.5.0より前）：V1.5.5.0以降へ更新します。\nSiemens Network Planner (SINETPLAN)（V2.0 SP2より前）：V2.0 SP2以降へ更新します。\nSIMATIC Automation Tool／SIMATIC Automation Tool SDK Windows（V5.0 SP4より前）：V5.0 SP4以降へ更新します。\nSIMATIC Logon V2.0（V2.0 Upd3より前）：V2.0 Upd3以降へ更新します。\nSIMATIC Management Agent／SIMATIC Management Console（V9.1 SP1 Upd8より前）：V9.1 SP1 Upd8以降へ更新します。\nSIMATIC NET PC Software V20（V20.0 Update 1より前）：V20.0 Update 1以降へ更新します。\nSIMATIC PCS 7 V9.1（V9.1 SP1 UC08より前）：V9.1 SP1 UC08以降へ更新します。\nSIMATIC PCS 7 V10.0（V10.0 SP1 UC01より前）：V10.0 SP1 UC01以降へ更新します。\nSIMATIC PCS 7 Advanced Process Faceplates V9.1（V9.1 SP2 Upd4より前）：V9.1 SP2 Upd4以降へ更新します。\nSIMATIC PCS 7 Advanced Process Library V9.1（V9.1 SP2 Upd6より前）：V9.1 SP2 Upd6以降へ更新します。\nSIMATIC PCS 7 Basis Faceplates V9.1（V9.1 SP2 Upd2より前）：V9.1 SP2 Upd2以降へ更新します。\nSIMATIC PCS 7 Basis Library V9.1（V9.1 SP2 Upd8より前）：V9.1 SP2 Upd8以降へ更新します。\nSIMATIC PCS 7 Basis Library V10.0（V10.0 SP1 Upd2より前）：V10.0 SP1 Upd2以降へ更新します。\nSIMATIC PCS 7 Logic Matrix V9.1（V9.1 Upd8より前）：V9.1 Upd8以降へ更新します。\nSIMATIC PCS neo V6.0（V6.0 SP1より前）：V6.0 SP1以降へ更新します。\nSIMATIC PDM V9.3（V9.3 SP1 Upd2より前）：V9.3 SP1 Upd2以降へ更新します。\nSIMATIC Process Historian 2024（V2024 SP1 Upd2より前）：V2024 SP1 Upd2以降へ更新します。\nSIMATIC ProSave V17／SIMATIC WinCC Runtime Advanced／Totally Integrated Automation Portal (TIA Portal) V17／SIMATIC WinCC Visualization Architect (SiVArc) V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMATIC ProSave V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMATIC S7-1500 Software Controller V3（V31.1.5より前）：V31.1.5以降へ更新します。\nSIMATIC S7-Fail-safe Configuration Tool (S7-FCT)（V4.0.1より前）：V4.0.1以降へ更新します。\nSIMATIC S7-PCT（V3.5 SP4 Update 1より前）：V3.5 SP4 Update 1以降へ更新します。\nSIMATIC S7-PLCSIM V20（V20 Update 1より前）：V20 Update 1以降へ更新します。\nSIMATIC S7-PLCSIM Advanced（V7.0 Update 1より前）：V7.0 Update 1以降へ更新します。\nSIMATIC Target（V6.0 SP3より前）：V6.0 SP3以降へ更新します。\nSIMATIC WinCC V7.5（V7.5 SP2 Update 20より前）：V7.5 SP2 Update 20以降へ更新します。\nSIMATIC WinCC V8.0（V8.0 Update 8より前）：V8.0 Update 8以降へ更新します。\nSIMATIC WinCC V8.1（V8.1 Update 3より前）：V8.1 Update 3以降へ更新します。\nSIMATIC WinCC Runtime Professional（V21より前）：V21以降へ更新します。\nSIMATIC WinCC Unified Line Coordination／SIMATIC WinCC Unified Sequence（V20より前）：V20以降へ更新します。\nSIMATIC D7-SYS（V10.0 SP1より前）：V10.0 SP1以降へ更新します。\nSINEC NMS（V4.0より前）：V4.0以降へ更新します。\nTeleControl Server Basic V3.1（V3.1.2.2より前）：V3.1.2.2以降へ更新します。\nTIA Administrator（V3.0.6より前）：V3.0.6以降へ更新します。\nTIA Portal Cloud Connector（V2.3より前）：V2.3以降へ更新します。\nTIA Project-Server（V2.2より前）：V2.2以降へ更新します。\nSIMATIC MTP CREATOR V2.x（V2.1より前）：V2.1以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-282044.html" ], "evidenceIds": [ "E26", "E159", "E30", "E31", "E32", "E33", "E34", "E35", "E36", "E37", "E38" ] }, { "text": "SSA-333035の対応：\nAPOGEE MBC (PPC) (BACnet)（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nAPOGEE MBC (PPC) (P2 Ethernet)／APOGEE MEC (PPC) (BACnet)／APOGEE MEC (PPC) (P2 Ethernet)（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nAPOGEE PXC Compact (BACnet)／APOGEE PXC Modular (BACnet)／TALON TC Compact (BACnet)／TALON TC Modular (BACnet)（V3.5.7より前）：V3.5.7以降へ更新します。\nAPOGEE PXC Compact (P2 Ethernet)／APOGEE PXC Modular (P2 Ethernet)（V2.8.21より前）：V2.8.21以降へ更新します。\nDesigo PXC00-E.D／Desigo PXC00-U／Desigo PXC001-E.D／Desigo PXC12-E.D／Desigo PXC22-E.D／Desigo PXC22.1-E.D／Desigo PXC36.1-E.D／Desigo PXC50-E.D／Desigo PXC64-U／Desigo PXC100-E.D／Desigo PXC128-U／Desigo PXC200-E.D／Desigo PXM20-E（V2.3以降）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-333035.html" ], "evidenceIds": [ "E39", "E41", "E160", "E43", "E44" ] }, { "text": "SSA-377139の対応：\nIndustrial Edge Device Kit - arm64 V1.5／Industrial Edge Device Kit - arm64 V1.6／Industrial Edge Device Kit - arm64 V1.7／Industrial Edge Device Kit - arm64 V1.8／Industrial Edge Device Kit - arm64 V1.9／Industrial Edge Device Kit - arm64 V1.10／Industrial Edge Device Kit - arm64 V1.11／Industrial Edge Device Kit - arm64 V1.12／Industrial Edge Device Kit - arm64 V1.13／Industrial Edge Device Kit - arm64 V1.14／Industrial Edge Device Kit - arm64 V1.15／Industrial Edge Device Kit - arm64 V1.16／Industrial Edge Device Kit - arm64 V1.17／Industrial Edge Device Kit - arm64 V1.18／Industrial Edge Device Kit - arm64 V1.19／Industrial Edge Device Kit - arm64 V1.20／Industrial Edge Device Kit - arm64 V1.21／Industrial Edge Device Kit - arm64 V1.22／Industrial Edge Device Kit - arm64 V1.23／Industrial Edge Device Kit - arm64 V1.24／Industrial Edge Device Kit - arm64 V1.25／Industrial Edge Device Kit - x86-64 V1.5／Industrial Edge Device Kit - x86-64 V1.6／Industrial Edge Device Kit - x86-64 V1.7／Industrial Edge Device Kit - x86-64 V1.8／Industrial Edge Device Kit - x86-64 V1.9／Industrial Edge Device Kit - x86-64 V1.10／Industrial Edge Device Kit - x86-64 V1.11／Industrial Edge Device Kit - x86-64 V1.12／Industrial Edge Device Kit - x86-64 V1.13／Industrial Edge Device Kit - x86-64 V1.14／Industrial Edge Device Kit - x86-64 V1.15／Industrial Edge Device Kit - x86-64 V1.16／Industrial Edge Device Kit - x86-64 V1.17／Industrial Edge Device Kit - x86-64 V1.18／Industrial Edge Device Kit - x86-64 V1.19／Industrial Edge Device Kit - x86-64 V1.20／Industrial Edge Device Kit - x86-64 V1.21／Industrial Edge Device Kit - x86-64 V1.22／Industrial Edge Device Kit - x86-64 V1.23／Industrial Edge Device Kit - x86-64 V1.24／Industrial Edge Device Kit - x86-64 V1.25（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nIndustrial Edge Device Kit - arm64 V1.26／Industrial Edge Device Kit - x86-64 V1.26（V1.26.2-1より前）：V1.26.2-1以降へ更新します。\nIndustrial Edge Device Kit - arm64 V1.27／Industrial Edge Device Kit - x86-64 V1.27（V1.27.1-1より前）：V1.27.1-1以降へ更新します。\nIndustrial Edge Device Kit - arm64 V1.28／Industrial Edge Device Kit - x86-64 V1.28（V1.28.0-6より前）：V1.28.0-6以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-377139.html" ], "evidenceIds": [ "E45", "E161", "E47", "E48" ] }, { "text": "SSA-390352の対応：\n.NET Client Library for SIMATIC S7 Webserver API（V3.3.61より前）：V3.3.61以降へ更新します。\n.NET Client Library for SIMATIC S7 Webserver API（V3.3.62より前）：V3.3.62以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-390352.html" ], "evidenceIds": [ "E49", "E50" ] }, { "text": "SSA-392859の対応：\nSIMATIC S7-PLCSIM V17／SIMATIC S7-PLCSIM V18（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC STEP 7 Safety V17／SIMATIC STEP 7 V17／SIMATIC WinCC Unified V17／SIMATIC WinCC V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMATIC WinCC Unified PC Runtime V18／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)／TIA Portal Cloud V18／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC STEP 7 Safety V18／SIMATIC STEP 7 V18／SIMATIC WinCC Unified V18／SIMATIC WinCC V18（V18 Update 6より前）：V18 Update 6以降へ更新します。\nSIMATIC STEP 7 Safety V19／SIMATIC STEP 7 V19／SIMATIC WinCC Unified PC Runtime V19／SIMATIC WinCC Unified V19／SIMATIC WinCC V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMOTION SCOUT TIA V5.6（V5.6 SP1 HF7より前）：V5.6 SP1 HF7以降へ更新します。\nTIA Portal Cloud V19（V5.2.1.1より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-392859.html" ], "evidenceIds": [ "E51", "E53", "E54", "E55", "E162" ] }, { "text": "SSA-398330の対応：\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)（V3.1.0以降、V3.1.5より前）：V3.1.5以降へ更新します。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)（V3.1.0以降、V3.1.5より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" ], "evidenceIds": [ "E57", "E58", "E163" ] }, { "text": "SSA-434797の対応：\nAI Lightweight Inference Server／SCALANCE LPE9413 (6GK5998-3GS01-2AC2)／SCALANCE LPE9433 (6GK5998-3GS11-2AC2)／SIMATIC Logon V2.0／SIMATIC PCS neo V6.0（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nConnector for Azure（V1.8.0より前）：V1.8.0以降へ更新します。\nDatabus／SIMOVE Fleetmanager V3.3（V3.3.2より前）：V3.3.2以降へ更新します。\nHiMed Cockpit／SCALANCE LPE9403 (6GK5998-3GS00-2AC2)／RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)／RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)／SCALANCE M804PB (6GK5804-0AP00-2AA2)／SCALANCE M812-1 ADSL-Router family／SCALANCE M816-1 ADSL-Router family／SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)／SCALANCE M874-2 (6GK5874-2AA00-2AA2)／SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2)／SCALANCE M874-3 (6GK5874-3AA00-2AA2)／SCALANCE M876-3 (6GK5876-3AA02-2BA2)／SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)／SCALANCE M876-4 (6GK5876-4AA10-2BA2)／SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)／SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)／SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1)／SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1)／SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1)／SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1)／SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)／SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1)／SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1)／SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1)／SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)／SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)／SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2)／SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)／SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)／SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)／SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0)／SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0)／SCALANCE WAM766-1 (6GK5766-1GE00-7DA0)／SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0)／SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)／SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0)／SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0)／SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)／SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0)／SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0)／SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)／SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)／SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0)／SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0)／SCALANCE WUM766-1 (6GK5766-1GE00-3DA0)／SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0)／SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)／SCALANCE XC316-8 (6GK5324-8TS00-2AC2)／SCALANCE XC324-4 (6GK5328-4TS00-2AC2)／SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2)／SCALANCE XC332 (6GK5332-0GA00-2AC2)／SCALANCE XC416-8 (6GK5424-8TR00-2AC2)／SCALANCE XC424-4 (6GK5428-4TR00-2AC2)／SCALANCE XC432 (6GK5432-0GR00-2AC2)／SCALANCE XR302-32 (6GK5334-5TS00-2AR3)／SCALANCE XR302-32 (6GK5334-5TS00-3AR3)／SCALANCE XR302-32 (6GK5334-5TS00-4AR3)／SCALANCE XR322-12 (6GK5334-3TS00-2AR3)／SCALANCE XR322-12 (6GK5334-3TS00-3AR3)／SCALANCE XR322-12 (6GK5334-3TS00-4AR3)／SCALANCE XR326-8 (6GK5334-2TS00-2AR3)／SCALANCE XR326-8 (6GK5334-2TS00-3AR3)／SCALANCE XR326-8 (6GK5334-2TS00-4AR3)／SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3)／SCALANCE XR502-32 (6GK5534-5TR00-2AR3)／SCALANCE XR502-32 (6GK5534-5TR00-3AR3)／SCALANCE XR502-32 (6GK5534-5TR00-4AR3)／SCALANCE XR522-12 (6GK5534-3TR00-2AR3)／SCALANCE XR522-12 (6GK5534-3TR00-3AR3)／SCALANCE XR522-12 (6GK5534-3TR00-4AR3)／SCALANCE XR526-8 (6GK5534-2TR00-2AR3)／SCALANCE XR526-8 (6GK5534-2TR00-3AR3)／SCALANCE XR526-8 (6GK5534-2TR00-4AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-2AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-2RR3)／SCALANCE XR524-8WG (6GK5532-2SR00-3AR3)／SCALANCE XR524-8WG (6GK5532-2SR00-3RR3)／Shopfloor IT Suite／Siemens OPC UA Modelling Editor (SiOME)／SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)／SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)／SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)／SIMATIC IPC BX-21A／SIMATIC IPC MD-57A／SIMATIC IPC ORCLA／SIMATIC MV530 H (6GF3530-0GE10)／SIMATIC MV530 S (6GF3530-0CD10)／SIMATIC MV540 H (6GF3540-0GE10)／SIMATIC MV540 H CRANES (6GF3540-0GE30)／SIMATIC MV540 S (6GF3540-0CD10)／SIMATIC MV550 H (6GF3550-0GE10)／SIMATIC MV550 S (6GF3550-0CD10)／SIMATIC MV560 U (6GF3560-0LE10)／SIMATIC MV560 X (6GF3560-0HE10)／SIMATIC RTLS Locating Manager (6GT2780-0DA00)／SIMATIC RTLS Locating Manager (6GT2780-0DA10)／SIMATIC RTLS Locating Manager (6GT2780-0DA20)／SIMATIC RTLS Locating Manager (6GT2780-0DA30)／SIMATIC RTLS Locating Manager (6GT2780-1EA10)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMOVE Fleetmanager V3.1（V3.1.13より前）：V3.1.13以降へ更新します。\nSIMOVE Fleetmanager V3.2（V3.2.4より前）：V3.2.4以降へ更新します。\nSIPLANT（掲載されたこの製品系列のすべての版）：Siemensの顧客サポートへ、該当製品のパッチと更新・対応方法を依頼します。\nSIDIS Prime（V4.0.700以降）：Siemensの顧客サポートへ、該当製品のパッチと更新・対応方法を依頼します。\nSIMATIC Logon V1.6（V1.6 Upd12より前）：V1.6 Upd12以降へ更新します。\nSIMATIC PDM V9.3（V9.3 SP2より前）：V9.3 SP2以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-434797.html" ], "evidenceIds": [ "E59", "E164", "E61", "E62", "E63", "E64" ] }, { "text": "SSA-457936の対応：\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)／SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)／SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)（V3.1.7以降）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)（V3.1.7以降）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "procedure", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" ], "evidenceIds": [ "E65", "E66", "E67" ] }, { "text": "SSA-493396の対応：\nSIMATIC S7-PLCSIM V17（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC STEP 7 V17／SIMATIC WinCC V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)／TIA Portal Cloud V18／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)／SIMOCODE ES V20／SIMOTION SCOUT TIA V5.7／SINAMICS Startdrive V20／SIRIUS Safety ES V20 (TIA Portal)／SIRIUS Soft Starter ES V20 (TIA Portal)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC STEP 7 V18／SIMATIC WinCC V18（V18 Update 6より前）：V18 Update 6以降へ更新します。\nSIMATIC STEP 7 V19／SIMATIC WinCC V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMOTION SCOUT TIA V5.6（V5.6 SP1 HF7より前）：V5.6 SP1 HF7以降へ更新します。\nTIA Portal Cloud V19（V5.2.1.1より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。\nSIMATIC STEP 7 V20／SIMATIC WinCC V20（V20 Update 4より前）：V20 Update 4以降へ更新します。\nTIA Portal Cloud V20（V5.2.2.2より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-493396.html" ], "evidenceIds": [ "E68", "E70", "E71", "E72", "E73", "E74", "E165" ] }, { "text": "SSA-508506の対応：\nRUGGEDCOM CROSSBOW（V6.0より前）：V6.0以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-508506.html" ], "evidenceIds": [ "E76", "E77" ] }, { "text": "SSA-545643の対応：\nblueplanet 3.0 TL3-60.0 TL3（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nblueplanet 87.0 TL3／blueplanet 92.0 TL3／blueplanet 105 TL3／blueplanet 110 TL3／blueplanet 125 TL3／blueplanet 137 TL3／blueplanet 150 TL3／blueplanet 155 TL3／blueplanet 165 TL3（V3.92より前）：V3.92以降へ更新します。\nblueplanet 87.0 TL3 GEN2／blueplanet 92.0 TL3 GEN2／blueplanet 100 TL3 GEN2／blueplanet 105 TL3 GEN2／blueplanet 125 TL3 GEN2／blueplanet 150 TL3 GEN2／blueplanet 155 TL3 GEN2／blueplanet 165 TL3 GEN2（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nblueplanet 87.0 TL3 GEN2／blueplanet 92.0 TL3 GEN2／blueplanet 100 TL3 GEN2／blueplanet 105 TL3 GEN2／blueplanet 125 TL3 GEN2／blueplanet 150 TL3 GEN2／blueplanet 155 TL3 GEN2／blueplanet 165 TL3 GEN2（V6.1.4.9より前）：V6.1.4.9以降へ更新します。\nblueplanet 100 NX3 M8／blueplanet 125 NX3 M10（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nblueplanet gridsave 92.0 TL3-S／blueplanet gridsave 110 TL3-S／blueplanet gridsave 137 TL3-S（V3.92より前）：V3.92以降へ更新します。\nblueplanet gridsave 92.0 TL3-S／blueplanet gridsave 110 TL3-S／blueplanet gridsave 137 TL3-S（V3.91より前）：V3.91以降へ更新します。\nblueplanet 3.0 NX3-20.0 NX3／blueplanet 3.0-5.0 NX1／blueplanet 25.0 NX3-33.0 NX3／blueplanet 50.0 NX3-60.0 NX3／blueplanet 360 NX3 M6／blueplanet hybrid 6.0 NH3-12.0 NH3／blueplanet hybrid 10.0 TL3（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-545643.html" ], "evidenceIds": [ "E78", "E79", "E80", "E166" ] }, { "text": "SSA-550198の対応：\nSIMATIC WinCC V7.5（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC WinCC V8.0（V8.0 Update 11より前）：V8.0 Update 11以降へ更新します。\nSIMATIC WinCC V8.1（V8.1 Update 7より前）：V8.1 Update 7以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-550198.html" ], "evidenceIds": [ "E82", "E167" ] }, { "text": "SSA-563922の対応：\nSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)（V1.3.1より前）：V1.3.1以降へ更新します。\nSIMOTION OA MIIF (6AU1820-3DA20-0AB0)／SIMOTION OACAMGEN (6AU1820-3EA20-0AB0)／SIMOTION OALECO (6AU1820-3HA20-0AB0)／SIMOTION OAVIBX (6AU1820-3CA20-0AB0)（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-563922.html" ], "evidenceIds": [ "E84", "E168", "E169" ] }, { "text": "SSA-580366の対応：\nSiemens Software Center（V4.0.9.8より前）：V4.0.9.8以降へ更新します。次回起動時に自動更新されるとされています。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-580366.html" ], "evidenceIds": [ "E86", "E170" ] }, { "text": "SSA-591731の対応：\nSIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0)／SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0)／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS／SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs／SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)／SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0)／SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0)／SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0)／SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0)／SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0)／SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0)／SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0)／SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0)／SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0)／SIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0)／SIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0)／SIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0)／SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0)／SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0)／SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0)／SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0)／SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0)／SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0)／SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0)／SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0)／SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0)／SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0)／SIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0)／SIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0)／SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0)／SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0)／SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0)／SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0)／SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0)／SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0)／SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0)／SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0)／SIMATIC S7-1500 CPU 1516pro F-2 PN (6ES7516-2GP03-0AB0)／SIMATIC S7-1500 CPU 1516pro-2 PN (6ES7516-2PP03-0AB0)／SIMATIC S7-1500 CPU 1516T-3 PN (6ES7516-3TP10-0AB0)／SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0)／SIMATIC S7-1500 CPU 1516TF-3 PN (6ES7516-3UP10-0AB0)／SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0)／SIMATIC S7-1500 CPU 1517-3 PN (6ES7517-3AQ10-0AB0)／SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN (6ES7517-3FQ10-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0)／SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP01-0AB0)／SIMATIC S7-1500 CPU 1517T-3 PN (6ES7517-3TQ10-0AB0)／SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0)／SIMATIC S7-1500 CPU 1517TF-3 PN (6ES7517-3UQ10-0AB0)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0)（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "procedure", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-591731.html" ], "evidenceIds": [ "E88", "E171" ] }, { "text": "SSA-628843の対応：\nSIMATIC CN 4100（ハードウェアがFS 05より前の製品）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC Field PG M5／SIMATIC IPC227E／SIMATIC IPC277E／SIMATIC ITP1000（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC Field PG M6（V26.01.14より前）：V26.01.14以降へ更新します。\nSIMATIC IPC427E／SIMATIC IPC477E／SIMATIC IPC477E PRO／SIPLUS IPC427E（V21.01.20より前）：V21.01.20以降へ更新します。\nSIMATIC IPC627E／SIMATIC IPC647E／SIMATIC IPC677E／SIMATIC IPC847E（V25.02.16より前）：V25.02.16以降へ更新します。\nSIMATIC IPC BX-32A／SIMATIC IPC BX-39A／SIMATIC IPC PX-39A／SIMATIC IPC PX-39A PRO／SIMATIC IPC PX-32A（V29.01.09より前）：V29.01.09以降へ更新します。\nSIMATIC IPC BX-56A／SIMATIC IPC BX-59A（V32.01.09より前）：V32.01.09以降へ更新します。\nSIMATIC IPC RW-528A／SIMATIC IPC RW-548A（V34.01.02より前）：V34.01.02以降へ更新します。\nSIMATIC IPC MD-57A（V30.01.10より前）：V30.01.10以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-628843.html" ], "evidenceIds": [ "E90", "E172", "E93", "E94", "E95", "E96" ] }, { "text": "SSA-693808の対応：\nSIMATIC PCS neo V4.1／SIMATIC PCS neo V5.0／SIMATIC S7-PLCSIM V17（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC PCS neo V6.0（V6.0 SP1 Update 1より前）：V6.0 SP1 Update 1以降へ更新します。\nSIMATIC STEP 7 V17／SIMATIC WinCC V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMOCODE ES V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)／SIMOCODE ES V20／SIMOTION SCOUT TIA V5.7／SINAMICS Startdrive V20／SIRIUS Safety ES V20 (TIA Portal)／SIRIUS Soft Starter ES V20 (TIA Portal)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Safety ES V18 (TIA Portal)／SIRIUS Soft Starter ES V18 (TIA Portal)（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。\nSIMATIC STEP 7 V18／SIMATIC WinCC V18（V18 Update 6より前）：V18 Update 6以降へ更新します。\nTIA Portal Cloud V18（V6.3.0.2より前）：V6.3.0.2以降へ更新します。\nSIMATIC STEP 7 V19／SIMATIC WinCC V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMOTION SCOUT TIA V5.6（V5.6 SP1 HF7より前）：V5.6 SP1 HF7以降へ更新します。\nTIA Portal Cloud V19（V5.2.1.1より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。\nSIMATIC STEP 7 V20／SIMATIC WinCC V20／TIA Portal Test Suite V20（V20 Update 4より前）：V20 Update 4以降へ更新します。\nTIA Portal Cloud V20（V5.2.2.2より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-693808.html" ], "evidenceIds": [ "E97", "E98", "E99", "E100", "E101", "E102", "E103", "E104", "E105", "E173" ] }, { "text": "SSA-765416の対応：\nRUGGEDCOM CROSSBOW Station Access Controller (SAC)（V6.0より前）：V6.0以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" ], "evidenceIds": [ "E106", "E107" ] }, { "text": "SSA-784472の対応：\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。", "kind": "procedure", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" ], "evidenceIds": [ "E108", "E174" ] }, { "text": "SSA-794185の対応：\nCPC80 Central Processing/Communication（V16.51より前）：V16.51以降へ更新します。\nCPCI85 Central Processing/Communication（V6.20より前）：V6.20以降へ更新します。\nPOWER METER SICAM Q100 family（V2.70より前）：V2.70以降へ更新します。\nPOWER METER SICAM Q200 family（V2.83より前）：V2.83以降へ更新します。\nPowerlink IP（V4.23より前）：V4.23以降へ更新します。\nSICAM GridPass（V2.50より前）：V2.50以降へ更新します。\nSICORE Base system（V2.20.0より前）：V2.20.0以降へ更新します。\nSIPROTEC 5 7SA82 (CP100)／SIPROTEC 5 7SD82 (CP100)／SIPROTEC 5 7SJ81 (CP100)／SIPROTEC 5 7SJ82 (CP100)／SIPROTEC 5 7SK82 (CP100)／SIPROTEC 5 7SL82 (CP100)／SIPROTEC 5 7UT82 (CP100)（V7.80以降、V8.90より前）：V8.90以降のV8.xx系列へ更新します。\nSIPROTEC 5 7SA82 (CP150)／SIPROTEC 5 7SD82 (CP150)／SIPROTEC 5 7SJ81 (CP150)／SIPROTEC 5 7SJ82 (CP150)／SIPROTEC 5 7SK82 (CP150)／SIPROTEC 5 7SL82 (CP150)／SIPROTEC 5 7SX82 (CP150)／SIPROTEC 5 7SY82 (CP150)／SIPROTEC 5 7UT82 (CP150)／SIPROTEC 5 6MD84 (CP300)／SIPROTEC 5 6MU85 (CP300)／SIPROTEC 5 7ST86 (CP300)／SIPROTEC 5 7SX85 (CP300)／SIPROTEC 5 7VU85 (CP300)／SIPROTEC 5 Compact 7SX800 (CP050)（V10.0より前）：V10.0以降へ更新します。\nSIPROTEC 5 6MD85 (CP300)／SIPROTEC 5 6MD86 (CP300)／SIPROTEC 5 6MD89 (CP300)／SIPROTEC 5 7KE85 (CP300)／SIPROTEC 5 7SA86 (CP300)／SIPROTEC 5 7SA87 (CP300)／SIPROTEC 5 7SD86 (CP300)／SIPROTEC 5 7SD87 (CP300)／SIPROTEC 5 7SJ85 (CP300)／SIPROTEC 5 7SJ86 (CP300)／SIPROTEC 5 7SK85 (CP300)／SIPROTEC 5 7SL86 (CP300)／SIPROTEC 5 7SL87 (CP300)／SIPROTEC 5 7SS85 (CP300)／SIPROTEC 5 7ST85 (CP300)／SIPROTEC 5 7UM85 (CP300)／SIPROTEC 5 7UT85 (CP300)／SIPROTEC 5 7UT86 (CP300)／SIPROTEC 5 7UT87 (CP300)／SIPROTEC 5 7VE85 (CP300)／SIPROTEC 5 7VK87 (CP300)（V7.80以降、V10.0より前）：V10.0以降へ更新します。\nSIPROTEC 5 6MD89 (CP300) V9.6x／SIPROTEC 5 7ST85 (CP300) V9.6x（V9.68より前）：V9.68以降へ更新します。\nSIPROTEC 5 7ST86 (CP300) V9.8x（V9.83より前）：V9.83以降へ更新します。\nSICAM AK 3／SICAM BC／SICAM GridEdge (Classic)／SICAM GridEdge Applications for SICAM 8 Platform／SICAM TM／SIPROTEC 5 - CP200 Devices（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-794185.html" ], "evidenceIds": [ "E110", "E112", "E113", "E114", "E115", "E116" ] }, { "text": "SSA-794697の対応：\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem（V1.1より前）：V1.1以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-794697.html" ], "evidenceIds": [ "E117", "E175", "E119" ] }, { "text": "SSA-800126の対応：\nSIMATIC S7-PLCSIM V16／SIMATIC S7-PLCSIM V17／SIMATIC STEP 7 Safety V16／SIMATIC STEP 7 V16／SIMATIC WinCC Unified V16／SIMATIC WinCC V16／SIMOCODE ES V16／SINAMICS Startdrive V16／TIA Portal Cloud V16（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC STEP 7 Safety V17／SIMATIC STEP 7 V17／SIMATIC WinCC Unified V17／SIMATIC WinCC V17（V17 Update 9より前）：V17 Update 9以降へ更新します。\nSIMOCODE ES V17／SIMOTION SCOUT TIA V5.4／SINAMICS Startdrive V17／SIRIUS Safety ES V17 (TIA Portal)／SIRIUS Soft Starter ES V17 (TIA Portal)／TIA Portal Cloud V17／SIMOCODE ES V18／SIMOTION SCOUT TIA V5.5／SINAMICS Startdrive V18／SIRIUS Soft Starter ES V18 (TIA Portal)／SIMOCODE ES V19／SINAMICS Startdrive V19／SIRIUS Safety ES V19 (TIA Portal)／SIRIUS Soft Starter ES V19 (TIA Portal)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC STEP 7 Safety V18／SIMATIC STEP 7 V18／SIMATIC WinCC Unified V18／SIMATIC WinCC V18／SIRIUS Safety ES V18 (TIA Portal)（V18 Update 6より前）：V18 Update 6以降へ更新します。\nTIA Portal Cloud V18（V6.3.0.2より前）：V6.3.0.2以降へ更新します。\nSIMATIC STEP 7 Safety V19／SIMATIC STEP 7 V19／SIMATIC WinCC Unified V19／SIMATIC WinCC V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMOTION SCOUT TIA V5.6（V5.6 SP1 HF7より前）：V5.6 SP1 HF7以降へ更新します。\nTIA Portal Cloud V19（V5.2.1.1より前）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-800126.html" ], "evidenceIds": [ "E120", "E122", "E123", "E124", "E125", "E176" ] }, { "text": "SSA-832641の対応：\nIndustrial Edge Cloud Device (IECD)／Industrial Edge Own Device (IEOD)／Industrial Edge Virtual Device (IEVD)（V1.28.1より前）：V1.28.1以降へ更新します。\nSCALANCE LPE9413 (6GK5998-3GS01-2AC2)／SCALANCE LPE9433 (6GK5998-3GS11-2AC2)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0)／SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0)／SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0)／SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0)／SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0)／SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0)／SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0)／SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0)／SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0)／SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0)／SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0)／SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0)／SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0)／SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0)／SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0)／SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0)／SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0)／SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0)／SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0)／SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0)／SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0)／SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0)／SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0)／SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0)／SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0)／SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0)／SIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0)／SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0)／SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1)／SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1)／SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1)／SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1)／SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1)／SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1)／SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1)／SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1)／SIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1)／SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1)／SIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1)／SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1)／SIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1)／SIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1)／SIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1)（掲載されたこの製品系列のすべての版）：公表時点で修正版はありません。修正提供状況を保守担当者に確認し、下の暫定対策も検討します。\nSIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2)／SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2)／SIMATIC IPC BX-21A Industrial Edge Device（V1.28.1-2より前）：V1.28.1-2以降へ更新します。\nSIMATIC IPC127E Industrial Edge Device／SIMATIC IPC227E Industrial Edge Device／SIMATIC IPC227G Industrial Edge Device／SIMATIC IPC427E Industrial Edge Device／SIMATIC IPC847E Industrial Edge Device／SIMATIC IPC BX-39A Industrial Edge Device／SIMATIC IPC BX-59A Industrial Edge Device（V3.2.0-17より前）：V3.2.0-17以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-832641.html" ], "evidenceIds": [ "E127", "E177", "E130", "E131", "E132" ] }, { "text": "SSA-858251の対応：\nIndustrial Edge for Machine Tools (formerly known as \"SINUMERIK Edge\")／SIMATIC IPC DiagMonitor（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC Energy Manager PRO V7.2／SIMATIC Energy Manager PRO V7.3（掲載されたこの製品系列のすべての版）：公表時点で修正の予定はありません。保守担当者と移行・交換や接続制限を検討します。\nSIMATIC Energy Manager PRO V7.4（V7.4 Update 0以降、V7.4 Update 7より前）：V7.4 Update 7以降へ更新します。\nSIMATIC Energy Manager PRO V7.5（V7.5 Update 0以降、V7.5 Update 2より前）：V7.5 Update 2以降へ更新します。\nSIMATIC WinCC V8.0（V8.0 Update 3より前）：V8.0 Update 3以降へ更新します。\nSIMIT V11（V11.3より前）：V11.3以降へ更新します。\nSIMATIC WinCC Unified V18（V18 Update 6より前）：V18 Update 6以降へ更新します。\nSIMATIC WinCC Unified V19（V19 Update 4より前）：V19 Update 4以降へ更新します。\nSIMATIC BRAUMAT／SIMATIC SISTAR（掲載されたこの製品系列のすべての版）：この取得範囲では更新番号を確定できません。機器名・版・この告知番号を保守担当者に渡し、更新と設定のどちらが必要か確認します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-858251.html" ], "evidenceIds": [ "E133", "E178", "E135" ] }, { "text": "SSA-864900の対応：\nRUGGEDCOM APE1808（Fortinet NGFWがV7.4.9より前の構成）：Fortigate NGFWをV7.4.9以降へ、Siemensの安全な更新手順に沿って更新します。手順の詳細は顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Fortinet NGFWがV7.6.6より前の構成）：Fortigate NGFWをV7.6.6以降へ、Siemensの安全な更新手順に沿って更新します。手順の詳細は顧客サポートへ依頼します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-864900.html" ], "evidenceIds": [ "E136", "E137", "E138", "E139" ] }, { "text": "SSA-911336の対応：\nRUGGEDCOM APE1808（公式に示された構成条件：with Nozomi Guardian/CMC）：Siemensの顧客サポートへ、該当製品のパッチと更新・対応方法を依頼します。", "kind": "procedure", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-911336.html" ], "evidenceIds": [ "E140", "E179" ] }, { "text": "SSA-967325の対応：\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでUser-ID認証ポータルを設定し、管理プロファイルのResponse Pagesを有効にした構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWを搭載した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWのGlobalProtect portal/gatewayで認証上書きCookieを有効にし、特定の証明書設定を使う構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h7へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでIKEv2の拠点間VPNを設定した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでDNS Proxyを有効にし、network proxyを接続した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでCASを有効にした認証プロファイルをログイン画面に適用した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h6へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWを搭載した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h7へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。\nRUGGEDCOM APE1808（Palo Alto Networks Virtual NGFWでURL filteringを有効にし、応答ページを変更した構成）：Palo Alto Networks Virtual NGFWをV11.2.10-h7以降へ更新します。パッチと手順をSiemensの顧客サポートへ依頼します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-967325.html" ], "evidenceIds": [ "E142", "E180", "E181", "E182" ] }, { "text": "SSA-968435の対応：\nIndustrial Edge App Publisher（V1.27.9より前）：V1.27.9以降へ更新します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-968435.html" ], "evidenceIds": [ "E144", "E183" ] }, { "text": "SSB-091449のアクセス制限：S7-1500/ET200MPはマニュアル4.9・11.6、S7-1200 G2は2.9・6.5、SINUMERIK ONEは11.7.2・11.10の設定を担当者と確認します。PG/HMI接続の保護レベルと、OPC UA/Web APIの変数ごとの許可を別々に点検してください。", "kind": "procedure", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssb-091449.html" ], "evidenceIds": [ "E146", "E184" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU90141693/" ] } ], "temporaryMitigations": [ { "text": "LOGO!のCVE-2025-40815はLSCアクセスを強いパスワードで保護します。CVE-2025-40816・40817はUDP 10006番への接続を信頼できるIPアドレスへ制限します。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-267056.html" ], "evidenceIds": [ "E24", "E185" ] }, { "text": "GNU/Linux subsystemの告知では、信頼できるアプリだけを動かし、shell操作を信頼できる担当者へ限る対策が示されています。Web Installerやプロジェクトファイルの問題は、入手元を確認したセットアップ・ファイルを扱う運用にします。いずれも更新を適用した証明にはなりません。", "kind": "procedure", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "https://cert-portal.siemens.com/productcert/html/ssa-493396.html" ], "evidenceIds": [ "E1", "E4", "E26", "E186", "E68", "E187", "E108", "E174" ] }, { "text": "APE1808のPalo Alto構成では、CVE-2026-0257は認証上書きCookie専用の証明書を使うか、Cookieの生成・受け入れを無効にします。CVE-2026-0264は外部に公開したインターフェースからDNS Proxyを外すか、使わない機能を無効にし、信頼できるDNS接続先を設定します。CVE-2026-0300はUser-ID認証ポータルを内部の信頼できるIPへ制限し、外部流入のあるインターフェースでResponse Pagesを無効にします。必要性を確認して不要な認証ポータルも無効にします。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-967325.html" ], "evidenceIds": [ "E142", "E188", "E189", "E190" ] } ], "verification": [ { "text": "担当者から、対象だった製品・適用した修正や設定・反映日時を回答してもらいます。製品ごとの公式情報と照合してから完了とし、通常業務が続けられることも確認してください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/vu/JVNVU90141693/" ], "evidenceIds": [ "E147", "E148", "E149", "E150", "E151" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/vu/JVNVU90141693/" ] } ], "unknowns": [ "公表時点の公式資料を照合した説明です。実際の機器や設定を検査した結果ではありません。修正版や対応状況は製品・系列ごとに確認してください。", "取得した資料の一部は長いため途中までの引用です。掲載していない型番・CVEを対象外とは判定しません。また、修正未提供と、取得範囲内に更新番号がない状態を区別しています。", "同じ型番でもCVEごとに対象範囲・修正状況が分かれる場合があります。修正番号は、隣接する製品や別の告知へ適用しないでください。" ], "supportRequest": "件名：JVNVU90141693（Siemens製品に対するアップデート（2026年10月））の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nJVNVU90141693について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVNVU90141693", "sources": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "label": "公的機関・開発元の個別告知" }, { "url": "https://jvn.jp/vu/JVNVU90141693/", "label": "JVN：関連する公式告知の一覧" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "reviewedSourceFingerprint": "reviewed-source-v1:a5433124b5c630c8b6c01e60e103759241235c64e9de9967e5a708defee852eb", "reviewedSourceScope": "official_evidence", "evidence": [ { "id": "E1", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "sourceField": "body:advisory", "excerpt": "SSA-019113\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6\n\nPublication Date:\n\n2026-07-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nSIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1.6 only; for version V3.1.7 refer to SSA-457936 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nExpan", "language": "en" }, { "id": "E2", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "sourceField": "body:advisory", "excerpt": "mens Security Advisory by Siemens ProductCERT\n\nSSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6\n\nPublication Date:\n\n2026-07-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIP", "language": "en" }, { "id": "E3", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "sourceField": "body:advisory", "excerpt": "any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1.6 only; for version V3.1.7 refer to SSA-457936 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nShow more details\n\nSIM", "language": "en" }, { "id": "E4", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "sourceField": "body:advisory", "excerpt": "-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.6 < V3.1.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-31431\n\nCVE-2026-43284\n\nCVE-2026-46300\n\nUpdate to V3.1.7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2", "language": "en" }, { "id": "E5", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "sourceField": "body:advisory", "excerpt": "SSA-055299\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n5.3\n\nCVSS v4.0 Base Score:\n6.9\n\nSUMMARY\n\nThe products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service.\n\nSiemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nCapital Embedded AR Classic 431-422\n\nAll versions\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nCapital Embedded AR Classic R20-11\n\nAll versions < V2303\n\naffected by\n\nCVE-2026-89208\n\nUpdate to V2303 or later version\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the ri", "language": "en" }, { "id": "E6", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "sourceField": "body:advisory", "excerpt": "ailable.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nCapital Embedded AR Classic 431-422\n\nAll versions\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nCapital Embedded AR Classic R20-11\n\nAll versions < V2303\n\naffected by\n\nCVE-2026-89208\n\nUpdate to V2303 or later version\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nApply network segmentation and put the ECUs behind properly configured gateways/firewalls\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nCapital Embedded AR Classic (formerly called Capital VSTAR), is a scalable AUTOSAR Classic software platform that meets ISO 26262 use cases for up to ASIL D. Versions are available for several recent AUTOSAR Classic", "language": "en" }, { "id": "E7", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "sourceField": "body:advisory", "excerpt": "SSA-082556\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5\n\nPublication Date:\n\n2025-06-10\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.7\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nSIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nExpand children", "language": "en" }, { "id": "E8", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "sourceField": "body:advisory", "excerpt": "mens Security Advisory by Siemens ProductCERT\n\nSSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5\n\nPublication Date:\n\n2025-06-10\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.7\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIP", "language": "en" }, { "id": "E9", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "sourceField": "body:advisory", "excerpt": "any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nShow more details\n\nSIM", "language": "en" }, { "id": "E10", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "sourceField": "body:advisory", "excerpt": "-46300\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.5 < V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-32776\n\nCVE-2026-32777\n\nCVE-2026-32778\n\nCVE-2026-3904\n\nCVE-2026-4046\n\nCVE-2026-41080\n\nCVE-2026-4437\n\nCVE-2026-4438\n\nCVE-2026-45186\n\nCVE-2026-5435\n\nCVE-2026-5450\n\nCVE-2026-5928\n\nCVE-2026-6238\n\nUpdate to V3.1.6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.5\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2025-21848\n\nCVE-2025-21712\n\nCVE-2025-21865\n\nCVE-2025-21862\n\nCVE-2025-21864\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-50246\n\nCVE-2024-57977\n\nCVE-2024-24855\n\nCVE-2024-26596\n\nCVE-2025-21701\n\nCVE-2025-21767\n\nCVE-2025-21728\n\nCVE-2025-21766\n\nCVE-2025-21795\n\nCVE-2025-21724\n\nCVE-2025-21765\n\nCVE-2024-57996\n\nCVE-2025-21796\n\nCVE-2025-21758\n\nCVE-2025-21745\n\nCVE-2023-4527\n\nCVE-2023-4806\n\nCVE-2023-4911\n\nCVE-2023-38545\n\nCVE-2023-38546\n\nCVE-2023-5363\n\nCVE-2023-44487\n\nC", "language": "en" }, { "id": "E11", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "sourceField": "body:advisory", "excerpt": "SSA-099819\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-099819: Denial of Service Vulnerability in SENTRON 3NA COM Fuse\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n5.8\n\nSUMMARY\n\nSENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSENTRON 3NA COM Fuse\n\nAll versions < V5.2\n\naffected by\n\nCVE-2024-7322\n\nUpdate to V5.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109797242/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siem", "language": "en" }, { "id": "E12", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "sourceField": "body:advisory", "excerpt": "lished to restore normal operation.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSENTRON 3NA COM Fuse\n\nAll versions < V5.2\n\naffected by\n\nCVE-2024-7322\n\nUpdate to V5.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109797242/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSENTRON 3NA COM, the first NH fuse with current direction detection, delivers overload protection and measurement data for grid stability and faster fault diagnosis.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulner", "language": "en" }, { "id": "E13", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "sourceField": "body:advisory", "excerpt": "SSA-104023\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-07-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n9.2\n\nSUMMARY\n\nPalo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nCustomers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications.\n\n[1] https://security.paloaltonetworks.com/\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW\n\naffected by\n\nall CVEs\n\nCVE-2026-0266\n\nCVE-2026-0272\n\nCVE-2026-0273\n\nCVE-2026-0279\n\nCVE-2026-0280\n\nCVE-2026-0281\n\nCVE-2026-0282\n\nCVE-2026-0283\n\nCVE-2026-0284\n\nCVE-2026-0285\n\nCVE-2026-0286\n\nCVE-2026-0287\n\nCVE-2026-0288\n\nCVE-2026-0308\n\nCVE-2026-0309\n\nCVE-2026-0310\n\nContact customer support to receive patch and update information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nP", "language": "en" }, { "id": "E14", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "sourceField": "body:advisory", "excerpt": "SSA-127084\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-08-11\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.1\n\nCVSS v3.1 Base Score:\n8.1\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigation measures.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW\n\naffected by\n\nall CVEs\n\nCVE-2026-23573\n\nCVE-2026-59839\n\nCVE-2026-71408\n\nCVE-2026-71407\n\nCVE-2026-84393\n\nUpdate Fortigate NGFW to V7.6.7 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with ap", "language": "en" }, { "id": "E15", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "sourceField": "body:advisory", "excerpt": "NOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW\n\naffected by\n\nall CVEs\n\nCVE-2026-23573\n\nCVE-2026-59839\n\nCVE-2026-71408\n\nCVE-2026-71407\n\nCVE-2026-84393\n\nUpdate Fortigate NGFW to V7.6.7 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific", "language": "en" }, { "id": "E16", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "sourceField": "body:advisory", "excerpt": "SSA-148322\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n7.0\n\nSUMMARY\n\nPSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type.\n\nSiemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nPSS(R)SINCAL V21.5\n\nAll versions\n\naffected by\n\nCVE-2026-84854\n\nCurrently no fix is available\n\nInstall WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems.\n\nPSS(R)SINCAL V22.0\n\nAll versions\n\naffected by\n\nCVE-2026-84854\n\nCurrently no fix is available\n\nInstall WIBU Systems WibuKey Runtime for Windows 6.72 or later version manuall", "language": "en" }, { "id": "E17", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "sourceField": "body:advisory", "excerpt": "tions for products where patches are currently unavailable.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nPSS(R)SINCAL V21.5\n\nAll versions\n\naffected by\n\nCVE-2026-84854\n\nCurrently no fix is available\n\nInstall WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems.\n\nPSS(R)SINCAL V22.0\n\nAll versions\n\naffected by\n\nCVE-2026-84854\n\nCurrently no fix is available\n\nInstall WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems.\n\nPSS(R)SINCAL V22.5\n\nAll versions < V22.5 Update 5\n\naffected by\n\nCVE-2026-84854\n\nUpdate to V22.5 Update 5 or later version\n\nhttps://www.simtec.cc/en/updates.aspx\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nOperators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechan", "language": "en" }, { "id": "E18", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "sourceField": "body:advisory", "excerpt": "SSA-159454\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n7.7\n\nCVSS v4.0 Base Score:\n8.4\n\nSUMMARY\n\nThe products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC IPC family\n\nShow more details\n\nSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G\n\nAll versions < V28.01.15\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V28.01.15 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC BX-21A\n\nAll versions < V31.01.13\n\naffecte", "language": "en" }, { "id": "E19", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "sourceField": "body:advisory", "excerpt": "t and Versions\nRemediation\n\nExpand children\n\nSIMATIC IPC family\n\nShow more details\n\nSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G\n\nAll versions < V28.01.15\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V28.01.15 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC BX-21A\n\nAll versions < V31.01.13\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V31.01.13 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC RW-543A\n\nAll versions < V1.1.4\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V1.1.4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee furth", "language": "en" }, { "id": "E20", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "sourceField": "body:advisory", "excerpt": "SSA-265688\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1\n\nPublication Date:\n\n2024-04-09\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.3\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.2\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.\n\nSiemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nSIMATIC S7-1500 TM MFP V1.1 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V1.1 only; for version V1.1.1 refer to SSA-784472 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nShow more details\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions < V1.1.1\n\naffected by\n\nmultiple CVEs\n\nCVE-2023-5678\n\nCVE-2024-0727\n\nCVE-2023-", "language": "en" }, { "id": "E21", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "sourceField": "body:advisory", "excerpt": "SSA-265688\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1\n\nPublication Date:\n\n2024-04-09\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.3\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.2\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.\n\nSiemens has released a new version for SIMATIC S7-150", "language": "en" }, { "id": "E22", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "sourceField": "body:advisory", "excerpt": "be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V1.1 only; for version V1.1.1 refer to SSA-784472 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nShow more details\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions < V1.1.1\n\naffected by\n\nmultiple CVEs\n\nCVE-2023-5678\n\nCVE-2024-0727\n\nC", "language": "en" }, { "id": "E23", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "sourceField": "body:advisory", "excerpt": "ntly no fix is available\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly build and run applications from trusted sources.\n\nLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-1500 TM MFP is a Technology module Multi functional platform for SIMATIC S7-1500 PLCs based on SIMATIC Industrial OS\n\nVULNERABILITY DESCR", "language": "en" }, { "id": "E24", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "sourceField": "body:advisory", "excerpt": "SSA-267056\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-267056: Multiple Vulnerabilities in LOGO! 8 BM Devices\n\nPublication Date:\n\n2025-11-11\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.1\n\nCVSS v3.1 Base Score:\n7.6\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nLOGO! 8 BM (incl. SIPLUS variants) contains multiple vulnerabilities. These could allow an attacker to execute code remotely, put the device into a denial of service state, or change the behavior of the device.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nLOGO! V8.4 BM\n\nShow more details\n\nLOGO! 12/24RCE (6ED1052-1MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 12/24RCEo (6ED1052-2MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee", "language": "en" }, { "id": "E25", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "sourceField": "body:advisory", "excerpt": "Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nLOGO! V8.4 BM\n\nShow more details\n\nLOGO! 12/24RCE (6ED1052-1MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 12/24RCEo (6ED1052-2MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later ve", "language": "en" }, { "id": "E26", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "SSA-282044\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery\n\nPublication Date:\n\n2025-08-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.0\n\nCVSS v3.1 Base Score:\n7.8\n\nCVSS v4.0 Base Score:\n8.5\n\nSUMMARY\n\nThe installers used to install several Siemens products are affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected installer component. This vulnerability poses a risk only during setup and installation phase of the affected applications downloaded e.g. via OSD (Online Software Delivery).\n\nSiemens has released new versions for several affected products and recommends using the latest versions during setup and installation. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nAutomation License Manager\n\nShow more details\n\nAutomation License Manager V6.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee fur", "language": "en" }, { "id": "E27", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "ODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nAutomation License Manager\n\nShow more details\n\nAutomation License Manager V6.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAutomation License Manager V6.2\n\nAll versions < V6.2 Upd3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.2 Upd3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/114358/\n\nSee further recommendations from section\nMitigations\n\nCEMAT V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nCP PtP Param configuring interface\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nCreate MyConfig (CMC)\n\nAll v", "language": "en" }, { "id": "E28", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "y\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nMultiFieldbus Configuration Tool (MFCT)\n\nAll versions < V1.5.5.0\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V1.5.5.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109773881/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nOpenPCS 7\n\nShow more details\n\nOpenPCS 7 V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned", "language": "en" }, { "id": "E29", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "cted by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSiemens Network Planner (SINETPLAN)\n\nAll versions < V2.0 SP2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.0 SP2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110002597/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Automation Tool\n\nAll versions < V5.0 SP4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V5.0 SP4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110004631/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Automation Tool SDK Windows\n\nAll versions < V5.0 SP4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V5.0 SP4 or later version\n\nhttps:/", "language": "en" }, { "id": "E30", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "ll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Logon V2.0\n\nAll versions < V2.0 Upd3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.0 Upd3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109983445/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Management Agent\n\nAll versions < V9.1 SP1 Upd8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP1 Upd8 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Management Console\n\nAll versions < V9.1 SP1 Upd8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP1 Upd8 or later versi", "language": "en" }, { "id": "E31", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "affected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC NET PC Software V20\n\nAll versions < V20.0 Update 1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V20.0 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987675/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC ODK 1500S\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from secti", "language": "en" }, { "id": "E32", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "rsion\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 V10.0\n\nAll versions < V10.0 SP1 UC01\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V10.0 SP1 UC01 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109983445/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Advanced Process Faceplates V9.1\n\nAll versions < V9.1 SP2 Upd4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 SP2 Upd4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7 Advanced Process Functions\n\nShow more details\n\nSIMATIC PCS 7 Advanced Process Functions V2.1", "language": "en" }, { "id": "E33", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "rther recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PCS 7 Logic Matrix\n\nShow more details\n\nSIMATIC PCS 7 Logic Matrix V9.1\n\nAll versions < V9.1 Upd8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.1 Upd8 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS 7 Logic Matrix V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations", "language": "en" }, { "id": "E34", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V6.0\n\nAll versions < V6.0 SP1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.0 SP1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109991149/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC PDM\n\nShow more details\n\nSIMATIC PDM V9.2\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PDM V9.3\n\nAll versions < V9.3 SP1 Upd2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V9.3 SP1 Upd2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109983445/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PDM Maintenance Station V5.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further rec", "language": "en" }, { "id": "E35", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "d by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 Software Controller V3\n\nAll versions < V31.1.5\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V31.1.5 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478528/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-Fail-safe Configuration Tool (S7-FCT)\n\nAll versions < V4.0.1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V4.0.1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109762827/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PCT\n\nAll versions < V3.5 SP4 Update 1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V3.5 SP4 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/32469496/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-PLCSIM\n\nShow more details\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2025-3003", "language": "en" }, { "id": "E36", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "https://support.industry.siemens.com/cs/ww/en/view/109963851/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PLCSIM Advanced\n\nAll versions < V7.0 Update 1\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V7.0 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109988436/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Safety Matrix V6.3\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations fr", "language": "en" }, { "id": "E37", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "All versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Target\n\nAll versions < V6.0 SP3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.0 SP3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109997133/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC WinCC\n\nShow more details\n\nSIMATIC WinCC V7.5\n\nAll versions < V7.5 SP2 Update 20\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V7.5 SP2 Update 20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109793460/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 8\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V8.0 Update 8 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC V8.1\n\nAll versions < V8.1 Update 3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V8.1 Update 3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109977191/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC WinCC flexible ES\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations fro", "language": "en" }, { "id": "E38", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "affected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTeleControl Server Basic V3.1\n\nAll versions < V3.1.2.2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V3.1.2.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987362/\n\nSee further recommendations from section\nMitigations\n\nTIA Administrator\n\nAll versions < V3.0.6\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V3.0.6 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109825038/\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud Connector\n\nAll versions < V2.3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.3 or later version\n\nhttps://support.industry.s", "language": "en" }, { "id": "E39", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourceField": "body:advisory", "excerpt": "SSA-333035\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n8.2\n\nCVSS v4.0 Base Score:\n8.8\n\nSUMMARY\n\nThe products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nAPOGEE MBC (PPC) (BACnet)\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102074\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE MBC (PPC) (P2 Ethernet)\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE MEC (PPC) (BACnet)\n\nAll versions", "language": "en" }, { "id": "E40", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourceField": "body:advisory", "excerpt": "le.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nAPOGEE MBC (PPC) (BACnet)\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102074\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE MBC (PPC) (P2 Ethernet)\n\nAll versions\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE MEC", "language": "en" }, { "id": "E41", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourceField": "body:advisory", "excerpt": "VE-2026-102076\n\nCVE-2026-102073\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAPOGEE PXC Compact (BACnet)\n\nAll versions < V3.5.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nUpdate to V3.5.7 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nAPOGEE PXC Compact (P2 Ethernet)\n\nAll versions < V2.8.21\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-102074\n\nCVE-2026-102075\n\nCVE-2026-102076\n\nCVE-2026-102073\n\nUpdate to V2.8.21 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nAPOGEE PXC Modular (BACnet)\n\nAll versions < V3.5.7\n\naffected by\n\nmultiple CVEs\n\nCVE-", "language": "en" }, { "id": "E42", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourceField": "body:advisory", "excerpt": ".8.21 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC00-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC00-U\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC001-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fi", "language": "en" }, { "id": "E43", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourceField": "body:advisory", "excerpt": "sigo PXC22-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC22.1-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC36.1-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC50-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC64-U\n\nAll versions >", "language": "en" }, { "id": "E44", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourceField": "body:advisory", "excerpt": "extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2026-102073\n\nDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)\n\nCVE-2026-102074\n\nDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)\n\nCVE-2026-102075\n\nDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)\n\nCVE-2026-102076\n\nDisable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.)\n\nCVE-2026-89208\n\nApply network segmentation and put the controllers behind properly configured gateways/firewalls.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in", "language": "en" }, { "id": "E45", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "sourceField": "body:advisory", "excerpt": "SSA-377139\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.1\n\nCVSS v4.0 Base Score:\n8.9\n\nSUMMARY\n\nUsers of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information).\n\nIndustrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge Device Kit - arm64 V1.5\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.6\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix", "language": "en" }, { "id": "E46", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "sourceField": "body:advisory", "excerpt": "fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge Device Kit - arm64 V1.5\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.6\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.7\n\nA", "language": "en" }, { "id": "E47", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "sourceField": "body:advisory", "excerpt": "all CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.10\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.11\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.12\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.13\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.14\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.15\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.16\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.17\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.18\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.19\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.20\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.21\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.22\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.23\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.24\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.25\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.26\n\nAll versions < V1.26.2-1\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.26.2-1 or later version\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.27\n\nAll versions < V1.27.1-1\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.27.1-1 or later version\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.28\n\nAll versions < V1.28.0-6\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nUpdate to V1.28.0-6 or later version\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - x86-64 V1.5\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations fro", "language": "en" }, { "id": "E48", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "sourceField": "body:advisory", "excerpt": ".28.0-6 or later version\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nEnsure network access to affected products is limited to trusted parties only\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nThe Industrial Edge Device Kit allows Industrial Edge Device Builders to extend the Industrial Edge Ecosystem with their devices. It provides the components needed on the device, as well as the necessary interfaces in the Indust", "language": "en" }, { "id": "E49", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "sourceField": "body:advisory", "excerpt": "SSA-390352\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-390352: Multiple Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n7.5\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\n.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory.\n\nSiemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nShow more details\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nAll versions < V3.3.61\n\naffected by\n\nCVE-2026-85114\n\nUpdate to V3.3.61 or later version\n\nhttps://github.com/siemens/simatic-s7-webserver-api/releases/tag/v3.3.61\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nAll versions < V3.3.62\n\naffected by\n\nCVE-2026-85115\n\nUpdate to V3.3.62 or later version\n\nhttps://github.com/siemens/simatic-s7-webserver-api/releases/tag/v3.3.62\n\nMITIGATI", "language": "en" }, { "id": "E50", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "sourceField": "body:advisory", "excerpt": "diation\n\nExpand children\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nShow more details\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nAll versions < V3.3.61\n\naffected by\n\nCVE-2026-85114\n\nUpdate to V3.3.61 or later version\n\nhttps://github.com/siemens/simatic-s7-webserver-api/releases/tag/v3.3.61\n\n.NET Client Library for SIMATIC S7 Webserver API\n\nAll versions < V3.3.62\n\naffected by\n\nCVE-2026-85115\n\nUpdate to V3.3.62 or later version\n\nhttps://github.com/siemens/simatic-s7-webserver-api/releases/tag/v3.3.62\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-85114\n\nAffected applications do not properly validate filenames received from remote servers during ticket downloads.\n\nThis could allow an attacker who can manipulate the", "language": "en" }, { "id": "E51", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceField": "body:advisory", "excerpt": "SSA-392859\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20\n\nPublication Date:\n\n2024-12-10\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n7.3\n\nCVSS v4.0 Base Score:\n7.0\n\nSUMMARY\n\nAffected products contain a local arbitrary code execution vulnerability that could allow an attacker to perform actions against the operation system of that environment.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.\n\nSiemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-52051. See the chapter \"Additional Information\" below for more details.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-PLCSIM\n\nShow more details\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is planned\n\nSIMATIC S7-PLCSIM V18\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is", "language": "en" }, { "id": "E52", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceField": "body:advisory", "excerpt": "ixes are not, or not yet available.\n\nSiemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-52051. See the chapter \"Additional Information\" below for more details.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-PLCSIM\n\nShow more details\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is planned\n\nSIMATIC S7-PLCSI", "language": "en" }, { "id": "E53", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceField": "body:advisory", "excerpt": "rt.industry.siemens.com/cs/ww/en/view/109784441/\n\nSIMOCODE ES V17\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIMOTION SCOUT TIA V5.4\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Safety ES V17 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Soft Starter ES V17 (TIA Port", "language": "en" }, { "id": "E54", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceField": "body:advisory", "excerpt": "rt.industry.siemens.com/cs/ww/en/view/109817218/\n\nSIMOCODE ES V18\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIMOTION SCOUT TIA V5.5\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSINAMICS Startdrive V18\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Safety ES V18 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Soft Starter ES V18 (TIA Port", "language": "en" }, { "id": "E55", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceField": "body:advisory", "excerpt": "rt.industry.siemens.com/cs/ww/en/view/109925643/\n\nSIMOCODE ES V19\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIMOTION SCOUT TIA V5.6\n\nAll versions < V5.6 SP1 HF7\n\naffected by\n\nCVE-2024-52051\n\nUpdate to V5.6 SP1 HF7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989067/\n\nSINAMICS Startdrive V19\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nSIRIUS Safety ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurr", "language": "en" }, { "id": "E56", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceField": "body:advisory", "excerpt": "ilable\n\nSIRIUS Soft Starter ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2024-52051\n\nTIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the", "language": "en" }, { "id": "E57", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "sourceField": "body:advisory", "excerpt": "SSA-398330\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5\n\nPublication Date:\n\n2023-12-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.8\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.8\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nThese GNU/Linux vulnerabilities have been externally identified.\nSiemens has released new versions for the affected products and recommends to update to the latest versions.\n\nSIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 are no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 ( https://cert-portal.siemens.com/productcert/html/ssb-439005.html ).\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. re", "language": "en" }, { "id": "E58", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "sourceField": "body:advisory", "excerpt": "s Security Advisory by Siemens ProductCERT\n\nSSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5\n\nPublication Date:\n\n2023-12-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.8\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.8\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP", "language": "en" }, { "id": "E59", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceField": "body:advisory", "excerpt": "SSA-434797\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-434797: Buffer Overflow Vulnerability in OpenSSL affecting Siemens Products\n\nPublication Date:\n\n2026-06-09\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.4\n\nCVSS v3.1 Base Score:\n8.8\n\nSUMMARY\n\nOpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nAI Lightweight Inference Server\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nConnector for Azure\n\nAll versions < V1.8.0\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V1.8.0 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nDatabus\n\nAll versions < V3.3.2\n\naffected by\n\nCVE-2025-15467", "language": "en" }, { "id": "E60", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceField": "body:advisory", "excerpt": "t available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nAI Lightweight Inference Server\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nConnector for Azure\n\nAll versions < V1.8.0\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V1.8.0 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nDatabus\n\nAll versions < V3.3.2\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.3.2 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nHiMed Cockpit\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9403 (6GK5998-3GS00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9413 (6GK5998-3GS01-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9433 (6GK5998-3GS11-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE M-800 family (incl. S615,", "language": "en" }, { "id": "E61", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceField": "body:advisory", "excerpt": "rrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMOVE Fleetmanager\n\nShow more details\n\nSIMOVE Fleetmanager V3.1\n\nAll versions < V3.1.13\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.1.13 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109813191/\n\nSee further recommendations from section\nMitigations\n\nSIMOVE Fleetmanager V3.2\n\nAll versions < V3.2.4\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.2.4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109813191/\n\nSee further recommendations from section\nMitigations\n\nSIMOVE Fleetmanager V3.3\n\nAll versions < V3.3.2\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.3.2 or later version\n\nhttps://support.industry", "language": "en" }, { "id": "E62", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceField": "body:advisory", "excerpt": "by\n\nCVE-2025-15467\n\nContact customer support siplant-support.de@siemens.com\n\nSee further recommendations from section\nMitigations\n\nSIDIS Prime\n\nAll versions >= V4.0.700\n\naffected by\n\nCVE-2025-15467\n\nContact customer support\n\nSee further recommendations from section\nMitigations\n\nSiemens OPC UA Modelling Editor (SiOME)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC eaSie Core Package (6DL5424-0AX0", "language": "en" }, { "id": "E63", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceField": "body:advisory", "excerpt": "25-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC Logon\n\nShow more details\n\nSIMATIC Logon V1.6\n\nAll versions < V1.6 Upd12\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V1.6 Upd12 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109812242/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Logon V2.0\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC MV500 family\n\nShow more details\n\nSIMATIC MV530 H (6GF3530-0GE10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations", "language": "en" }, { "id": "E64", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceField": "body:advisory", "excerpt": "6GF3560-0HE10)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V6.0\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PDM V9.3\n\nAll versions < V9.3 SP2\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V9.3 SP2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110002130/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC RTLS Locating Manager\n\nShow more details\n\nSIMATIC RTLS Locating Manager (6GT2780-0DA00)\n\nAll versions\n\naffecte", "language": "en" }, { "id": "E65", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "sourceField": "body:advisory", "excerpt": "SSA-457936\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-202", "language": "en" }, { "id": "E66", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "sourceField": "body:advisory", "excerpt": "mens Security Advisory by Siemens ProductCERT\n\nSSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIP", "language": "en" }, { "id": "E67", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "sourceField": "body:advisory", "excerpt": "-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-", "language": "en" }, { "id": "E68", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "SSA-493396\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-493396: Deserialization Vulnerability in Siemens Engineering Platforms\n\nPublication Date:\n\n2025-08-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n7.8\n\nCVSS v4.0 Base Score:\n8.5\n\nSUMMARY\n\nAffected products do not properly sanitize user-controllable input when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V17\n\nShow more details\n\nSIMATIC STEP 7 V17\n\nAll versions < V17 Update 9\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V17", "language": "en" }, { "id": "E69", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V17\n\nShow more details\n\nSIMATIC STEP 7 V17\n\nAll versions < V17 Update 9\n\naffected", "language": "en" }, { "id": "E70", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "CODE ES V17\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.4\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V17 (TIA Portal)\n\nAl", "language": "en" }, { "id": "E71", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "CODE ES V18\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.5\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V18\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V18 (TIA Portal)\n\nAl", "language": "en" }, { "id": "E72", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "CODE ES V19\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.6\n\nAll versions < V5.6 SP1 HF7\n\naffected by\n\nCVE-2025-40759\n\nUpdate to V5.6 SP1 HF7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989067/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V19\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations", "language": "en" }, { "id": "E73", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "ersions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2025-40759\n\nFixed with V5.2.1.1, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V20\n\nShow more details\n\nSIMATIC STEP 7 V20\n\nAll versions <", "language": "en" }, { "id": "E74", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "CODE ES V20\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.7\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V20\n\nAll versions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V20 (TIA Portal)\n\nAl", "language": "en" }, { "id": "E75", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "ersions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V20\n\nAll versions < V5.2.2.2\n\naffected by\n\nCVE-2025-40759\n\nFixed with V5.2.2.2, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly open", "language": "en" }, { "id": "E76", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "sourceField": "body:advisory", "excerpt": "SSA-508506\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-508506: Multiple Vulnerabilities in RUGGEDCOM CROSSBOW\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n8.8\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nRUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service.\n\nSiemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM CROSSBOW\n\nAll versions < V6.0\n\naffected by\n\nall CVEs\n\nCVE-2026-89196\n\nCVE-2026-89197\n\nCVE-2026-89198\n\nCVE-2026-89199\n\nCVE-2026-89200\n\nCVE-2026-89201\n\nCVE-2026-89202\n\nCVE-2026-89203\n\nCVE-2026-89204\n\nCVE-2026-89205\n\nCVE-2026-89206\n\nUpdate to V6.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006651/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the Gen", "language": "en" }, { "id": "E77", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "sourceField": "body:advisory", "excerpt": "ends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM CROSSBOW\n\nAll versions < V6.0\n\naffected by\n\nall CVEs\n\nCVE-2026-89196\n\nCVE-2026-89197\n\nCVE-2026-89198\n\nCVE-2026-89199\n\nCVE-2026-89200\n\nCVE-2026-89201\n\nCVE-2026-89202\n\nCVE-2026-89203\n\nCVE-2026-89204\n\nCVE-2026-89205\n\nCVE-2026-89206\n\nUpdate to V6.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006651/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP compliant access to Intelligent Electronic Devices.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-89196\n\nAff", "language": "en" }, { "id": "E78", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "sourceField": "body:advisory", "excerpt": "SSA-545643\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-545643: Multiple Vulnerabilities in KACO Blueplanet Inverters\n\nPublication Date:\n\n2026-05-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n8.3\n\nCVSS v4.0 Base Score:\n7.2\n\nSUMMARY\n\nKACO blueplanet Inverters contain multiple vulnerabilities that could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access.\n\nKACO new energy GmbH has released new versions for several affected products and recommends to update to the latest versions. KACO new energy GmbH is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nblueplanet 3.0 TL3-60.0 TL3\n\nAll versions\n\naffected by\n\nCVE-2025-40946\n\nCurrently no fix is planned\n\nblueplanet 87.0 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 87.0 TL3 GEN2\n\nShow more details\n\nblueplanet 87.0 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurre", "language": "en" }, { "id": "E79", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "sourceField": "body:advisory", "excerpt": "sures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nblueplanet 3.0 TL3-60.0 TL3\n\nAll versions\n\naffected by\n\nCVE-2025-40946\n\nCurrently no fix is planned\n\nblueplanet 87.0 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 87.0 TL3 GEN2\n\nShow more details\n\nblueplanet 87.0 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently no fix is available\n\nblueplanet 87.0 TL3 GEN2\n\nAll versions < V6.1.4.9\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V6.1.4.9 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet 92.0 TL3\n\nAll versions < V3.92\n\naffected by\n\nall CVEs\n\nCVE-2026-41125\n\nCVE-2025-40946\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet 92.0 TL3 GEN2\n\nShow more details\n\nblueplanet 92.0 TL3 GEN2\n\nAll versions\n\naffected by\n\nCVE-2026-41125\n\nCurrently", "language": "en" }, { "id": "E80", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "sourceField": "body:advisory", "excerpt": "CVE-2026-41125\n\nUpdate to V3.92 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nblueplanet gridsave 92.0 TL3-S\n\nAll versions < V3.91\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V3.91 or later version\n\nhttps://kaco-newenergy.com/service/mykacocom-customer-portal\n\nExpand children\n\nblueplanet gridsave 110 TL3-S\n\nShow more details\n\nblueplanet gridsave 110 TL3-S\n\nAll versions < V3.91\n\naffected by\n\nCVE-2025-40946\n\nUpdate to V3.91 or later version\n\nhttps://ka", "language": "en" }, { "id": "E81", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "sourceField": "body:advisory", "excerpt": "s://kaco-newenergy.com/service/mykacocom-customer-portal\n\nKNOWN NOT AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nKnown Not Affected Products\nReason\n\nblueplanet 3.0 NX3-20.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 3.0-5.0 NX1\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 25.0 NX3-33.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 50.0 NX3-60.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 360 NX3 M6\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet hybrid 6.0 NH3-12.0 NH3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet hybrid 10.0 TL3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .", "language": "en" }, { "id": "E82", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "sourceField": "body:advisory", "excerpt": "SSA-550198\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-550198: Authenticated Remote Code Execution in WinCC\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n8.8\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC WinCC\n\nShow more details\n\nSIMATIC WinCC V7.5\n\nAll versions\n\naffected by\n\nCVE-2026-59241\n\nCurrently no fix is available\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 11\n\naffected by\n\nCVE-2026-59241\n\nUpdate to V8.0 Update 11 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSIMATIC WinCC V8.1\n\nAll versions < V8.1 Update 7\n\naffected by\n\nCVE-2026-59241\n\nUpdate to V8.1 Update 7 or later version\n\nhttp", "language": "en" }, { "id": "E83", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "sourceField": "body:advisory", "excerpt": "ilable.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC WinCC\n\nShow more details\n\nSIMATIC WinCC V7.5\n\nAll versions\n\naffected by\n\nCVE-2026-59241\n\nCurrently no fix is available\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 11\n\naffected by\n\nCVE-2026-59241\n\nUpdate to V8.0 Update 11 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSIMATIC WinCC V8.1\n\nAll versions < V8.1 Update 7\n\naffected by\n\nCVE-2026-59241\n\nUpdate to V8.1 Update 7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109977191/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY", "language": "en" }, { "id": "E84", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "sourceField": "body:advisory", "excerpt": "SSA-563922\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-563922: Local Privilege Escalation Vulnerability in SIMOTION Tools\n\nPublication Date:\n\n2025-09-09\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.1\n\nCVSS v3.1 Base Score:\n8.1\n\nSUMMARY\n\nSeveral tools for the SIMOTION system are affected by a local privilege escalation vulnerability. This could allow an attacker to execute arbitrary code with SYSTEM privileges when a legitimate user installs an application that uses the affected setup component. This vulnerability poses a risk only during setup and installation phase of the affected tools.\n\nSiemens has released a new version for SIMATIC Technology Package TPCamGen and recommends to update to the latest version. Siemens recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)\n\nAll versions < V1.3.1\n\naffected by\n\nCVE-2025-43715\n\nUpdate to V1.3.1 or later version\n\nTo obtain the patch and update information, please contact your regular Siemens contact person.\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109804905/\n\nSee further recommendations f", "language": "en" }, { "id": "E85", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "sourceField": "body:advisory", "excerpt": "KNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)\n\nAll versions < V1.3.1\n\naffected by\n\nCVE-2025-43715\n\nUpdate to V1.3.1 or later version\n\nTo obtain the patch and update information, please contact your regular Siemens contact person.\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109804905/\n\nSee further recommendations from section\nMitigations\n\nSIMOTION OA MIIF (6AU1820-3DA20-0AB0)\n\nAll versions\n\naffected by\n\nCVE", "language": "en" }, { "id": "E86", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "sourceField": "body:advisory", "excerpt": "SSA-580366\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-580366: DLL Sideloading Vulnerability in Siemens Software Center\n\nPublication Date:\n\n2026-10-15\n\nLast Update:\n\n2026-10-19\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n6.7\n\nCVSS v4.0 Base Score:\n8.4\n\nSUMMARY\n\nThe affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.\n\nSiemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSiemens Software Center\n\nAll versions < V4.0.9.8\n\naffected by\n\nCVE-2026-110936\n\nUpdate to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link)\n\nhttps://www.sw.siemens.com/en-US/siemens-software-center/\n\nMITIGATIONS\n\nProduct-specific remediat", "language": "en" }, { "id": "E87", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "sourceField": "body:advisory", "excerpt": "ploitation and how to detect it.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSiemens Software Center\n\nAll versions < V4.0.9.8\n\naffected by\n\nCVE-2026-110936\n\nUpdate to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link)\n\nhttps://www.sw.siemens.com/en-US/siemens-software-center/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKn", "language": "en" }, { "id": "E88", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "sourceField": "body:advisory", "excerpt": "SSA-591731\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.6\n\nCVSS v4.0 Base Score:\n9.4\n\nSUMMARY\n\nSIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization.\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC Drive Controller family\n\nShow more details\n\nSIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCV", "language": "en" }, { "id": "E89", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "sourceField": "body:advisory", "excerpt": "children\n\nSIMATIC Drive Controller family\n\nShow more details\n\nSIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrentl", "language": "en" }, { "id": "E90", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "SSA-628843\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-628843: Out of Bound Read Vulnerability in TPM 2.0\n\nPublication Date:\n\n2026-04-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n6.6\n\nSUMMARY\n\nThe products listed below contain a vulnerability that could allow an attacker to perform an out-of-bound read, potentially leading to information disclosure or denial of service of the TPM.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC CN 4100\n\nAll versions with Hardware versions < FS 05\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC Field PG\n\nShow more details\n\nSIMATIC Field PG M5\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nSIMATIC Field PG M6\n\nAll versions < V26.01.14\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V26.01.14 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nExpand children\n\nSIMATIC IPC family\n\nShow more detail", "language": "en" }, { "id": "E91", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "SSA-628843\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-628843: Out of Bound Read Vulnerability in TPM 2.0\n\nPublication Date:\n\n2026-04-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n6.6\n\nSUMMARY\n\nThe products listed below contain a vulnerability that could allow an attacker to perform an out-of-bound read, potentially leading to information disclosure or denial of service of the TPM.\n\nSiemens h", "language": "en" }, { "id": "E92", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "NOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC CN 4100\n\nAll versions with Hardware versions < FS 05\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC Field PG\n\nShow more details\n\nSIMATIC Field PG M5\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nSIMATIC Field PG M6\n\nAll versions < V26.01.14\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V26.01.14 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nExpand children\n\nSIMATIC IPC family\n\nShow more details\n\nSIMATIC IPC227E\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nSIMATIC IPC277E\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC IPC427E / IPC477E / IPC477E PRO\n\nShow more details\n\nSIMATIC IPC427E\n\nAll versions < V21.01.20\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V21.01.20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC477E\n\nAll versions < V21.01.20\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V21.01.20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC477E P", "language": "en" }, { "id": "E93", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "dustry.siemens.com/cs/ww/en/view/109763408/\n\nExpand children\n\nSIMATIC IPC627E / IPC647E / IPC677E / IPC847E\n\nShow more details\n\nSIMATIC IPC627E\n\nAll versions < V25.02.16\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V25.02.16 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC647E\n\nAll versions < V25.02.16\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V25.02.16 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC677E", "language": "en" }, { "id": "E94", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "cted by\n\nCVE-2025-2884\n\nUpdate to V25.02.16 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC BX-32A\n\nAll versions < V29.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nExpand children\n\nSIMATIC IPC BX-39A / IPC PX-39A / IPC PX-39A PRO\n\nShow more details\n\nSIMATIC IPC BX-39A\n\nAll versions < V29.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later", "language": "en" }, { "id": "E95", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "cted by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC BX-56A\n\nAll versions < V32.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V32.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC BX-59A\n\nAll versions < V32.01.09\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V32.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC PX", "language": "en" }, { "id": "E96", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "ted by\n\nCVE-2025-2884\n\nUpdate to V29.01.09 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC RW-528A\n\nAll versions < V34.01.02\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V34.01.02 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC RW-548A\n\nAll versions < V34.01.02\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V34.01.02 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC MD-57A\n\nAll versions < V30.01.10\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V30.01.10 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC ITP1000\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC Field PG is a mobile, industry-standard programming device for automation engineers with all commonly used interfaces for industrial applications that also brings pre-installed SIMATIC engineering software.\n\nSIMATIC IPC (Industrial PC) is the hardware platform for PC-based automation from Siemens.\n\nThe SIMATIC CN 4100 is a communication node that allows connecting third-party systems helping to imple", "language": "en" }, { "id": "E97", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "SSA-693808\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms\n\nPublication Date:\n\n2025-08-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.4\n\nCVSS v3.1 Base Score:\n8.2\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nAffected products do not properly restrict access permissions to a local Windows Named Pipe and do not properly sanitize user-controllable input sent to that Named Pipe. This could allow a local authenticated attacker to cause a type confusion and execute arbitrary code within the affected application and its privileges.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC PCS neo\n\nShow more details\n\nSIMATIC PCS neo V4.1\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V5.0\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is planned\n\nSee further", "language": "en" }, { "id": "E98", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "le.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC PCS neo\n\nShow more details\n\nSIMATIC PCS neo V4.1\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V5.0\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC PCS neo V6.0\n\nAll versions < V6.0 SP1 Update 1\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V6.0 SP1 Update 1 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110000357/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-PLCSIM V17\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is planned\n\nSee further recommenda", "language": "en" }, { "id": "E99", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "CODE ES V17\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.4\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109784441/\n\nSee further recommendations", "language": "en" }, { "id": "E100", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "ted by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.5\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V18\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations", "language": "en" }, { "id": "E101", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "4678\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109817218/\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V18\n\nAll versions < V6.3.0.2\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V6.3.0.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V19\n\nShow more details\n\nSIMATIC STEP 7 V19\n\nAll versions < V19 Updat", "language": "en" }, { "id": "E102", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "CODE ES V19\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.6\n\nAll versions < V5.6 SP1 HF7\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V5.6 SP1 HF7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989067/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V19\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations", "language": "en" }, { "id": "E103", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "ersions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2024-54678\n\nFixed with V5.2.1.1, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V20\n\nShow more details\n\nSIMATIC STEP 7 V20\n\nAll versions <", "language": "en" }, { "id": "E104", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "CODE ES V20\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.7\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V20\n\nAll versions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V20 (TIA Portal)\n\nAl", "language": "en" }, { "id": "E105", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "ersions\n\naffected by\n\nCVE-2024-54678\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V20\n\nAll versions < V5.2.2.2\n\naffected by\n\nCVE-2024-54678\n\nFixed with V5.2.2.2, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Test Suite V20\n\nAll versions < V20 Update 4\n\naffected by\n\nCVE-2024-54678\n\nUpdate to V20 Update 4 or later version", "language": "en" }, { "id": "E106", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "sourceField": "body:advisory", "excerpt": "SSA-765416\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n9.2\n\nSUMMARY\n\nRUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information.\n\nSiemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM CROSSBOW Station Access Controller (SAC)\n\nAll versions < V6.0\n\naffected by\n\nall CVEs\n\nCVE-2025-6965\n\nCVE-2026-11822\n\nCVE-2026-11824\n\nCVE-2025-70873\n\nCVE-2025-71316\n\nUpdate to V6.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006651/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general secu", "language": "en" }, { "id": "E107", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "sourceField": "body:advisory", "excerpt": "sion.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM CROSSBOW Station Access Controller (SAC)\n\nAll versions < V6.0\n\naffected by\n\nall CVEs\n\nCVE-2025-6965\n\nCVE-2026-11822\n\nCVE-2026-11824\n\nCVE-2025-70873\n\nCVE-2025-71316\n\nUpdate to V6.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006651/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP compliant access to Intelligent Electronic Devices.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-6965\n\nTher", "language": "en" }, { "id": "E108", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourceField": "body:advisory", "excerpt": "SSA-784472\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1.\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2024-58002\n\nCVE-2025-21844\n\nCVE-2024-26982\n\nCVE-2024-58079\n\nCVE-2025-21858\n\nCVE-2025-21865\n\nCVE-2025-21859\n\nCVE-2025-21862\n\nCVE-2025-21846\n\nCVE-2025-21864\n\nCVE-2025-21838\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-57977\n\nCVE-2025-21725\n\nCVE-2025-21806\n\nCVE-2024-58009\n\nCVE-2025-21767\n\nCVE-2025-21763\n\nCVE-2024-58077\n\nCVE-2024-58063\n\nCVE-2024-58013\n\nCVE-2025-21835\n\nCVE-2024-57979\n\nCVE-2025-21703\n\nCVE-2025-21735\n\nCVE-2025-21761\n\nCVE-2024-58071\n\nCVE-2025-21728\n\nCVE-2025-21738", "language": "en" }, { "id": "E109", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourceField": "body:advisory", "excerpt": "SSA-784472\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1.\n\nSiemens is preparing fixes and recommends specific", "language": "en" }, { "id": "E110", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourceField": "body:advisory", "excerpt": "SSA-794185\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products\n\nPublication Date:\n\n2025-05-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.4\n\nCVSS v3.1 Base Score:\n9.0\n\nCVSS v4.0 Base Score:\n9.1\n\nSUMMARY\n\nThis advisory documents the impact of CVE-2024-3596 (also dubbed \"Blastradius\"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products.\n\nThe vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an \"Access-Reject\" message into an \"Access-Accept\". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials).\n\nFurther details incl. external references can be found in the chapter \"Additional Information\".\nSiemens has released new versions for several affected products and recommends to update to the latest versions, and", "language": "en" }, { "id": "E111", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourceField": "body:advisory", "excerpt": "SSA-794185\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products\n\nPublication Date:\n\n2025-05-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.4\n\nCVSS v3.1 Base Score:\n9.0\n\nCVSS v4.0 Base Score:\n9.1\n\nSUMMARY\n\nThis advisory documents the impact of CVE-2024-3596 (also dubbed \"Blastradius\"), a vulnerability in the RADIUS protocol, to", "language": "en" }, { "id": "E112", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourceField": "body:advisory", "excerpt": "ion\" for details.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nCPC80 Central Processing/Communication\n\nAll versions < V16.51\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V16.51 or later version\n\nSee further recommendations from section\nMitigations\n\nCPCI85 Central Processing/Communication\n\nAll versions < V6.20\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V6.20 or later version\n\nSee further recommendations from section\nMitigations\n\nPOWER METER SICAM Q100 family\n\nAll versions < V2.70\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V2.70 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109743524/\n\nSee further recommendations from section\nMitigations\n\nPOWER METER SICAM Q200 family\n\nAll versions < V2.83\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V2.83 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109743592/\n\nSee further recommendations from section\nMitigations\n\nPowerlink IP\n\nAll versions < V4.23\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V4.23 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109986527/\n\nSee further recommendations from section\nMitigations\n\nSICAM GridPass\n\nAll versions < V2.50\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V2.50 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763384/\n\nSee further recommendations from section\nMitigations\n\nSICORE Base system\n\nAll versions < V2.20.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V2.20.0 or later version\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIPROTEC 5 - CP100 Devices\n\nShow more details\n\nSIPROTEC 5 7SA82 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SD82 (CP100)\n\nAll versions >= V7.80 < V8.90\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V8.90 or later V8.xx version\n\nhttps://", "language": "en" }, { "id": "E113", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourceField": "body:advisory", "excerpt": "See further recommendations from section\nMitigations\n\nExpand children\n\nSIPROTEC 5 - CP150 Devices\n\nShow more details\n\nSIPROTEC 5 7SA82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109757433/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SD82 (CP150)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siem", "language": "en" }, { "id": "E114", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourceField": "body:advisory", "excerpt": "or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109742950/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 6MD89 (CP300) V9.6x\n\nAll versions < V9.68\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V9.68 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109742950/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 6MU85 (CP300)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siem", "language": "en" }, { "id": "E115", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourceField": "body:advisory", "excerpt": "or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109768428/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7ST86 (CP300) V9.8x\n\nAll versions < V9.83\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V9.83 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109768428/\n\nSee further recommendations from section\nMitigations\n\nSIPROTEC 5 7SX85 (CP300)\n\nAll versions < V10.0\n\naffected by\n\nCVE-2024-3596\n\nUpdate to V10.0 or later version\n\nhttps://support.industry.siem", "language": "en" }, { "id": "E116", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html", "sourceField": "body:advisory", "excerpt": "he product does not support the RADIUS protocol. (Vulnerable Code Not Present)\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nConfigure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it\n\nRestrict access to the networks where RADIUS messages are exchanged (e.g., send RADIUS traffic via management network or a dedicated VLAN)\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nOperators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product", "language": "en" }, { "id": "E117", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "sourceField": "body:advisory", "excerpt": "SSA-794697\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1\n\nPublication Date:\n\n2023-06-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.9\n\nCVSS v3.1 Base Score:\n9.8\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.0.\n\nSiemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version.\n\nSIMATIC S7-1500 TM MFP V1.0 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nThis advisory lists vulnerabilities for firmware version V1.0 only; for V1.1 refer to Siemens Security Advisory SSA-265688 ( https://cert-portal.siemens.com/productcert/html/ssa-265688.html ).\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions < V1.1\n\naffected by\n\nall CVEs\n\nCVE-2021-3759\n\nCVE-2021-4037\n\nCVE-2021-33655\n\nCVE-2022-0171\n\nCVE-2022-1012\n\nCVE-2022-1015\n\nCVE-2022-1184\n\nCVE-2022-1292\n\nCVE-2022-1343\n\nCVE-2022-1434\n\nCVE-2022-1462\n\nCVE-2022-1473\n\nCVE-2022-167", "language": "en" }, { "id": "E118", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "sourceField": "body:advisory", "excerpt": "94697\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1\n\nPublication Date:\n\n2023-06-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.9\n\nCVSS v3.1 Base Score:\n9.8\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.0.\n\nSiemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends to update to the latest version.\n\nSIMATIC S7-1500 TM MFP V1.0 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nThis advisory lists vulnerabilities for", "language": "en" }, { "id": "E119", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "sourceField": "body:advisory", "excerpt": "cs/ww/en/view/109827684/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2022-4304\n\nDisable the use of RSA ciphers in the web server configuration; note that RSA ciphers are disabled by default\n\nCVE-2022-4450\n\nDo not import or configure certificate files in PEM format from untrusted sources\n\nCVE-2023-0286\n\nDisable CRL (certification revocation list) checking, if possible\n\nOnly build and run applications from trusted sources\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.", "language": "en" }, { "id": "E120", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "SSA-800126\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-800126: Deserialization Vulnerability in Siemens Engineering Platforms before V20\n\nPublication Date:\n\n2024-12-10\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n7.8\n\nCVSS v4.0 Base Score:\n8.4\n\nSUMMARY\n\nAffected products do not properly sanitize user-controllable input when parsing files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nSiemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter \"Additional Information\" below for more details.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-PLCSIM\n\nShow more details\n\nSIMATIC S7-PLCSIM V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSIMATIC", "language": "en" }, { "id": "E121", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "ixes are not, or not yet available.\n\nSiemens has released products based on the Totally Integrated Automation Portal (TIA Portal) V20 which are not affected by CVE-2024-49849. See the chapter \"Additional Information\" below for more details.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-PLCSIM\n\nShow more details\n\nSIMATIC S7-PLCSIM V16\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is planned\n\nSee further reco", "language": "en" }, { "id": "E122", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "CODE ES V17\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.4\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V17\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V17 (TIA Portal)\n\nAl", "language": "en" }, { "id": "E123", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "CODE ES V18\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.5\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V18\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIRIUS Safety ES V18 (TIA Portal)\n\nAl", "language": "en" }, { "id": "E124", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "ersions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V18\n\nAll versions < V6.3.0.2\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V6.3.0.2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal) V19\n\nShow more details\n\nSIMATIC STEP 7 Safety V19\n\nAll versions < V1", "language": "en" }, { "id": "E125", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "CODE ES V19\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMOTION SCOUT TIA V5.6\n\nAll versions < V5.6 SP1 HF7\n\naffected by\n\nCVE-2024-49849\n\nUpdate to V5.6 SP1 HF7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109989067/\n\nSee further recommendations from section\nMitigations\n\nSINAMICS Startdrive V19\n\nAll versions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations", "language": "en" }, { "id": "E126", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "ersions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2024-49849\n\nTIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that", "language": "en" }, { "id": "E127", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourceField": "body:advisory", "excerpt": "SSA-832641\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.1\n\nCVSS v4.0 Base Score:\n8.9\n\nSUMMARY\n\nSiemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge Cloud Device (IECD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28.1/industrial-edge-virtual/cloud-device/release-notes\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Own Device (IEOD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1 or later version\n\nhttps://docs.industrial-operations-x.s", "language": "en" }, { "id": "E128", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourceField": "body:advisory", "excerpt": "r not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge Cloud Device (IECD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28.1/industrial-edge-virtual/cloud-device/release-notes\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Own Device (IEOD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1 or", "language": "en" }, { "id": "E129", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourceField": "body:advisory", "excerpt": "el PRO family\n\nShow more details\n\nSIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0)\n\nAll versions\n\naffected by\n\nCVE-2026-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMiti", "language": "en" }, { "id": "E130", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourceField": "body:advisory", "excerpt": "6-44415\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2)\n\nAll versions < V1.28.1-2\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1-2 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28/one-db-simatic-iot2050-industrial-edge-device/all-release-notes/release-notes-v1.28\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2)\n\nAl", "language": "en" }, { "id": "E131", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourceField": "body:advisory", "excerpt": "edge-device/all-release-notes/release-notes-v1.28\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC127E Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V3.2.0-17 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v3.2/simatic-ipc-ied-os/all-release-notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC227E Industrial Edge Device\n\nAll versions < V3.2.0-17\n\naffected b", "language": "en" }, { "id": "E132", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourceField": "body:advisory", "excerpt": "notes/release-notes-v3.2\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nEnsure network access to affected products is limited to trusted parties only\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nIndustrial Edge Cloud Device (IECD) offers you the Industrial Edge Device functionality on demand and without the need of dedicated physical hardware devices.\n\nIndustrial Edge Own Device (IEOD) offers the Industrial Edge functio", "language": "en" }, { "id": "E133", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "sourceField": "body:advisory", "excerpt": "SSA-858251\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-858251: Authentication Bypass Vulnerabilities in OPC UA\n\nPublication Date:\n\n2025-03-11\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n9.1\n\nSUMMARY\n\nThe products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge for Machine Tools (formerly known as \"SINUMERIK Edge\")\n\nAll versions\n\naffected by\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC Energy Manager PRO\n\nShow more details\n\nSIMATIC Energy Manager PRO V7.2\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nSIMATIC Energy Manager PRO V7.3\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nSIMATIC Energy Manager PRO V7.4\n\nAll versions >= V7.4 Update 0 < V7.4 Update 7\n\naffe", "language": "en" }, { "id": "E134", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "sourceField": "body:advisory", "excerpt": "Un-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge for Machine Tools (formerly known as \"SINUMERIK Edge\")\n\nAll versions\n\naffected by\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC Energy Manager PRO\n\nShow more details\n\nSIMATIC Energy Manager PRO V7.2\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nSIMATIC Energy Manager PRO V7.3\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nSIMATIC Energy Manager PRO V7.4\n\nAll versions >= V7.4 Update 0 < V7.4 Update 7\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nUpdate to V7.4 Update 7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109997044/\n\nSIMATIC Energy Manager PRO V7.5\n\nAll versions >= V7.5 Update 0 < V7.5 Update 2\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nUpdate to V7.5 Update 2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109996728/\n\nSIMATIC IPC DiagMonitor\n\nAll versions\n\naffected by\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nPlease note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default. Systems running with default configuration are therefore not affected by this vulnerability.\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 3\n\naffected by\n\nCVE-2024-42513\n\nUpdate to V8.0 Update 3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSIMIT V11\n\nAll versions < V11.3\n\naffected by\n\nCVE-2024-42512\n\nUpdate to V11.3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987184/\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nSIMATIC WinCC Unified V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-42513\n\nUpdate to V18 Update", "language": "en" }, { "id": "E135", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "sourceField": "body:advisory", "excerpt": "oduct does not expose an HTTPS endpoint. (Vulnerable Code Not in Execute Path)\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nIndustrial Edge represents an open, ready-to-use Edge computing platform consisting of Edge devices, Edge apps, Edge connectivity, and an application and device management infrastructure.\n\nSIMATIC BRAUMAT / SISTAR are industry-specific control systems especially for the control and monitoring of recipe-controlled production processes such as in the food, beverages and tobacco industries as well as for compar", "language": "en" }, { "id": "E136", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourceField": "body:advisory", "excerpt": "SSA-864900\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2025-05-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.1\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nRUGGEDCOM APE1808\n\nShow more details\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.9\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-52963\n\nCVE-2024-32122\n\nCVE-2024-50562\n\nCVE-2025-22862\n\nCVE-2025-24471\n\nCVE-2025-25250\n\nCVE-2024-55599\n\nCVE-2025-25248\n\nCVE-2025-53744\n\nCVE-2025-57740\n\nCVE-2025-58903\n\nCVE-2025-31366\n\nCVE-2025-47890\n\nCVE-2025-25253\n\nCVE-2025-58413\n\nCVE-2025-53843\n\nCVE-2025-59718\n\nCVE-2025-59719\n\nCVE-2025-25249\n\nUpdate Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nSee further recommendati", "language": "en" }, { "id": "E137", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourceField": "body:advisory", "excerpt": "SSA-864900\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2025-05-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.1\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens has relea", "language": "en" }, { "id": "E138", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourceField": "body:advisory", "excerpt": "pse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nRUGGEDCOM APE1808\n\nShow more details\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.9\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-52963\n\nCVE-2024-32122\n\nCVE-2024-50562\n\nCVE-2025-22862\n\nCVE-2025-24471\n\nCVE-2025-25250\n\nCVE-2024-55599\n\nCVE-2025-25248\n\nCVE-2025-53744\n\nCVE-2025-57740\n\nCVE-2025-58903\n\nCVE-2025-31366\n\nCVE-2025-47890\n\nCVE-2025-25253\n\nCVE-2025-58413\n\nCVE-2025-53843\n\nCVE-2025-59718\n\nCVE-2025-59719\n\nCV", "language": "en" }, { "id": "E139", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourceField": "body:advisory", "excerpt": "ive detailed information\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2024-52963\n\nUnder the config vpn ipsec phase1-interface configuration, either set authmethod to psk, or set digital-signature-auth to disable (see https://fortiguard.fortinet.com/psirt/FG-IR-24-373 )\n\nCVE-2025-25249\n\nFor each interface, remove \"fabric\" access (see https://fortiguard.fortinet.com/psirt/FG-IR-25-084 )\n\nCVE-2025-53843\n\nDisable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs (see https://fortiguard.fortinet.com/psirt/FG-IR-25-358 for more information)\n\nCVE-2025-58413\n\nDisable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs . Remove inter-controller-peer elements in config wireless-controller inter-controller configuration. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-632 for more information)\n\nCVE-2025-59718\n\nTo prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fo", "language": "en" }, { "id": "E140", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "sourceField": "body:advisory", "excerpt": "SSA-911336\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n7.5\n\nCVSS v4.0 Base Score:\n6.4\n\nSUMMARY\n\nNozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC . This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nSiemens recommends to contact customer support to receive patch and update information.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM APE1808\n\nAll versions with Nozomi Guardian/CMC\n\naffected by\n\nall CVEs\n\nCVE-2026-33387\n\nCVE-2026-33391\n\nCVE-2026-33920\n\nCVE-2026-33388\n\nCVE-2026-33389\n\nContact customer support to receive patch and update information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protect", "language": "en" }, { "id": "E141", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "sourceField": "body:advisory", "excerpt": "FFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nRUGGEDCOM APE1808\n\nAll versions with Nozomi Guardian/CMC\n\naffected by\n\nall CVEs\n\nCVE-2026-33387\n\nCVE-2026-33391\n\nCVE-2026-33920\n\nCVE-2026-33388\n\nCVE-2026-33389\n\nContact customer support to receive patch and update information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly rec", "language": "en" }, { "id": "E142", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceField": "body:advisory", "excerpt": "SSA-967325\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS before V11.2.10-h7 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-05-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n9.3\n\nSUMMARY\n\nPalo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications.\n\n[1] https://security.paloaltonetworks.com/\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nRUGGEDCOM APE1808\n\nShow more details\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with User-ID™ Authentication Portal configured and interface management profile with response pages enabled\n\naffected by\n\nCVE-2026-0300\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee furth", "language": "en" }, { "id": "E143", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceField": "body:advisory", "excerpt": "with Palo Alto Networks Virtual NGFW with User-ID™ Authentication Portal configured and interface management profile with response pages enabled\n\naffected by\n\nCVE-2026-0300\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-0256\n\nCVE-2026-0261\n\nCVE-2026-0262\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists\n\naffected by\n\nCVE-2026-0257\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h7. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with a PAN-OS Site-to-Site VPN Gateway with IKEv2 configured\n\naffected by\n\nCVE-2026-0258\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with DNS Proxy enabled and a network proxy attached\n\naffected by\n\nCVE-2026-0264\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with Authentication Profile with CAS enabled and Authentication profile is attached to a login interface\n\naffected by\n\nCVE-2026-0265\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW\n\naffected by\n\nCVE-2026-0269\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h7. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with URL filtering enabled and a customized response page\n\naffected by\n\nCVE-2026-0301\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h7 or later versions. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2026-0", "language": "en" }, { "id": "E144", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "sourceField": "body:advisory", "excerpt": "SSA-968435\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-968435: Multiple Vulnerabilities in Industrial Edge App Publisher\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n8.3\n\nCVSS v4.0 Base Score:\n7.7\n\nSUMMARY\n\nThe Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration.\n\nSiemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge App Publisher\n\nAll versions < V1.27.9\n\naffected by\n\nall CVEs\n\nCVE-2026-78556\n\nCVE-2026-78557\n\nUpdate to V1.27.9 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/develop_an_application/ieap/download_the_ie_ap.html\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURI", "language": "en" }, { "id": "E145", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "sourceField": "body:advisory", "excerpt": "ate to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge App Publisher\n\nAll versions < V1.27.9\n\naffected by\n\nall CVEs\n\nCVE-2026-78556\n\nCVE-2026-78557\n\nUpdate to V1.27.9 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/develop_an_application/ieap/download_the_ie_ap.html\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMEND", "language": "en" }, { "id": "E146", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "sourceField": "body:advisory", "excerpt": "SSB-091449\n\nSiemens Security Bulletin by Siemens ProductCERT\n\nSSB-091449: SIMATIC S7 PLCs and Related Products: Per-Variable HMI/OPC UA/Web API Access Attributes Not Enforced on PG/HMI Communication\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nSUMMARY\nSiemens became aware of a documentation ambiguity affecting SIMATIC S7 PLCs and related products [1]. SIMATIC S7 PLCs use two distinct, channel-specific security models: PLC protection levels govern PG/HMI access, while the per-variable access attributes \"Accessible from HMI/OPC UA/Web API\" and \"Writable from HMI/OPC UA/Web API\" govern OPC UA/Web API access. The TIA Portal documentation does not sufficiently explain this distinction. Operators who are unaware of it may draw incorrect conclusions about the access control boundaries across communication channels.\n\nSiemens recommends that customers ensure secure access protection is configured as documented in the relevant product documentation, e.g.:\n\nSIMATIC S7-1500/ET 200MP System Manual (Sections 4.9 and 11.6)\n\nSIMATIC S7-1200 G2 System Manual (Section 2.9 and 6.5)\n\nSINUMERIK ONE Configuration Manual (Section 11.7.2 or 11.10)\n\nISSUE DESCRIPTION\nTIA Portal supports configuration of below attribute", "language": "en" }, { "id": "E147", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourceField": "section:概要", "excerpt": "Siemensから各製品向けのアドバイザリが公表されました。", "language": "ja" }, { "id": "E148", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourceField": "section:影響を受けるシステム", "excerpt": "Siemensのアドバイザリを参照してください。", "language": "ja" }, { "id": "E149", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourceField": "section:詳細情報", "excerpt": "新規：18件\n\nSSA-055299: Out-of-bounds Read Vulnerability in Capital Embedded AR Classic\n\nSSB-091449: SIMATIC S7 PLCs and Related Products: Per-Variable HMI/OPC UA/Web API Access Attributes Not Enforced on PG/HMI Communication\n\nSSA-099819: Denial of Service Vulnerability in SENTRON 3NA COM Fuse\n\nSSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL\n\nSSA-159454: Hard-coded Key Vulnerability in SIMATIC IPCs\n\nSSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products\n\nSSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit\n\nSSA-390352: Multiple Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API\n\nSSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7\n\nSSA-508506: Multiple Vulnerabilities in RUGGEDCOM CROSSBOW\n\nSSA-550198: Authenticated Remote Code Execution in WinCC\n\nSSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server\n\nSSA-765416: Multiple SQLite Vulnerabilities in RUGGEDCOM CROSSBOW Station Access Controller\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nSSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices\n\nS", "language": "ja" }, { "id": "E150", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourceField": "section:想定される影響", "excerpt": "Siemensのアドバイザリを参照してください。", "language": "ja" }, { "id": "E151", "sourceUrl": "https://jvn.jp/vu/JVNVU90141693/", "sourceField": "section:対策方法", "excerpt": "Siemensのアドバイザリを参照してください。", "language": "ja" }, { "id": "E152", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-055299.html", "sourceField": "body:advisory", "excerpt": "o V2303 or later version\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nApply network segmentation and put the ECUs behind properly configured gateways/firewalls\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nCapital Embedded AR Classic (formerly called Capital VSTAR), is a scalable AUTOSAR Classic software platform that meets ISO 26262 use cases for up to ASIL D. Versions are available for several recent AUTOSAR Classic", "language": "en" }, { "id": "E153", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html", "sourceField": "body:advisory", "excerpt": "VE-2026-0310\n\nContact customer support to receive patch and update information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific", "language": "en" }, { "id": "E154", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "sourceField": "body:advisory", "excerpt": "SSA-127084\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-08-11\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.1\n\nCVSS v3.1 Base Score:\n8.1\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens recommends to contact customer suppo", "language": "en" }, { "id": "E155", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html", "sourceField": "body:advisory", "excerpt": "mmendation procedure. Contact customer support to receive detailed information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific", "language": "en" }, { "id": "E156", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "sourceField": "body:advisory", "excerpt": "t and Versions\nRemediation\n\nExpand children\n\nSIMATIC IPC family\n\nShow more details\n\nSIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G\n\nAll versions < V28.01.15\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V28.01.15 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC BX-21A\n\nAll versions < V31.01.13\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V31.01.13 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nSIMATIC IPC RW-543A\n\nAll versions < V1.1.4\n\naffected by\n\nCVE-2026-72895\n\nUpdate to V1.1.4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nNote: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nAs a temporary mitigation, users can manually remove the test key from the database (e.g., \"DO NOT TRUST - AMI Test PK\" for RW-543A or \"insyde-ElkhartLake\" for IPC227G/277G/327G/377G and BX-21A). Note: Loading default settings will restore the test key, so upgrading remains recommended.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC IPC (Indus", "language": "en" }, { "id": "E157", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "sourceField": "body:advisory", "excerpt": "Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nLOGO! V8.4 BM\n\nShow more details\n\nLOGO! 12/24RCE (6ED1052-1MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 12/24RCEo (6ED1052-2MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-202", "language": "en" }, { "id": "E158", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "sourceField": "body:advisory", "excerpt": "cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2025-40815\n\nProtect the LSC access to the device with a strong password.\n\nCVE-2025-40816\n\nRestrict network access to port 10006/udp to trusted IP addresses.\n\nCVE-2025-40817\n\nRestrict network access to port 10006/udp to trusted IP addresses.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSiemens LOGO! BM (Base Module) devices are used for basic sma", "language": "en" }, { "id": "E159", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "ODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nAutomation License Manager\n\nShow more details\n\nAutomation License Manager V6.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAutomation License Manager V6.2\n\nAll versions < V6.2 Upd3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.2 Upd3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/114358/\n\nSee further recommendations from section\nMitigations\n\nCEMAT V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nCP PtP Param configuring interface\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nCreate MyConfig (CMC)\n\nAll versions < V6.9\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109955311/\n\nSee further recommendations from section\nMitigations\n\nEnergy Support Library (EnSL)\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nFM Configuration Package\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nModular PID CTRL Tool\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nMultiFieldbus Configuration Tool (MFCT)\n\nAll versions < V1.5.5.0\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V1.5.5.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109773881/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nOpenPCS 7\n\nShow more details\n\nOpenPCS 7 V9.1\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nOpenPCS 7 V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSiemens Network Planner (SINETPLAN)\n\nAll versions < V2.0 SP2\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V2.0 SP2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110002597/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Automation Tool\n\nAll versions < V5.0 SP4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V5.0 SP4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110004631/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Automation Tool SDK Windows\n\nAll versions < V5.0 SP4\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V5.0 SP4 or later version\n\nhttps:/", "language": "en" }, { "id": "E160", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-333035.html", "sourceField": "body:advisory", "excerpt": ".8.21 or later version\n\nhttps://partnerportal.extranet.dc.siemens.com/\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC00-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC00-U\n\nAll versions >= V2.3\n\naffected by\n\nCVE-2026-89208\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nDesigo PXC001-E.D\n\nAll versions >= V2.3\n\naffected by\n\nCV", "language": "en" }, { "id": "E161", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-377139.html", "sourceField": "body:advisory", "excerpt": "fixes are not, or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge Device Kit - arm64 V1.5\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.6\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.7\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Device Kit - arm64 V1.8\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-44414\n\nCVE-2026-44415\n\nCurrently no fix is planned\n\nSee further recommendations", "language": "en" }, { "id": "E162", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceField": "body:advisory", "excerpt": "ilable\n\nSIRIUS Soft Starter ES V19 (TIA Portal)\n\nAll versions\n\naffected by\n\nCVE-2024-52051\n\nCurrently no fix is available\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2024-52051\n\nTIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMATIC STEP 7 Safety Basic / Advanced is the high-performance add-on package for programming of fail-safe S7 controllers for the Totally Integrated Automation Portal\n\nSIMATIC WinCC Unified", "language": "en" }, { "id": "E163", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "sourceField": "body:advisory", "excerpt": ".siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.0 < V3.1.5\n\naffected by\n\nall CVEs\n\nCVE-2023-45871\n\nCVE-2023-45853\n\nCVE-2023-45322\n\nCVE-2013-0340\n\nCVE-2013-4235\n\nCVE-2014-7209\n\nCVE-2015-20107\n\nCVE-2022-37454\n\nCVE-2022-43680\n\nCVE-2022-45061\n\nCVE-2019-19242\n\nCVE-2019-19244\n\nCVE-2019-19317\n\nCVE-2019-19603\n\nCVE-2019-19645\n\nCVE-2019-19646\n\nCVE-2019-19880\n\nCVE-2019-19923\n\nCVE-2019-19924\n\nCVE-2019-19925\n\nCVE-2019-19926\n\nCVE-2019-19959\n\nCVE-2019-20218\n\nCVE-2016-10228\n\nCVE-2020-10029\n\nCVE-2020-1752\n\nCVE-2020-6096\n\nCVE-2016-10739\n\nCVE-2019-6488\n\nCVE-2016-3189\n\nCVE-2019-12900\n\nCVE-2021-28363\n\nCVE-2021-45960\n\nCVE-2022-0778\n\nCVE-2022-25235\n\nCVE-2022-25236\n\nCVE-2022-25313\n\nCVE-2022-25314\n\nCVE-2022-25315\n\nCVE-2022-26488\n\nCVE-2016-3709\n\nCVE-2022-29824\n\nCVE-2016-4658\n\nCVE-2016-5131\n\nCVE-2016-9318\n\nCVE-2017-0663\n\nCVE-2017-9047\n\nCVE-2017-9048\n\nCVE-2017-9049\n\nCVE-2017-9050\n\nCVE-2017-16931\n\nCVE-2017-16932\n\nCVE-2017-17512\n\nCVE-2017-18258\n\nCVE-2017-7375\n\nCVE-2017-7376\n\nCVE-2018-0495\n\nCVE-2019-12904\n\nCVE-2019-13627\n\nCVE-2018-12886\n\nCVE-2018-14404\n\nCVE-2018-14567\n\nCVE-2018-19591\n\nCVE-2018-20482\n\nCVE-2018-20843\n\nCVE-2018-25032\n\nCVE-2019-1010022\n\nCVE-2019-1010023", "language": "en" }, { "id": "E164", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceField": "body:advisory", "excerpt": "l versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nConnector for Azure\n\nAll versions < V1.8.0\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V1.8.0 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nDatabus\n\nAll versions < V3.3.2\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.3.2 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nHiMed Cockpit\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9403 (6GK5998-3GS00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9413 (6GK5998-3GS01-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9433 (6GK5998-3GS11-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE M-800 family (incl. S615,", "language": "en" }, { "id": "E165", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "ersions\n\naffected by\n\nCVE-2025-40759\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V20\n\nAll versions < V5.2.2.2\n\naffected by\n\nCVE-2025-40759\n\nFixed with V5.2.2.2, no user action required\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly open projects from trusted sources.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMOCODE ES is the central software package", "language": "en" }, { "id": "E166", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "sourceField": "body:advisory", "excerpt": "s://kaco-newenergy.com/service/mykacocom-customer-portal\n\nKNOWN NOT AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nKnown Not Affected Products\nReason\n\nblueplanet 3.0 NX3-20.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 3.0-5.0 NX1\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 25.0 NX3-33.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 50.0 NX3-60.0 NX3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet 360 NX3 M6\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet hybrid 6.0 NH3-12.0 NH3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nblueplanet hybrid 10.0 TL3\n\nAll versions\n\nnot affected by\n\nall CVEs\n\nCVE-2025-40946\n\nCVE-2026-41125\n\nDifferent code base compared to affected products. (Component Not Present)\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nOperators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment.\nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechan", "language": "en" }, { "id": "E167", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "sourceField": "body:advisory", "excerpt": "ilable.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC WinCC\n\nShow more details\n\nSIMATIC WinCC V7.5\n\nAll versions\n\naffected by\n\nCVE-2026-59241\n\nCurrently no fix is available\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 11\n\naffected by\n\nCVE-2026-59241\n\nUpdate to V8.0 Update 11 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSIMATIC WinCC V8.1\n\nAll versions < V8.1 Update 7\n\naffected by\n\nCVE-2026-59241\n\nUpdate to V8.1 Update 7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109977191/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC WinCC is a supervisory control and data acquisition (SCADA) system.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-59241\n\nThe affected application does not sufficiently restrict the permis", "language": "en" }, { "id": "E168", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "sourceField": "body:advisory", "excerpt": "KNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)\n\nAll versions < V1.3.1\n\naffected by\n\nCVE-2025-43715\n\nUpdate to V1.3.1 or later version\n\nTo obtain the patch and update information, please contact your regular Siemens contact person.\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109804905/\n\nSee further recommendations from section\nMitigations\n\nSIMOTION OA MIIF (6AU1820-3DA20-0AB0)\n\nA", "language": "en" }, { "id": "E169", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-563922.html", "sourceField": "body:advisory", "excerpt": "rently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nEnsure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC Technology Package TPCamGen is part of the software package SIMATIC SimaPressServo. It determines optimized motion profiles for servo presses in which the too", "language": "en" }, { "id": "E170", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "sourceField": "body:advisory", "excerpt": "ploitation and how to detect it.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSiemens Software Center\n\nAll versions < V4.0.9.8\n\naffected by\n\nCVE-2026-110936\n\nUpdate to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link)\n\nhttps://www.sw.siemens.com/en-US/siemens-software-center/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSiemens Software Center allows you to download, install, and activate purchased software. You can also update your software as new versions become available and launch free trials.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabi", "language": "en" }, { "id": "E171", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-591731.html", "sourceField": "body:advisory", "excerpt": "-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0)\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC ET 200SP Open Controller (incl. SIPLUS variants)\n\nShow more details\n\nExpand children\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)\n\nShow more details\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354\n\nCVE-2026-63355\n\nCVE-2026-63356\n\nCVE-2026-63357\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs\n\nShow more details\n\nSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2026-63350\n\nCVE-2026-63351\n\nCVE-2026-63352\n\nCVE-2026-63353\n\nCVE-2026-63354", "language": "en" }, { "id": "E172", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "IC Field PG\n\nShow more details\n\nSIMATIC Field PG M5\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nSIMATIC Field PG M6\n\nAll versions < V26.01.14\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V26.01.14 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nExpand children\n\nSIMATIC IPC family\n\nShow more details\n\nSIMATIC IPC227E\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nSIMATIC IPC277E\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC IPC427E / IPC477E / IPC477E PRO\n\nShow more details\n\nSIMATIC IPC427E\n\nAll versions < V21.01.20\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V21.01.20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC477E\n\nAll versions < V21.01.20\n\naffected by\n\nCVE-2025-2884\n\nUpdate to V21.01.20 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109763408/\n\nSIMATIC IPC477E P", "language": "en" }, { "id": "E173", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html", "sourceField": "body:advisory", "excerpt": "cs/ww/en/view/109963851/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOn Desktop systems: Execute affected software on Windows hosts where only a single user is configured\n\nOn Server systems: Reduce the access on operating system level to administrators only\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC PCS neo is a distributed control system (DCS).\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other", "language": "en" }, { "id": "E174", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourceField": "body:advisory", "excerpt": "ntly no fix is available\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly build and run applications from trusted sources.\n\nLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-1500 TM MFP is a Technology module Multi functional platform for SIMATIC S7-1500 PLCs based on SIMATIC Industrial OS\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this sec", "language": "en" }, { "id": "E175", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "sourceField": "body:advisory", "excerpt": "94697\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-794697: Vulnerabilities in the Additional GNU/Linux Subsystem of the SIMATIC S7-1500 TM MFP Before V1.1\n\nPublication Date:\n\n2023-06-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.9\n\nCVSS v3.1 Base Score:\n9.8\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.0.\n\nSiemens has released a new version for SIMATIC S7-1500 TM MFP - GNU/Linux subsys", "language": "en" }, { "id": "E176", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "ersions\n\naffected by\n\nCVE-2024-49849\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nTIA Portal Cloud V19\n\nAll versions < V5.2.1.1\n\naffected by\n\nCVE-2024-49849\n\nTIA Portal Cloud V5.2.1.1 or later version updated TIA Portal to V19 Update 4 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nAvoid opening untrusted files from unknown sources in affected products\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMATIC STEP", "language": "en" }, { "id": "E177", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-832641.html", "sourceField": "body:advisory", "excerpt": "r not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge Cloud Device (IECD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026-44414\n\nUpdate to V1.28.1 or later version\n\nhttps://docs.industrial-operations-x.siemens.cloud/r/en-us/v1.28.1/industrial-edge-virtual/cloud-device/release-notes\n\nSee further recommendations from section\nMitigations\n\nIndustrial Edge Own Device (IEOD)\n\nAll versions < V1.28.1\n\naffected by\n\nCVE-2026", "language": "en" }, { "id": "E178", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-858251.html", "sourceField": "body:advisory", "excerpt": "versions\n\naffected by\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nExpand children\n\nSIMATIC Energy Manager PRO\n\nShow more details\n\nSIMATIC Energy Manager PRO V7.2\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nSIMATIC Energy Manager PRO V7.3\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nSIMATIC Energy Manager PRO V7.4\n\nAll versions >= V7.4 Update 0 < V7.4 Update 7\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nUpdate to V7.4 Update 7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109997044/\n\nSIMATIC Energy Manager PRO V7.5\n\nAll versions >= V7.5 Update 0 < V7.5 Update 2\n\naffected by\n\nall CVEs\n\nCVE-2024-42512\n\nCVE-2024-42513\n\nUpdate to V7.5 Update 2 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109996728/\n\nSIMATIC IPC DiagMonitor\n\nAll versions\n\naffected by\n\nCVE-2024-42513\n\nCurrently no fix is planned\n\nPlease note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default. Systems running with default configuration are therefore not affected by this vulnerability.\n\nSIMATIC WinCC V8.0\n\nAll versions < V8.0 Update 3\n\naffected by\n\nCVE-2024-42513\n\nUpdate to V8.0 Update 3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109818723/\n\nSIMIT V11\n\nAll versions < V11.3\n\naffected by\n\nCVE-2024-42512\n\nUpdate to V11.3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109987184/\n\nExpand children\n\nTotally Integrated Automation Portal (TIA Portal)\n\nShow more details\n\nSIMATIC WinCC Unified V18\n\nAll versions < V18 Update 6\n\naffected by\n\nCVE-2024-42513\n\nUpdate to V18 Update", "language": "en" }, { "id": "E179", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-911336.html", "sourceField": "body:advisory", "excerpt": "E-2026-33389\n\nContact customer support to receive patch and update information\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific", "language": "en" }, { "id": "E180", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceField": "body:advisory", "excerpt": "SSA-967325\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS before V11.2.10-h7 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2026-05-12\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.3\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n9.3\n\nSUMMARY\n\nPalo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affec", "language": "en" }, { "id": "E181", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceField": "body:advisory", "excerpt": "hentication Portal configured and interface management profile with response pages enabled\n\naffected by\n\nCVE-2026-0300\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-0256\n\nCVE-2026-0261\n\nCVE-2026-0262\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Co", "language": "en" }, { "id": "E182", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceField": "body:advisory", "excerpt": "h and update information\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2026-0257\n\nUse a dedicated certificate for Authentication Override cookies\n\nDisable Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration\n\nCVE-2026-0264\n\nDisassociate DNS Proxy from externally accessible interfaces and configure DNS server with a RFC1918 or a public trusted IP address\n\nDisable the DNS Proxy feature (Network > DNS Proxy) if it is not being used and configure DNS server with a RFC1918 or a public trusted IP address\n\nCVE-2026-0300\n\nRestrict access to the User-ID Authentication Portal to trusted internal IP addresses only\n\nDisable Response Pages in the Interface Management Profile attached to every L3 interface in any zone where untrusted/internet traffic can ingress. Keep Response Pages enabled only on interfaces in trust/internal zones where legitimate users' browsers ingress\n\nDisable User-ID™ Authentication Portal if not required\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendation", "language": "en" }, { "id": "E183", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "sourceField": "body:advisory", "excerpt": "ate to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nIndustrial Edge App Publisher\n\nAll versions < V1.27.9\n\naffected by\n\nall CVEs\n\nCVE-2026-78556\n\nCVE-2026-78557\n\nUpdate to V1.27.9 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/develop_an_application/ieap/download_the_ie_ap.html\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nIndustrial Edge App Publisher packages Docker images into Industrial Edge Apps for deployment on Industrial Edge Devices\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-78556\n\nThe affected software", "language": "en" }, { "id": "E184", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssb-091449.html", "sourceField": "body:advisory", "excerpt": "mers ensure secure access protection is configured as documented in the relevant product documentation, e.g.:\n\nSIMATIC S7-1500/ET 200MP System Manual (Sections 4.9 and 11.6)\n\nSIMATIC S7-1200 G2 System Manual (Section 2.9 and 6.5)\n\nSINUMERIK ONE Configuration Manual (Section 11.7.2 or 11.10)\n\nISSUE DESCRIPTION\nTIA Portal supports configuration of below attribute properties for local tags and constants for SIMATIC S7 PLCs and related products:\n\n\"Accessible from HMI/OPC UA/Web API\" — controls whether a variable is visible to clients on HMI/OPC UA/Web API\n\n\"Writable from HMI/OPC UA/Web API\" — controls wheth", "language": "en" }, { "id": "E185", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-267056.html", "sourceField": "body:advisory", "excerpt": "d Versions\nRemediation\n\nExpand children\n\nLOGO! V8.4 BM\n\nShow more details\n\nLOGO! 12/24RCE (6ED1052-1MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.84.05 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006452/\n\nSee further recommendations from section\nMitigations\n\nLOGO! 12/24RCEo (6ED1052-2MD08-0BA2)\n\nAll versions < V1.84.05\n\naffected by\n\nall CVEs\n\nCVE-2025-40815\n\nCVE-2025-40816\n\nCVE-2025-40817\n\nUpdate to V1.8", "language": "en" }, { "id": "E186", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html", "sourceField": "body:advisory", "excerpt": "25-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nAutomation License Manager V6.2\n\nAll versions < V6.2 Upd3\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.2 Upd3 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/114358/\n\nSee further recommendations from section\nMitigations\n\nCEMAT V10.0\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nCP PtP Param configuring interface\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nCreate MyConfig (CMC)\n\nAll versions < V6.9\n\naffected by\n\nCVE-2025-30033\n\nUpdate to V6.9 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109955311/\n\nSee further recommendations from section\nMitigations\n\nEnergy Support Library (EnSL)\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nFM Configuration Package\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nModular PID CTRL Tool\n\nAll versions\n\naffected by\n\nCVE-2025-30033\n\nCurrently no fix is available\n\nSee further r", "language": "en" }, { "id": "E187", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html", "sourceField": "body:advisory", "excerpt": "cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly open projects from trusted sources.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMOCODE ES is the central software package", "language": "en" }, { "id": "E188", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceField": "body:advisory", "excerpt": "with Palo Alto Networks Virtual NGFW with User-ID™ Authentication Portal configured and interface management profile with response pages enabled\n\naffected by\n\nCVE-2026-0300\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-0256\n\nCVE-2026-0261\n\nCVE-2026-0262\n\nUp", "language": "en" }, { "id": "E189", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceField": "body:advisory", "excerpt": "with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists\n\naffected by\n\nCVE-2026-0257\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h7. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with a PAN-OS Site-to-Site VPN Gateway with IKEv2 configured\n\naffected by\n\nC", "language": "en" }, { "id": "E190", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html", "sourceField": "body:advisory", "excerpt": "rom section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with DNS Proxy enabled and a network proxy attached\n\naffected by\n\nCVE-2026-0264\n\nUpgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Palo Alto Networks Virtual NGFW with Authentication Profile with CAS enabled and Authentication profile is a", "language": "en" }, { "id": "E191", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-099819.html", "sourceField": "body:advisory", "excerpt": "r later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109797242/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSENTRON 3NA COM, the first NH fuse with current direction detection, delivers overload protection and measurement data for grid stability and faster fault diagnosis.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulner", "language": "en" }, { "id": "E192", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html", "sourceField": "body:advisory", "excerpt": "date to V22.5 Update 5 or later version\n\nhttps://www.simtec.cc/en/updates.aspx\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nOperators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechan", "language": "en" }, { "id": "E193", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html", "sourceField": "body:advisory", "excerpt": "sioned again afterwards.\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nAs a temporary mitigation, users can manually remove the test key from the database (e.g., \"DO NOT TRUST - AMI Test PK\" for RW-543A or \"insyde-ElkhartLake\" for IPC227G/277G/327G/377G and BX-21A). Note: Loading default settings will restore the test key, so upgrading remains recommended.\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC IPC (Indus", "language": "en" }, { "id": "E194", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-390352.html", "sourceField": "body:advisory", "excerpt": "sion\n\nhttps://github.com/siemens/simatic-s7-webserver-api/releases/tag/v3.3.62\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-85114\n\nAffected applications do not properly validate filenames received from remote servers during ticket downloads.\n\nThis could allow an attacker who can manipulate the", "language": "en" }, { "id": "E195", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-392859.html", "sourceField": "body:advisory", "excerpt": "r later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109794456/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMATIC STEP 7 Safety Basic / Advanced is the high-performance add-on package for programming of fail-safe S7 controllers for the Totally Integrated Automation Portal\n\nSIMATIC WinCC Unified", "language": "en" }, { "id": "E196", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "sourceField": "body:advisory", "excerpt": "25-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nConnector for Azure\n\nAll versions < V1.8.0\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V1.8.0 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nDatabus\n\nAll versions < V3.3.2\n\naffected by\n\nCVE-2025-15467\n\nUpdate to V3.3.2 or later version\n\nhttps://docs.eu1.edge.siemens.cloud/release_notes/scope_of_delivery/scope_of_delivery.html\n\nSee further recommendations from section\nMitigations\n\nHiMed Cockpit\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9403 (6GK5998-3GS00-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9413 (6GK5998-3GS01-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nSCALANCE LPE9433 (6GK5998-3GS11-2AC2)\n\nAll versions\n\naffected by\n\nCVE-2025-15467\n\nCurrently no fix is planned\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSCALANCE M-800 family (incl. S615,", "language": "en" }, { "id": "E197", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html", "sourceField": "body:advisory", "excerpt": "r later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006651/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP compliant access to Intelligent Electronic Devices.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-89196\n\nAff", "language": "en" }, { "id": "E198", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-545643.html", "sourceField": "body:advisory", "excerpt": "25\n\nDifferent code base compared to affected products. (Component Not Present)\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nOperators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment.\nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechan", "language": "en" }, { "id": "E199", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-550198.html", "sourceField": "body:advisory", "excerpt": "r later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109977191/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC WinCC is a supervisory control and data acquisition (SCADA) system.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-59241\n\nThe affected application does not sufficiently restrict the permis", "language": "en" }, { "id": "E200", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-580366.html", "sourceField": "body:advisory", "excerpt": "he respective link)\n\nhttps://www.sw.siemens.com/en-US/siemens-software-center/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSiemens Software Center allows you to download, install, and activate purchased software. You can also update your software as new versions become available and launch free trials.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabi", "language": "en" }, { "id": "E201", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html", "sourceField": "body:advisory", "excerpt": "ITP1000\n\nAll versions\n\naffected by\n\nCVE-2025-2884\n\nCurrently no fix is planned\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC Field PG is a mobile, industry-standard programming device for automation engineers with all commonly used interfaces for industrial applications that also brings pre-installed SIMATIC engineering software.\n\nSIMATIC IPC (Industrial PC) is the hardware platform for PC-based automation from Siemens.\n\nThe SIMATIC CN 4100 is a communication node that allows connecting third-party systems helping to imple", "language": "en" }, { "id": "E202", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "sourceField": "body:advisory", "excerpt": "r later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/110006651/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP compliant access to Intelligent Electronic Devices.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2025-6965\n\nTher", "language": "en" }, { "id": "E203", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-800126.html", "sourceField": "body:advisory", "excerpt": "cs/ww/en/view/109794456/\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nAvoid opening untrusted files from unknown sources in affected products\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-PLCSIM simulates S7-1200, S7-1500 and a few other PLC derivatives and is shipped as part of SIMATIC STEP 7.\n\nSIMATIC STEP 7 (TIA Portal) is an engineering software to configure and program SIMATIC controllers.\n\nSIMATIC STEP", "language": "en" }, { "id": "E204", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-968435.html", "sourceField": "body:advisory", "excerpt": "ocs.eu1.edge.siemens.cloud/develop_an_application/ieap/download_the_ie_ap.html\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nIndustrial Edge App Publisher packages Docker images into Industrial Edge Apps for deployment on Industrial Edge Devices\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2026-78556\n\nThe affected software", "language": "en" } ], "summaryEvidenceIds": [ "E1", "E4", "E5", "E152", "E7", "E10", "E11", "E191", "E13", "E153", "E14", "E155", "E16", "E192", "E18", "E193", "E20", "E23", "E24", "E158", "E26", "E186", "E39", "E44", "E45", "E48", "E49", "E194", "E51", "E195", "E57", "E163", "E59", "E196", "E65", "E67", "E68", "E187", "E76", "E197", "E78", "E198", "E82", "E199", "E84", "E169", "E86", "E200", "E88", "E171", "E90", "E201", "E97", "E173", "E106", "E202", "E108", "E174", "E110", "E116", "E117", "E119", "E120", "E203", "E127", "E132", "E133", "E135", "E136", "E139", "E140", "E179", "E142", "E182", "E144", "E204", "E146" ], "riskEvidenceIds": [ "E1", "E4", "E5", "E152", "E7", "E10", "E11", "E191", "E13", "E153", "E14", "E155", "E16", "E192", "E18", "E193", "E20", "E23", "E24", "E158", "E26", "E186", "E39", "E44", "E45", "E48", "E49", "E194", "E51", "E195", "E57", "E163", "E59", "E196", "E65", "E67", "E68", "E187", "E76", "E197", "E78", "E198", "E82", "E199", "E84", "E169", "E86", "E200", "E88", "E171", "E90", "E201", "E97", "E173", "E106", "E202", "E108", "E174", "E110", "E116", "E117", "E119", "E120", "E203", "E127", "E132", "E133", "E135", "E136", "E139", "E140", "E179", "E142", "E182", "E144", "E204", "E146" ], "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "JVN88474777", "aliases": [], "title": "SiteGuard Server EditionにおけるOSコマンドインジェクションの脆弱性", "summary": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionには、OSコマンドインジェクションの脆弱性が存在します。", "risk": "当該製品が動作するサーバ上で、rootまたはSYSTEM権限で任意のOSコマンドが実行される可能性があります。", "product": "SiteGuard Server Edition", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\n本脆弱性は次のバージョンで修正されています。\n\nApache版、Nginx版、IIS版：Ver8.00 Update5\n\nFreeBSD Apache版、Nginx版：Ver7.00 Update6\n\nパッチを適用する\n\n開発者はバージョンアップが困難な利用者向けに、統計処理の対象ファイルを差し替えるパッチを提供しています（サポート終了バージョンを含む）。\n\nなお、開発者は2026年9月29日に直接サポート契約がある利用者へ本脆弱性の存在と対策（バージョンアップ、個別パッチ）を通知しています。\n\n詳細は開発者が提供する情報を確認してください。", "「JVN88474777」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN88474777/", "label": "JVNの原文" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-10-14T02:00:00.000Z", "modifiedAt": "2026-10-14T06:15:00.000Z", "fetchedAt": "2026-10-23T01:17:50.760Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionには、OSコマンドインジェクションの脆弱性が存在します。", "sourceTitle": "SiteGuard Server EditionにおけるOSコマンドインジェクションの脆弱性", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-14T06:15:00.000Z", "fetchedAt": "2026-10-23T01:17:50.760Z", "state": "published" }, { "source": "JVN", "modifiedAt": "2026-10-14T06:15:00.000Z", "fetchedAt": "2026-10-23T01:17:50.760Z", "state": "published" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "JVN88474777", "sourceType": "JVN", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "fetchedAt": "2026-10-23T02:43:53.956Z", "publishedAt": "2026-10-13T15:00:00.000Z", "modifiedAt": "2026-10-13T15:00:00.000Z", "sourceDatePrecision": "day", "state": "published", "provider": "JVN / JPCERT/CC / IPA", "title": "JVN#88474777\n\nSiteGuard Server EditionにおけるOSコマンドインジェクションの脆弱性\n\n緊急", "descriptions": [ { "lang": "ja", "value": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionには、OSコマンドインジェクションの脆弱性が存在します。", "sourcePath": "section:概要" }, { "lang": "ja", "value": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionは、Webサーバに組み込んで使用するホスト型のWAF（Web Application Firewall）です。SiteGuard Server Editionの統計機能には次の脆弱性が存在します。\n\nOSコマンドインジェクション（ CWE-78 ）\n\nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 基本値 8.5\n\nCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 基本値 7.8\n\nCVE-2026-106931\n\nなお、本脆弱性の悪用が確認されています。", "sourcePath": "section:詳細情報" }, { "lang": "ja", "value": "当該製品が動作するサーバ上で、rootまたはSYSTEM権限で任意のOSコマンドが実行される可能性があります。", "sourcePath": "section:想定される影響" } ], "affected": [], "affectedStatements": [ { "lang": "ja", "value": "SiteGuard Server Edition Ver2.20およびそれ以降のバージョン\n\nただし、IIS版についてはVer3.10からVer4.00 Update4のバージョンは本脆弱性の影響を受けません。\n\nなお、当該製品において統計機能が有効な場合に本脆弱性の影響を受けます（初期値は有効）。", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\n本脆弱性は次のバージョンで修正されています。\n\nApache版、Nginx版、IIS版：Ver8.00 Update5\n\nFreeBSD Apache版、Nginx版：Ver7.00 Update6\n\nパッチを適用する\n\n開発者はバージョンアップが困難な利用者向けに、統計処理の対象ファイルを差し替えるパッチを提供しています（サポート終了バージョンを含む）。\n\nなお、開発者は2026年9月29日に直接サポート契約がある利用者へ本脆弱性の存在と対策（バージョンアップ、個別パッチ）を通知しています。\n\n詳細は開発者が提供する情報を確認してください。", "sourcePath": "section:対策方法" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [], "references": [ { "url": "https://cwe.mitre.org/data/definitions/78.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.eg-secure.co.jp/siteguard/news/alert-202610-1", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.jpcert.or.jp/at/2026/at260032.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-106931", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2026-000148", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://jvndb.jvn.jp/apis/myjvn/index.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" }, { "url": "https://www.ipa.go.jp/security/todokede/vuln/uketsuke.html", "label": "JVN掲載の参考情報", "tags": [], "provider": "JVN", "sourcePath": "a[href]" } ], "sections": [ { "heading": "概要", "value": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionには、OSコマンドインジェクションの脆弱性が存在します。", "sourcePath": "section:概要" }, { "heading": "影響を受けるシステム", "value": "SiteGuard Server Edition Ver2.20およびそれ以降のバージョン\n\nただし、IIS版についてはVer3.10からVer4.00 Update4のバージョンは本脆弱性の影響を受けません。\n\nなお、当該製品において統計機能が有効な場合に本脆弱性の影響を受けます（初期値は有効）。", "sourcePath": "section:影響を受けるシステム" }, { "heading": "詳細情報", "value": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionは、Webサーバに組み込んで使用するホスト型のWAF（Web Application Firewall）です。SiteGuard Server Editionの統計機能には次の脆弱性が存在します。\n\nOSコマンドインジェクション（ CWE-78 ）\n\nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 基本値 8.5\n\nCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 基本値 7.8\n\nCVE-2026-106931\n\nなお、本脆弱性の悪用が確認されています。", "sourcePath": "section:詳細情報" }, { "heading": "想定される影響", "value": "当該製品が動作するサーバ上で、rootまたはSYSTEM権限で任意のOSコマンドが実行される可能性があります。", "sourcePath": "section:想定される影響" }, { "heading": "対策方法", "value": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\n本脆弱性は次のバージョンで修正されています。\n\nApache版、Nginx版、IIS版：Ver8.00 Update5\n\nFreeBSD Apache版、Nginx版：Ver7.00 Update6\n\nパッチを適用する\n\n開発者はバージョンアップが困難な利用者向けに、統計処理の対象ファイルを差し替えるパッチを提供しています（サポート終了バージョンを含む）。\n\nなお、開発者は2026年9月29日に直接サポート契約がある利用者へ本脆弱性の存在と対策（バージョンアップ、個別パッチ）を通知しています。\n\n詳細は開発者が提供する情報を確認してください。", "sourcePath": "section:対策方法" }, { "heading": "ベンダ情報", "value": "ベンダ\n\nリンク\n\nEGセキュアソリューションズ株式会社\n\nSiteGuard Server EditionにおけるOSコマンドインジェクションの脆弱性(緊急)", "sourcePath": "section:ベンダ情報" } ], "snippets": [ { "evidenceId": "official:section:概要", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourcePath": "section:概要", "text": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionには、OSコマンドインジェクションの脆弱性が存在します。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourcePath": "section:影響を受けるシステム", "text": "SiteGuard Server Edition Ver2.20およびそれ以降のバージョン\n\nただし、IIS版についてはVer3.10からVer4.00 Update4のバージョンは本脆弱性の影響を受けません。\n\nなお、当該製品において統計機能が有効な場合に本脆弱性の影響を受けます（初期値は有効）。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:詳細情報", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourcePath": "section:詳細情報", "text": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionは、Webサーバに組み込んで使用するホスト型のWAF（Web Application Firewall）です。SiteGuard Server Editionの統計機能には次の脆弱性が存在します。\n\nOSコマンドインジェクション（ CWE-78 ）\n\nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 基本値 8.5\n\nCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 基本値 7.8\n\nCVE-2026-106931\n\nなお、本脆弱性の悪用が確認されています。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:想定される影響", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourcePath": "section:想定される影響", "text": "当該製品が動作するサーバ上で、rootまたはSYSTEM権限で任意のOSコマンドが実行される可能性があります。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:対策方法", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourcePath": "section:対策方法", "text": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\n本脆弱性は次のバージョンで修正されています。\n\nApache版、Nginx版、IIS版：Ver8.00 Update5\n\nFreeBSD Apache版、Nginx版：Ver7.00 Update6\n\nパッチを適用する\n\n開発者はバージョンアップが困難な利用者向けに、統計処理の対象ファイルを差し替えるパッチを提供しています（サポート終了バージョンを含む）。\n\nなお、開発者は2026年9月29日に直接サポート契約がある利用者へ本脆弱性の存在と対策（バージョンアップ、個別パッチ）を通知しています。\n\n詳細は開発者が提供する情報を確認してください。", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:section:ベンダ情報", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourcePath": "section:ベンダ情報", "text": "ベンダ\n\nリンク\n\nEGセキュアソリューションズ株式会社\n\nSiteGuard Server EditionにおけるOSコマンドインジェクションの脆弱性(緊急)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"EG Secure Solutions Inc.\",\"product\":\"SiteGuard Server Edition for Apache httpd\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Ver2.20\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThan\":\"Ver8.00 Update 5\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-106931" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"EG Secure Solutions Inc.\",\"product\":\"SiteGuard Server Edition for Nginx\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Ver2.20\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThan\":\"Ver8.00 Update 5\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-106931" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"EG Secure Solutions Inc.\",\"product\":\"SiteGuard Server Edition for IIS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Ver2.20\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThan\":\"Ver8.00 Update 5\",\"changes\":[{\"at\":\"Ver3.10\",\"status\":\"unaffected\"},{\"at\":\"Ver4.00 Update 5\",\"status\":\"affected\"}]}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-106931" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"EG Secure Solutions Inc.\",\"product\":\"SiteGuard Server Edition for Apache httpd on FreeBSD\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Ver2.20\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThan\":\"Ver7.00 Update 6\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-106931" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"EG Secure Solutions Inc.\",\"product\":\"SiteGuard Server Edition for Nginx on FreeBSD\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"Ver2.20\",\"status\":\"affected\",\"versionType\":\"semver\",\"lessThan\":\"Ver7.00 Update 6\"}]}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-106931" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-106931" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Improper neutralization of special elements used in an OS command ('OS Command Injection')\",\"lang\":\"en-US\",\"cweId\":\"CWE-78\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-106931" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-106931" }, { "evidenceId": "related:CVE-2026-106931:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.5,\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json", "relatedCve": "CVE-2026-106931" } ], "limits": { "completeness": "official_article_with_linked_advisories", "truncatedFields": [], "note": "JVNの日本語本文を取得しています。複数CVEの一括情報は分割せず、影響なし・修正版の番号を推測しません。参照先ページ本文は含みません。 公式の関連CVE・指定された公的機関と開発元の告知本文を追加しています。複数の告知・CVEに共通の修正版があるとは扱わず、それぞれの製品・条件と対応を照合してください。", "linkedSourceErrors": [] }, "relatedCves": [ "CVE-2026-106931" ], "supplementarySources": [ { "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "id": "CVE-2026-106931", "modifiedAt": "2026-10-21T03:56:27.300Z" } ], "relatedDocuments": [ { "type": "cve", "id": "CVE-2026-106931", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106931.json", "modifiedAt": "2026-10-21T03:56:27.300Z", "affected": [ { "vendor": "EG Secure Solutions Inc.", "product": "SiteGuard Server Edition for Apache httpd", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "Ver2.20", "lessThan": "Ver8.00 Update 5", "versionType": "semver", "status": "affected" } ] }, { "vendor": "EG Secure Solutions Inc.", "product": "SiteGuard Server Edition for Nginx", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "Ver2.20", "lessThan": "Ver8.00 Update 5", "versionType": "semver", "status": "affected" } ] }, { "vendor": "EG Secure Solutions Inc.", "product": "SiteGuard Server Edition for IIS", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "Ver2.20", "lessThan": "Ver8.00 Update 5", "versionType": "semver", "status": "affected", "changes": [ { "at": "Ver3.10", "status": "unaffected" }, { "at": "Ver4.00 Update 5", "status": "affected" } ] } ] }, { "vendor": "EG Secure Solutions Inc.", "product": "SiteGuard Server Edition for Apache httpd on FreeBSD", "sourcePath": "/containers/cna/affected/3", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "Ver2.20", "lessThan": "Ver7.00 Update 6", "versionType": "semver", "status": "affected" } ] }, { "vendor": "EG Secure Solutions Inc.", "product": "SiteGuard Server Edition for Nginx on FreeBSD", "sourcePath": "/containers/cna/affected/4", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "Ver2.20", "lessThan": "Ver7.00 Update 6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [] } ] }, "relatedCves": [ "CVE-2026-106931" ], "sourceSummary": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionには、OSコマンドインジェクションの脆弱性が存在します。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:16.646Z", "sourceFingerprint": "df92121ea09496c5d5b34b762749b38a0122f7fc6092f801b51dac2c98450267", "generatorVersion": "2026-10-23.3", "sourceModifiedAt": "2026-10-14T06:15:00.000Z", "verificationMethod": "official_japanese_source_with_structured_checks", "summary": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionには、OSコマンドインジェクションの脆弱性が存在します。", "risk": "当該製品が動作するサーバ上で、rootまたはSYSTEM権限で任意のOSコマンドが実行される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "JVNが公表している対象範囲です。\nSiteGuard Server Edition Ver2.20およびそれ以降のバージョン\n\nただし、IIS版についてはVer3.10からVer4.00 Update4のバージョンは本脆弱性の影響を受けません。\n\nなお、当該製品において統計機能が有効な場合に本脆弱性の影響を受けます（初期値は有効）。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ], "evidenceIds": [ "E3" ] }, { "text": "利用中の製品名・開発元・版を、この対象範囲と照らし合わせてください。OSや製品の種類、機能の設定、例外の記載がある場合は、番号だけでなくその条件も確認します。自分で判断できない場合は、下の確認メモを管理担当者に渡してください。", "kind": "check", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ], "evidenceIds": [ "E3" ] }, { "text": "公表されたCVSS評価では、攻撃者は事前に一般利用者程度の権限を持つ必要があります。WordPressの「購読者」「投稿者」などの具体的な役割は、この値だけでは分かりません。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ], "evidenceIds": [ "E4" ] }, { "text": "公表されたCVSS評価では、対象機器上の処理など、ローカルな攻撃経路が条件です。インターネットからリクエストを送るだけで成立する、という評価ではありません。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ], "evidenceIds": [ "E4" ] }, { "text": "公表されたCVSS評価では、攻撃者以外の利用者がリンクを開くなどの操作をしなくても、攻撃が成立し得ます。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ], "evidenceIds": [ "E4" ] }, { "text": "なお、本脆弱性の悪用が確認されています。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "「SiteGuard Server Edition」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN88474777/" ] } ], "actions": [ { "text": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\n本脆弱性は次のバージョンで修正されています。\n\nApache版、Nginx版、IIS版：Ver8.00 Update5\n\nFreeBSD Apache版、Nginx版：Ver7.00 Update6\n\nパッチを適用する\n\n開発者はバージョンアップが困難な利用者向けに、統計処理の対象ファイルを差し替えるパッチを提供しています（サポート終了バージョンを含む）。\n\nなお、開発者は2026年9月29日に直接サポート契約がある利用者へ本脆弱性の存在と対策（バージョンアップ、個別パッチ）を通知しています。\n\n詳細は開発者が提供する情報を確認してください。", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ], "evidenceIds": [ "E5" ] }, { "text": "「JVN88474777」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN88474777/" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://jvn.jp/jp/JVN88474777/" ] } ], "verification": [ { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://jvn.jp/jp/JVN88474777/" ] } ], "unknowns": [ "これはJVNが公表した対象・影響・対策を整理した案内です。利用中の環境を検査した結果ではありません。対象外と判断するときは、製品・版だけでなく、設定や権限などの条件も照合してください。", "公表時点の対策を掲載しています。現在提供されている修正とサポート状況は、利用中の製品・系列に合わせて管理担当者に確認してください。対象範囲の上限だけから、修正版の番号を推測しないでください。" ], "supportRequest": "件名：JVN88474777 の対象確認と対応の依頼\n\n利用中の製品・型番：[記入してください]\nOS・現在の版・ビルド番号：[不明なら「不明」と記入]\n利用している機能・設定：[分かる範囲で記入]\n\nJVNは次の対象範囲を公表しています。\nSiteGuard Server Edition Ver2.20およびそれ以降のバージョン\n\nただし、IIS版についてはVer3.10からVer4.00 Update4のバージョンは本脆弱性の影響を受けません。\n\nなお、当該製品において統計機能が有効な場合に本脆弱性の影響を受けます（初期値は有効）。\n\nこの環境が対象か、対象外ならその理由を教えてください。対象の場合は次の公表対策に基づき、実施する修正・手順・停止や再起動の必要性と実施予定を確認してください。\nアップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\n本脆弱性は次のバージョンで修正されています。\n\nApache版、Nginx版、IIS版：Ver8.00 Update5\n\nFreeBSD Apache版、Nginx版：Ver7.00 Update6\n\nパッチを適用する\n\n開発者はバージョンアップが困難な利用者向けに、統計処理の対象ファイルを差し替えるパッチを提供しています（サポート終了バージョンを含む）。\n\nなお、開発者は2026年9月29日に直接サポート契約がある利用者へ本脆弱性の存在と対策（バージョンアップ、個別パッチ）を通知しています。\n\n詳細は開発者が提供する情報を確認してください。\n\n対応後は適用した版・設定と、この問題への対処が完了したと判断した根拠を連絡してください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVN88474777", "sources": [ { "url": "https://jvn.jp/jp/JVN88474777/", "label": "JVNの原文" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourceField": "section:概要", "excerpt": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionには、OSコマンドインジェクションの脆弱性が存在します。", "language": "ja" }, { "id": "E2", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourceField": "section:想定される影響", "excerpt": "当該製品が動作するサーバ上で、rootまたはSYSTEM権限で任意のOSコマンドが実行される可能性があります。", "language": "ja" }, { "id": "E3", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourceField": "section:影響を受けるシステム", "excerpt": "SiteGuard Server Edition Ver2.20およびそれ以降のバージョン\n\nただし、IIS版についてはVer3.10からVer4.00 Update4のバージョンは本脆弱性の影響を受けません。\n\nなお、当該製品において統計機能が有効な場合に本脆弱性の影響を受けます（初期値は有効）。", "language": "ja" }, { "id": "E4", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourceField": "section:詳細情報", "excerpt": "EGセキュアソリューションズ株式会社が提供するSiteGuard Server Editionは、Webサーバに組み込んで使用するホスト型のWAF（Web Application Firewall）です。SiteGuard Server Editionの統計機能には次の脆弱性が存在します。\n\nOSコマンドインジェクション（ CWE-78 ）\n\nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 基本値 8.5\n\nCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 基本値 7.8\n\nCVE-2026-106931\n\nなお、本脆弱性の悪用が確認されています。", "language": "ja" }, { "id": "E5", "sourceUrl": "https://jvn.jp/jp/JVN88474777/", "sourceField": "section:対策方法", "excerpt": "アップデートする\n\n開発者が提供する情報をもとに、最新版へアップデートしてください。\n\n本脆弱性は次のバージョンで修正されています。\n\nApache版、Nginx版、IIS版：Ver8.00 Update5\n\nFreeBSD Apache版、Nginx版：Ver7.00 Update6\n\nパッチを適用する\n\n開発者はバージョンアップが困難な利用者向けに、統計処理の対象ファイルを差し替えるパッチを提供しています（サポート終了バージョンを含む）。\n\nなお、開発者は2026年9月29日に直接サポート契約がある利用者へ本脆弱性の存在と対策（バージョンアップ、個別パッチ）を通知しています。\n\n詳細は開発者が提供する情報を確認してください。", "language": "ja" } ], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:16.646Z", "lastSuccess": "2026-10-23T03:21:16.646Z", "sourceCheckedAt": "2026-10-23T02:43:53.956Z", "errorCode": null }, "glossary": [] } } ], "total": 2185, "limit": 20, "offset": 320, "filters": { "product": "all", "type": "all", "q": "", "page": 17 }, "pagination": { "page": 17, "pageSize": 20, "totalPages": 110 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T08:17:50.076Z", "lastAttempt": "2026-10-23T08:17:50.076Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "error", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T08:17:50.076Z", "error": "GitHub API取得上限に到達 (2026-10-23T08:33:55.000Z以降に再取得)", "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T08:17:50.076Z", "lastAttempt": "2026-10-23T08:17:50.076Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T08:17:50.076Z", "lastAttempt": "2026-10-23T08:17:50.076Z", "error": null, "recordCount": 0, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T07:02:49.537Z 〜 2026-10-23T08:17:50.076Z、全製品の変更 11/11件まで確認、対象0件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T08:17:50.076Z", "lastAttempt": "2026-10-23T08:17:50.076Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。 PHP公式ニュース経由で候補補足（先頭20項目から2件）。GitHub全件代替ではない。CVE取得は既存候補と合わせ最大6件。", "cursor": null, "freshness": "fresh", "stale": false } ] }