脆弱性の詳細

産業・医療向け20件の告知：機器別の更新と、修正待ちの対応

その他の製品JVNVU98747108重要度：未評価悪用状況：未確認公式の対策情報あり

カメラ・映像配信装置、Siemensの制御・管理製品、医療向けIRIS for Healthの告知です。製品名と版を照合し、下の同じ製品の更新先だけを使ってください。サーバー側で対応済みのMeariと、機器更新が必要な製品、修正待ちの製品を分けています。

公式情報を個別に照合した日本語解説・確認日 2026/10/23

どんな危険？

製品ごとに、管理情報を見られる、不正な処理を動かされる、機器や通信が止まるなどの問題があります。例えばWinCCはデータベースへの認証済みアクセス、S7のWebサーバーは権限のある利用者のブラウザー操作、IRISは暗号化せず通信できる設定が関係します。同じ危険が20件すべてに当てはまるわけではありません。

原文の抜粋 1 原文の抜粋 2 原文の抜粋 3 原文の抜粋 65 原文の抜粋 5 原文の抜粋 52 原文の抜粋 7 原文の抜粋 53 原文の抜粋 9 原文の抜粋 10 原文の抜粋 11 原文の抜粋 12 原文の抜粋 14 原文の抜粋 15 原文の抜粋 55 原文の抜粋 17 原文の抜粋 19 原文の抜粋 20 原文の抜粋 56 原文の抜粋 23 原文の抜粋 58 原文の抜粋 25 原文の抜粋 60 原文の抜粋 29 原文の抜粋 31 原文の抜粋 35 原文の抜粋 37 原文の抜粋 38 原文の抜粋 32 原文の抜粋 34 原文の抜粋 27 原文の抜粋 61 原文の抜粋 39 原文の抜粋 64 原文の抜粋 43 原文の抜粋 62 原文の抜粋 44 原文の抜粋 66

自分は対象？

Meari IoT Cloud Platform OpenAPI Serviceは、設定やdevice shadowデータを権限なく操作できる2件の問題です。サーバー側の修正は全利用者に適用済みと公表され、CloudEdgeアプリは必須の更新が案内されています。
公表された条件根拠 1 原文の抜粋 1 原文の抜粋 2
Kiloview E3 NDI Encoderはfirmware 1.30より前、Industrial Edge App Publisherは1.27.9より前、Siemens Software Centerは4.0.9.8より前です。App Publisherでは通信相手の偽装を経由した不正な処理、Software Centerではログイン済みのローカル利用者が置いたDLLの読み込みが問題です。
公表された条件根拠 2 根拠 3 根拠 4 原文の抜粋 3 原文の抜粋 4 原文の抜粋 5 原文の抜粋 6 原文の抜粋 7 原文の抜粋 8
Capital Embedded AR Classicは431-422の全版、およびR20-11の2303より前です。SENTRON 3NA COM Fuseは5.2より前です。PSS SINCALは旧WibuKeyドングルのライセンス機構を使う場合で、V21.5・V22.0の全版とV22.5 Update 5より前が対象です。いずれも主な影響として停止が示されています。
公表された条件根拠 5 根拠 6 根拠 7 原文の抜粋 9 原文の抜粋 10 原文の抜粋 11 原文の抜粋 12 原文の抜粋 13 原文の抜粋 14
Secure Bootのテスト鍵に関する対象は、SIMATIC IPC BX-21AのBIOS 31.01.13より前、RW-543Aの1.1.4より前、IPC227G・IPC277G・IPC277G PRO・IPC327G・IPC377Gの28.01.15より前です。
公表された条件根拠 8 原文の抜粋 15 原文の抜粋 16
APOGEE・TALON・Desigoの一部機種には、BACnet通信などによる停止の問題があります。MBC/MEC PPCのBACnet/P2製品は全版、PXC CompactはBACnet 3.5.7より前・P2 2.8.21より前など、型番と通信方式で範囲が異なります。
公表された条件根拠 9 原文の抜粋 17 原文の抜粋 18 原文の抜粋 19
Industrial Edge Device Kitでは、ログイン済み利用者が意図しない場所の情報を読めます。旧V1.5〜V1.25系列と、V1.26の1.26.2-1より前、V1.27の1.27.1-1より前、V1.28の1.28.0-6より前などが対象です。arm64/x86-64の区分も確認します。
公表された条件根拠 10 原文の抜粋 20 原文の抜粋 21 原文の抜粋 22
.NET Client Library for S7 Webserver APIは、CVE-2026-85114が3.3.61より前、CVE-2026-85115が3.3.62より前です。秘密情報の扱いとダウンロード先へのファイル書き込みに関する問題です。
公表された条件根拠 11 原文の抜粋 23 原文の抜粋 24
SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPはV3.1.7のGNU/Linux subsystem、SIMATIC S7-1500 TM MFPはV1.1.1のGNU/Linux subsystemが対象です。PLC全体のどの処理にも同じ影響があるという意味ではありません。
公表された条件根拠 12 根拠 13 原文の抜粋 25 原文の抜粋 26 原文の抜粋 27 原文の抜粋 28
RUGGEDCOM CROSSBOWとRUGGEDCOM CROSSBOW SACは6.0より前です。前者にはSQL命令・管理認証情報・権限・設定による停止など、後者には内蔵SQLiteに関係するコード実行・情報・停止の問題があります。
公表された条件根拠 14 根拠 15 原文の抜粋 29 原文の抜粋 30 原文の抜粋 31 原文の抜粋 32 原文の抜粋 33 原文の抜粋 34
WinCCの問題は、対象システムのデータベースにログインできる攻撃者が、ホスト上で不正な命令を実行できるものです。WinCC V7.5全版、V8.0 Update 11より前、V8.1 Update 7より前が対象です。
公表された条件根拠 16 原文の抜粋 35 原文の抜粋 36 原文の抜粋 37
SIMATIC/SIPLUS S7のWebサーバーは、告知に列挙されたDrive Controller・ET200・S7-1200/1500などのモデルが対象です。権限のある利用者のブラウザーで不正なスクリプトが動くと、その利用者に許された範囲でPLC操作ができる問題です。利用者の権限を無条件で超えられるという公表ではありません。
公表された条件根拠 17 原文の抜粋 38
Industrial Edge Devicesの認証済み利用者による情報取得は、IECD・IEOD・IEVDの1.28.1より前、IOT2050 Advanced/SMとBX-21Aの1.28.1-2より前、BX-39A・BX-59A・IPC127Eの3.2.0-17より前などが対象です。SCALANCE LPE9413/LPE9433や一部HMI製品には修正版未提供の区分があります。
公表された条件根拠 18 原文の抜粋 39 原文の抜粋 40 原文の抜粋 41 原文の抜粋 42
RUGGEDCOM APE1808はNozomi Guardian/CMCを載せた構成が対象です。細工したダッシュボードの利用・取り込み、監視対象への接続のなりすまし、制限された認証情報管理や設定の操作など、問題ごとに条件が異なります。
公表された条件根拠 19 原文の抜粋 43
InterSystems IRIS for Healthの掲載版は2026.2.0.221、2026.1.0.235、2025.3.0.226です。既定でTLSを必須にしないため、通信中のデータやログイン情報が露出する可能性があります。
公表された条件根拠 20 原文の抜粋 44 原文の抜粋 45
利用中の製品名・型番・完全な版番号を確認し、自分の製品の項目だけを照合してください。複数製品をまとめた告知では、別製品の修正版や対策を流用しません。分からない項目は管理担当者にこのページを渡して確認します。
自分の環境で確認根拠 21 原文の抜粋 46 原文の抜粋 47 原文の抜粋 48 原文の抜粋 49 原文の抜粋 50
最初に「CISA ICS Advisory / ICS Medical Advisory（2026年10月22日）」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。
自分の環境で確認根拠 21

対象の版: 対象の版番号は取得データにありません。下の確認メモで管理者に確認できます。
修正版: 版番号の一覧は未確認です。公表された具体的な対策は「どうすればいい？」に記載しています。

どうすればいい？

Meariはサーバー修正の適用済み状況を確認し、CloudEdgeをApp StoreまたはGoogle Playの最新アプリへ更新します。Kiloview E3はV1.30、App Publisherは1.27.9、Software Centerは4.0.9.8以降へ更新します。Software Centerは次回起動時に自動更新されるとされています。
公表された対策根拠 1 根拠 2 根拠 3 根拠 4 原文の抜粋 1 原文の抜粋 2 原文の抜粋 3 原文の抜粋 51 原文の抜粋 5 原文の抜粋 6 原文の抜粋 52 原文の抜粋 7 原文の抜粋 8 原文の抜粋 53
Capital AR Classic R20-11は2303以降へ、SENTRONは5.2以降へ、PSS SINCAL V22.5はUpdate 5以降へ更新します。Capital 431-422は修正予定なし、SINCAL V21.5/V22.0は修正版未提供のため、それぞれ移行方針を提供元と決めてください。
公表された対策根拠 5 根拠 6 根拠 7 原文の抜粋 9 原文の抜粋 10 原文の抜粋 11 原文の抜粋 12 原文の抜粋 54 原文の抜粋 14
IPCのBIOSは、BX-21Aが31.01.13以降、RW-543Aが1.1.4以降、IPC227G・277G・277G PRO・327G・377Gが28.01.15以降へ更新します。別型番用のBIOSを流用しません。更新後はBIOSの既定設定を読み込みます。Secure Boot鍵を既に登録していた場合は、その後に鍵を登録し直す必要があります。担当者が現在の起動設定と鍵の復元手順を確認して実施してください。
公表された対策根拠 8 原文の抜粋 15 原文の抜粋 16 原文の抜粋 55
PXC CompactはBACnet 3.5.7以降、P2 2.8.21以降へ更新します。APOGEEのMBC/MEC PPC BACnet/P2は修正予定なしです。ほかのAPOGEE/TALON/Desigo型番も同じ番号と判断せず、機器の完全な型番を保守担当者へ渡して対応を依頼してください。
公表された対策根拠 9 原文の抜粋 17 原文の抜粋 18 原文の抜粋 19
Device Kitは該当系列の1.26.2-1、1.27.1-1、1.28.0-6以降へ更新します。旧系列には修正予定なしの区分があります。機器に組み込まれたKitは開発用Kitだけ更新しても機器へ反映されないため、機器メーカーの更新を確認します。.NET Client Libraryは3.3.61と3.3.62の両修正が入った版を利用します。
公表された対策根拠 10 根拠 11 原文の抜粋 20 原文の抜粋 56 原文の抜粋 22 原文の抜粋 23 原文の抜粋 57 原文の抜粋 58
RUGGEDCOM CROSSBOWとCROSSBOW SACは、それぞれ製品の6.0以降へ更新します。内蔵ライブラリーの修正番号を機器ファームウェアの番号として使わないでください。
公表された対策根拠 14 根拠 15 原文の抜粋 29 原文の抜粋 30 原文の抜粋 31 原文の抜粋 32 原文の抜粋 33 原文の抜粋 34
WinCC V8.0はUpdate 11以降、V8.1はUpdate 7以降へ更新します。V7.5はこの告知時点で修正版がないため、提供元と移行・接続制限を検討してください。
公表された対策根拠 16 原文の抜粋 35 原文の抜粋 59 原文の抜粋 37
Industrial Edge Devicesは型番に合わせ、IECD・IEOD・IEVDを1.28.1以降、IOT2050 Advanced/SM・BX-21Aを1.28.1-2以降、BX-39A・BX-59A・IPC127Eを3.2.0-17以降へ更新します。SCALANCEやHMIの修正待ち区分へ、これらの更新を流用しません。
公表された対策根拠 18 原文の抜粋 39 原文の抜粋 40 原文の抜粋 41 原文の抜粋 42
Nozomi Guardian/CMC搭載APE1808は、Siemensの顧客サポートへパッチと更新情報を依頼します。CPU 1518 V3.1.7、TM MFP V1.1.1、S7 Webサーバーの告知には、この公表時点で修正版未提供の区分があります。
一般的な作業手順根拠 19 根拠 12 根拠 13 根拠 17 原文の抜粋 25 原文の抜粋 26 原文の抜粋 60 原文の抜粋 38 原文の抜粋 27 原文の抜粋 28 原文の抜粋 61 原文の抜粋 43 原文の抜粋 62
IRIS for Healthは担当者がIRIS superserverのTLS設定を「Required」にします。「Enabled」は暗号化しない接続も許可するため、TLS必須化の代わりにはなりません。接続するアプリ側もTLSで接続できることを確認します。
公表された対策根拠 20 原文の抜粋 44 原文の抜粋 63
対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。
一般的な作業手順根拠 22 根拠 21

この説明に出てくる言葉

言葉の一般的な意味です。この脆弱性で起きる被害や条件は、上の個別の説明を確認してください。

SQLインジェクション: 入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。用語の解説元

使っているバージョンの調べ方

「CISA ICS Advisory / ICS Medical Advisory（2026年10月22日）」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。
一般的な作業手順根拠 22 根拠 21

すぐに更新できないとき

CPU 1518/TM MFPのGNU/Linux subsystemは、信頼できるアプリだけを実行し、shell操作を信頼できる担当者へ限定する緩和策が示されています。Device Kit・Industrial Edge Devicesは管理ネットワークへの接続を信頼できる接続元に制限します。これらは修正済みを意味しません。
公表された対策根拠 12 根拠 13 根拠 10 根拠 18 原文の抜粋 20 原文の抜粋 56 原文の抜粋 25 原文の抜粋 60 原文の抜粋 27 原文の抜粋 61 原文の抜粋 39 原文の抜粋 64

対応が終わったら確認すること

担当者から、対象だった製品・適用した修正や設定・反映日時を回答してもらいます。製品ごとの公式情報と照合してから完了とし、通常業務が続けられることも確認してください。
一般的な作業手順根拠 21 原文の抜粋 46 原文の抜粋 47 原文の抜粋 48 原文の抜粋 49 原文の抜粋 50
更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。
一般的な作業手順根拠 22 根拠 21

まだ分からないこと・判断の限界

公表時点の公式資料を照合した説明です。実際の機器や設定を検査した結果ではありません。修正版や対応状況は製品・系列ごとに確認してください。
多くの型番を含む告知は、ここに挙げた代表製品だけでは安全・対象外を確定できません。完全な型番と通信方式が一致する公式の製品表で最終照合してください。

管理会社・担当者に聞くための確認メモ

自分で操作できない場合に使えます。コピー先で空欄を埋めて担当者へ送ってください。

確認メモ（選択してコピーもできます）

件名：JVNVU98747108（CISA ICS Advisory / ICS Medical Advisory（2026年10月22日））の影響と対応状況の確認

利用中のサイト・機器・サービス：[記入してください]
製品名・開発元：[記入してください]
現在のバージョン・ビルド番号：[不明なら「不明」と記入]

JVNVU98747108について、次を教えてください。
1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。
2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。
3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。
4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。
5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。

確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVNVU98747108

この解説・手順の根拠

説明に対応する原文の抜粋

日本語の説明の根拠になった、取得済みの公式情報です。各抜粋を開くと、出典と元の文章を確認できます。

抜粋 1：www.cisa.gov
Meari IoT Cloud Platform OpenAPI Service (Update A) | CISA Summary Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. The following versions of Meari IoT Cloud Platform OpenAPI Service (Update A) are affected: IoT Cloud Platform OpenAPI Service vers:all/* (CVE-2026-101104, CVE-2026-96613) CVSS Vendor Equipment v3 7.7 Meari IoT Cloud Platform OpenAPI Service 1 Vulnerability Missing Authorization Background Critical Infrastructure Sectors: Commercial Facilities, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-101104 The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions. Read More 1 Affected Product Meari IoT Cloud Platform
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 2：www.cisa.gov
IoT Cloud Platform OpenAPI Service: vers:all/* Product Status: known_affected Remediations Mitigation Both vulnerabilities have been remediated. The required server-side fixes have been deployed to the Meari IoT Cloud Platform and are now effective for all users. Mitigation To ensure compatibility with these changes, all CloudEdge users are required to upgrade to the latest version of the application. Upon launching CloudEdge, users will receive a mandatory update prompt and must complete the upgrade before continuing to use the app. The latest version of CloudEdge is available on the Apple App Store and Google Play. Vendor fix Specifically, Meari implemented the following protections in its IoT Cloud Platform OpenAPI Service: Mitigation CVE-2026-101104: Server-side authorization checks now verify the ownership relationship between the authenticated account and the target device before processing device configuration requests. Requests for devices that are not bound to the authenticated account are rejected. Mitigation IoT Cloud Platform OpenAPI users are advised to contact Meari for further support https://www.meari.com/en/downLoadCenter. Additional Metrics Relevant CWE: CWE-862 Missing Authorization CVSS Version Base Score Base Severity Vector Stri
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 3：www.cisa.gov
Kiloview E3 NDI Encoder | CISA Summary Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Kiloview E3 NDI Encoder are affected: E3 Firmware <1.30 (CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450, CVE-2026-110825) CVSS Vendor Equipment v3 9.9 Kiloview E3 Firmware 6 Vulnerabilities Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Insufficient Session Expiration, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), NULL Pointer Dereference, Use of Hard-coded Credentials Background Critical Infrastructure Sectors: Communications, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-109122 The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 4：www.cisa.gov
is these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Kiloview E3 NDI Encoder are affected: E3 Firmware <1.30 (CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450, CVE-2026-110825) CVSS Vendor Equipment v3 9.9 Kiloview E3 Firmware 6 Vulnerabilities Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Mis
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 5：www.cisa.gov
Siemens Industrial Edge App Publisher | CISA Summary The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration. Siemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version. The following versions of Siemens Industrial Edge App Publisher are affected: Industrial Edge App Publisher vers:intdot/<1.27.9 (CVE-2026-78556, CVE-2026-78557) CVSS Vendor Equipment v3 8.3 Siemens Industrial Edge App Publisher 2 Vulnerabilities Improper Certificate Validation, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-78556 The affected software does not properly vali
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 6：www.cisa.gov
nds to update to the latest version. The following versions of Siemens Industrial Edge App Publisher are affected: Industrial Edge App Publisher vers:intdot/<1.27.9 (CVE-2026-78556, CVE-2026-78557) CVSS Vendor Equipment v3 8.3 Siemens Industrial Edge App Publisher 2 Vulnerabilities Improper Certificate Validation, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Background Critical Infrastructure Sectors: Critical Manufacturing, Transport
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 7：www.cisa.gov
Siemens Software Center | CISA Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it. The following versions of Siemens Software Center are affected: Siemens Software Center vers:intdot/<4.0.9.8 (CVE-2026-110936) CVSS Vendor Equipment v3 6.7 Siemens Siemens Software Center 1 Vulnerability Uncontrolled Search Path Element Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-110936 The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 8：www.cisa.gov
current known active exploitation and how to detect it. The following versions of Siemens Software Center are affected: Siemens Software Center vers:intdot/<4.0.9.8 (CVE-2026-110936) CVSS Vendor Equipment v3 6.7 Siemens Siemens Software Center 1 Vulnerability Uncontrolled Search Path Element Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 9：www.cisa.gov
Siemens Capital Embedded AR Classic | CISA Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Capital Embedded AR Classic are affected: Capital Embedded AR Classic 431-422 vers:all/* (CVE-2026-89208) Capital Embedded AR Classic R20-11 vers:intdot/<2303 (CVE-2026-89208) CVSS Vendor Equipment v3 5.3 Siemens Capital Embedded AR Classic 431-422 1 Vulnerability Out-of-bounds Read Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-89208 The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 10：www.cisa.gov
Products Capital Embedded AR Classic 431-422 Product Status: known_affected Remediations Mitigation Apply network segmentation and put the ECUs behind properly configured gateways/firewalls No fix planned Currently no fix is planned Capital Embedded AR Classic R20-11 < V2303 Product Status: known_affected Remediations Mitigation Apply network segmentation and put the ECUs behind properly configured gateways/firewalls Vendor fix Update to V2303 or later version Additional Metrics Relevant CWE: CWE-125 Out-of-bounds Read CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N View CVE Details
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 11：www.cisa.gov
Siemens SENTRON 3NA COM Fuse | CISA Summary SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation. The following versions of Siemens SENTRON 3NA COM Fuse are affected: SENTRON 3NA COM Fuse vers:intdot/<5.2 (CVE-2024-7322) CVSS Vendor Equipment v3 5.8 Siemens SENTRON 3NA COM Fuse 1 Vulnerability Improper Verification of Source of a Communication Channel Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2024-7322 A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes Denial of Service (DoS). To recover from this DoS, the network must be re-established Read More 1 Affected Product SENTRON 3NA COM Fuse < V5.2 Product Status: known_affected Remediations Vendor fix Update to V5.2 or later version Additional Metrics Relevant CWE: CWE-940 Improper Verification of Source of a Communication Channel CVSS Version Base Score Base Severity Vector String 3.1 5.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H View CVE Details
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 12：www.cisa.gov
Siemens PSS(R)SINCAL | CISA Summary PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable. The following versions of Siemens PSS(R)SINCAL are affected: PSS(R)SINCAL V21.5 vers:all/* (CVE-2026-84854) PSS(R)SINCAL V22.0 vers:all/* (CVE-2026-84854) PSS(R)SINCAL V22.5 vers:intdot/<22.5.5 (CVE-2026-84854) CVSS Vendor Equipment v3 7 Siemens PSS(R)SINCAL V21.5 1 Vulnerability Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-84854 In the WibuKey driver, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the inten
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 13：www.cisa.gov
mmends applicable mitigations for products where patches are currently unavailable. The following versions of Siemens PSS(R)SINCAL are affected: PSS(R)SINCAL V21.5 vers:all/* (CVE-2026-84854) PSS(R)SINCAL V22.0 vers:all/* (CVE-2026-84854) PSS(R)SINCAL V22.5 vers:intdot/<22.5.5 (CVE-2026-84854) CVSS Vendor Equipment v3 7 Siemens PSS(R)SINCAL V21.5 1 Vulnerability Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financia
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 14：www.cisa.gov
More 3 Affected Products PSS(R)SINCAL V21.5 Product Status: known_affected Remediations Mitigation Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems. None available Currently no fix is available PSS(R)SINCAL V22.0 Product Status: known_affected Remediations Mitigation Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems. None available Currently no fix is available PSS(R)SINCAL V22.5 < V22.5 Update 5 Product Status: known_affected Remediations Vendor fix Update to V22.5 Update 5 or later version Additional Metrics Relevant CWE: CWE-787 Out-of-bounds Write CVSS Version Base Score Base Severity Vector String 3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 15：www.cisa.gov
Siemens SIMATIC IPCs | CISA Summary The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SIMATIC IPCs are affected: SIMATIC IPC BX-21A vers:intdot/<31.01.13 (CVE-2026-72895) SIMATIC IPC RW-543A vers:intdot/<1.1.4 (CVE-2026-72895) SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G vers:intdot/<28.01.15 (CVE-2026-72895) CVSS Vendor Equipment v3 7.7 Siemens SIMATIC IPC BX-21A 1 Vulnerability Use of Default Cryptographic Key Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-72895 A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or U
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 16：www.cisa.gov
fected products and recommends to update to the latest versions. The following versions of Siemens SIMATIC IPCs are affected: SIMATIC IPC BX-21A vers:intdot/<31.01.13 (CVE-2026-72895) SIMATIC IPC RW-543A vers:intdot/<1.1.4 (CVE-2026-72895) SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G vers:intdot/<28.01.15 (CVE-2026-72895) CVSS Vendor Equipment v3 7.7 Siemens SIMATIC IPC BX-21A 1 Vulnerability Use of Default Cryptographic Key Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Count
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 17：www.cisa.gov
Siemens APOGEE, TALON and Desigo PXC/PXM Products | CISA Summary The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens APOGEE, TALON and Desigo PXC/PXM Products are affected: APOGEE MBC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MBC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Modular (BACn
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 18：www.cisa.gov
2076) APOGEE MEC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Modular (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Modular (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) Desigo PX
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 19：www.cisa.gov
13 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC200-E.D >= V2.3 Product Status:
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 20：www.cisa.gov
Siemens Industrial Edge Device Kit | CISA Summary Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Industrial Edge Device Kit are affected: Industrial Edge Device Kit - arm64 V1.10 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.11 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.12 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.13 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.14 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.15 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.16 ver
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 21：www.cisa.gov
ll/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.24 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.25 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.26 vers:intdot/<1.26.2.1 (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.27 vers:intdot/<1.27.1.1 (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.28 vers:intdot/<1.28.0.6 (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.5 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.6 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.7 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Device Kit - arm64 V1.8 vers:all/* (CVE-2026-44414, CVE-2026-44415) Industrial Edge Dev
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 22：www.cisa.gov
network access to affected products is limited to trusted parties only No fix planned Currently no fix is planned Industrial Edge Device Kit - arm64 V1.26 < V1.26.2-1 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.26.2-1 or later version Industrial Edge Device Kit - arm64 V1.27 < V1.27.1-1 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.27.1-1 or later version Industrial Edge Device Kit - arm64 V1.28 < V1.28.0-6 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.0-6 or later version Industrial Edge Device Kit - arm64 V1.11 Product Status: known_affected Remediations Mitigation Ensure network access to affected
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 23：www.cisa.gov
Siemens SIMATIC S7 Webserver API | CISA Summary .NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version. The following versions of Siemens SIMATIC S7 Webserver API are affected: .NET Client Library for SIMATIC S7 Webserver API vers:intdot/<3.3.61, vers:intdot/<3.3.62 (CVE-2026-85114, CVE-2026-85115) CVSS Vendor Equipment v3 7.5 Siemens .NET Client Library for SIMATIC S7 Webserver API 2 Vulnerabilities Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-85114 Affected applications do not properly validate filenames received from remote servers during ti
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 24：www.cisa.gov
to the latest version. The following versions of Siemens SIMATIC S7 Webserver API are affected: .NET Client Library for SIMATIC S7 Webserver API vers:intdot/<3.3.61, vers:intdot/<3.3.62 (CVE-2026-85114, CVE-2026-85115) CVSS Vendor Equipment v3 7.5 Siemens .NET Client Library for SIMATIC S7 Webserver API 2 Vulnerabilities Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information Background Critical Infrastructure Sectors: Critical Manufacturing,
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 25：www.cisa.gov
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP | CISA Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/>=3.1.7 SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) vers:intdot/>=3.1.7 SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) vers:intdot/>=3.1.7 SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) vers:intdot/>=3.1.7 SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) vers:intdot/>=3.1.7 CVSS Vendor Equipment v3 10 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) 428 Vulnerabilities Access of Resource Using Incompatible Type ('Type Confusion'), Access of Uninitialized Pointer, Active Debug Code, Buffer Access with Incorrect Length Value, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Buffer Underwrite ('Buffer Underflow'), Concurr
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 26：www.cisa.gov
IC S7-1500 CPU 1518(F)-4 PN/DP MFP | CISA Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 27：www.cisa.gov
Siemens SIMATIC S7-1500 TM MFP | CISA Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 TM MFP are affected: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem vers:all/* CVSS Vendor Equipment v3 10 Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 377 Vulnerabilities Access of Uninitialized Pointer, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Deadlock, Detection of Error Condition Without Action, Double Free, Expired Pointer Dereference, Heap-based Buffer Overflow, Improper Control of Resource Identifiers ('Resource Injection'), Improper Control of a Resource Through its Lifetime, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Resource Locking, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Update of Reference Count, Improper Validation of Array Index, Improper Validation of
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 28：www.cisa.gov
emens SIMATIC S7-1500 TM MFP | CISA Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 TM MFP are affected: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem vers:all/* CVSS Vendor Equipment v3 10 Siemens SIMATIC S7-1500 TM MFP - GNU/Linu
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 29：www.cisa.gov
Siemens RUGGEDCOM CROSSBOW | CISA Summary RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version. The following versions of Siemens RUGGEDCOM CROSSBOW are affected: RUGGEDCOM CROSSBOW vers:intdot/<6.0 (CVE-2026-89196, CVE-2026-89197, CVE-2026-89198, CVE-2026-89199, CVE-2026-89200, CVE-2026-89201, CVE-2026-89202, CVE-2026-89203, CVE-2026-89204, CVE-2026-89205, CVE-2026-89206) CVSS Vendor Equipment v3 8.8 Siemens RUGGEDCOM CROSSBOW 4 Vulnerabilities Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Authorization Bypass Through User-Controlled Key, Insertion of Sensitive Information Into Sent Data, Client-Side Enforcement of Server-Side Security Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilitie
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 30：www.cisa.gov
M CROSSBOW and recommends to update to the latest version. The following versions of Siemens RUGGEDCOM CROSSBOW are affected: RUGGEDCOM CROSSBOW vers:intdot/<6.0 (CVE-2026-89196, CVE-2026-89197, CVE-2026-89198, CVE-2026-89199, CVE-2026-89200, CVE-2026-89201, CVE-2026-89202, CVE-2026-89203, CVE-2026-89204, CVE-2026-89205, CVE-2026-89206) CVSS Vendor Equipment v3 8.8 Siemens RUGGEDCOM CROSSBOW 4 Vulnerabilities Improper Neutralization of Special Elements used in an SQL Comma
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 31：www.cisa.gov
1 Affected Product RUGGEDCOM CROSSBOW < V6.0 Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2026-89197 Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. Read More 2 Affected Products RUGGEDCOM CROSSBOW < V6.0 Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW < V6.0 Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2026-89198 Affected devices do not properly val
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 32：www.cisa.gov
Siemens RUGGEDCOM CROSSBOW Station Access Controller | CISA Summary RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version. The following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller are affected: RUGGEDCOM CROSSBOW Station Access Controller (SAC) vers:intdot/<6.0 (CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824) CVSS Vendor Equipment v3 9.8 Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) 4 Vulnerabilities Numeric Truncation Error, Improper Clearing of Heap Memory Before Release ('Heap Inspection'), Improper Handling of Unicode Encoding, Heap-based Buffer Overflow Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 33：www.cisa.gov
The following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller are affected: RUGGEDCOM CROSSBOW Station Access Controller (SAC) vers:intdot/<6.0 (CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824) CVSS Vendor Equipment v3 9.8 Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) 4 Vulnerabilities Numeric Truncation Error, Improper Clearing of Heap Memory Before Release ('Heap Inspection'), Improper Handling of Unicode Encod
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 34：www.cisa.gov
ROSSBOW Station Access Controller (SAC) < V6.0 Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-197 Numeric Truncation Error CVSS Version Base Score Base Severity Vector String 3.1 7.7 HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L View CVE Details CVE-2025-70873 An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file. Read More 2 Affected Products RUGGEDCOM CROSSBOW Station Access Controller (SAC) < V6.0 Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) < V6.0 Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N View CVE Details CVE-2025-71316 SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker coul
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 35：www.cisa.gov
Siemens WinCC | CISA Summary Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available. The following versions of Siemens WinCC are affected: SIMATIC WinCC V7.5 vers:all/* (CVE-2026-59241) SIMATIC WinCC V8.0 vers:intdot/<8.0.0.11 (CVE-2026-59241) SIMATIC WinCC V8.1 vers:intdot/<8.1.7 (CVE-2026-59241) CVSS Vendor Equipment v3 8.8 Siemens SIMATIC WinCC V7.5 1 Vulnerability Incorrect Privilege Assignment Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-59241 The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker wit
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 36：www.cisa.gov
r fixes and recommends mitigations for products where fixes are not or not yet available. The following versions of Siemens WinCC are affected: SIMATIC WinCC V7.5 vers:all/* (CVE-2026-59241) SIMATIC WinCC V8.0 vers:intdot/<8.0.0.11 (CVE-2026-59241) SIMATIC WinCC V8.1 vers:intdot/<8.1.7 (CVE-2026-59241) CVSS Vendor Equipment v3 8.8 Siemens SIMATIC WinCC V7.5 1 Vulnerability Incorrect Privilege Assignment Background Critical Infrastructure Sectors: Critical Manufacturing,
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 37：www.cisa.gov
More 3 Affected Products SIMATIC WinCC V7.5 Product Status: known_affected Remediations None available Currently no fix is available SIMATIC WinCC V8.0 < V8.0 Update 11 Product Status: known_affected Remediations Vendor fix Update to V8.0 Update 11 or later version SIMATIC WinCC V8.1 < V8.1 Update 7 Product Status: known_affected Remediations Vendor fix Update to V8.1 Update 7 or later version Additional Metrics Relevant CWE: CWE-266 Incorrect Privilege Assignment CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 38：www.cisa.gov
Siemens SIMATIC S7 PLCs Web Server | CISA Summary SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7 PLCs Web Server are affected: SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) vers:all/* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357) SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) vers:all/* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357) SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) vers:all/* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357) SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) vers:all/* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 39：www.cisa.gov
Siemens Industrial Edge Devices | CISA Summary Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens Industrial Edge Devices are affected: Industrial Edge Cloud Device (IECD) vers:intdot/<1.28.1 (CVE-2026-44414) Industrial Edge Own Device (IEOD) vers:intdot/<1.28.1 (CVE-2026-44414) Industrial Edge Virtual Device (IEVD) vers:intdot/<1.28.1 (CVE-2026-44414) SCALANCE LPE9413 (6GK5998-3GS01-2AC2) vers:all/* (CVE-2026-44414) SCALANCE LPE9433 (6GK5998-3GS11-2AC2) vers:all/* (CVE-2026-44414) SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000, Unified Comfort Panel neu
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 40：www.cisa.gov
fixes are not or not yet available. The following versions of Siemens Industrial Edge Devices are affected: Industrial Edge Cloud Device (IECD) vers:intdot/<1.28.1 (CVE-2026-44414) Industrial Edge Own Device (IEOD) vers:intdot/<1.28.1 (CVE-2026-44414) Industrial Edge Virtual Device (IEVD) vers:intdot/<1.28.1 (CVE-2026-44414) SCALANCE LPE9413 (6GK5998-3GS01-2AC2) vers:all/* (CVE-2026-44414) SCALANCE LPE9433 (6GK5998-3GS11-2AC2) vers:all/* (CVE-2026-44414) SIMATIC HMI MTP1000
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 41：www.cisa.gov
Industrial Edge Cloud Device (IECD) < V1.28.1 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version Industrial Edge Own Device (IEOD) < V1.28.1 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version Industrial Edge Virtual Device (IEVD) < V1.28.1 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SCALANCE LPE9433 (6GK5998-3GS11-2AC2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) < V1.28.1-2 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1-2 or later version SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2) < V1.28.1-2 Product Status: known_affected Remediations Mitigation Ensure network acce
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 42：www.cisa.gov
k access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1-2 or later version SIMATIC IPC BX-39A Industrial Edge Device < V3.2.0-17 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC BX-59A Industrial Edge Device < V3.2.0-17 Product Status: known_affected Remediations Mitigation Ensure network access
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 43：www.cisa.gov
Siemens RUGGEDCOM APE1808 Devices | CISA Summary Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information. The following versions of Siemens RUGGEDCOM APE1808 Devices are affected: RUGGEDCOM APE1808 vers:all/* (CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920) CVSS Vendor Equipment v3 7.5 Siemens RUGGEDCOM APE1808 4 Vulnerabilities Improper Neutralization of Special Elements Used in a Template Engine, Incorrect Authorization, Lack of Administrator Control over Security, Cross-Site Request Forgery (CSRF) Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-33387 A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privilege
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 44：www.cisa.gov
InterSystems Corporation InterSystems IRIS for Health | CISA Summary Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. The following versions of InterSystems Corporation InterSystems IRIS for Health are affected: InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (CVE-2026-111594, CVE-2026-111594, CVE-2026-111594) CVSS Vendor Equipment v3 8.1 InterSystems Corporation InterSystems IRIS for Health 1 Vulnerability Cleartext Transmission of Sensitive Information Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities CVE-2026-111594 InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. Read More 3 Affected Products InterSystems Corporation InterSystems IRIS for Health: 2026.2.0.221 Product Status: known_affected Remediations Mitigation InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 45：www.cisa.gov
that data to log into the device. The following versions of InterSystems Corporation InterSystems IRIS for Health are affected: InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (CVE-2026-111594, CVE-2026-111594, CVE-2026-111594) CVSS Vendor Equipment v3 8.1 InterSystems Corporation InterSystems IRIS for Health 1 Vulnerability Cleartext Transmission of Sensitive Information Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Com
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 46：jvn.jp
米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。
この抜粋の出典を開く
取得元の項目：section:概要／言語：ja
抜粋 47：jvn.jp
ICS Advisory / ICS Medical Advisoryを参照してください。
この抜粋の出典を開く
取得元の項目：section:影響を受けるシステム／言語：ja
抜粋 48：jvn.jp
新規：19件 ICSA-26-295-01: Kiloview E3 NDI Encoder ICSA-26-295-02: Siemens Industrial Edge App Publisher ICSA-26-295-03: Siemens Software Center ICSA-26-295-04: Siemens Capital Embedded AR Classic ICSA-26-295-05: Siemens SENTRON 3NA COM Fuse ICSA-26-295-06: Siemens PSS(R)SINCAL ICSA-26-295-07: Siemens SIMATIC IPCs ICSA-26-295-08: Siemens APOGEE, TALON and Desigo PXC/PXM Products ICSA-26-295-09: Siemens Industrial Edge Device Kit ICSA-26-295-10: Siemens SIMATIC S7 Webserver API ICSA-26-295-11: Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP ICSA-26-295-12: Siemens RUGGEDCOM CROSSBOW ICSA-26-295-13: Siemens WinCC ICSA-26-295-14: Siemens SIMATIC S7 PLCs Web Server ICSA-26-295-15: Siemens RUGGEDCOM CROSSBOW Station Access Controller ICSA-26-295-16: Siemens SIMATIC S7-1500 TM MFP ICSA-26-295-17: Siemens Industrial Edge Devices ICSA-26-295-18: Siemens RUGGEDCOM APE1808 Devices ICSMA-26-295-01: InterSystems Corporation InterSystems IRIS for Health 更新：1件 ICSA-26-274-06: Meari IoT Cloud Platform OpenAPI Service (Update A)
この抜粋の出典を開く
取得元の項目：section:詳細情報／言語：ja
抜粋 49：jvn.jp
ICS Advisory / ICS Medical Advisoryを参照してください。
この抜粋の出典を開く
取得元の項目：section:想定される影響／言語：ja
抜粋 50：jvn.jp
ICS Advisory / ICS Medical Advisoryを参照してください。
この抜粋の出典を開く
取得元の項目：section:対策方法／言語：ja
抜粋 51：www.cisa.gov
rial. Read More 1 Affected Product Kiloview E3 Firmware: <1.30 Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H View CVE Details CVE-2026-111100 The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks. Read More 2 Affected Products Kiloview E3 Firmware: <1.30 Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: <1.30 Product Status: known_affected Remediations Mitigation KiloView recommends u
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 52：www.cisa.gov
oduct Industrial Edge App Publisher < V1.27.9 Product Status: known_affected Remediations Vendor fix Update to V1.27.9 or later version Additional Metrics Relevant CWE: CWE-295 Improper Certificate Validation CVSS Version Base Score Base Severity Vector String 3.1 7.4 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N View CVE Details CVE-2026-78557 The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine Read More 2 Affected Products Industrial Edge App Publisher < V1.27.9 Product Status: known_affected Remediations Vendor fix Update to V1.27.9 or later version Industrial Edge App Publisher < V1.27.9 Product Status: known_affected Remediations Vendor fix Update to V1.27.9 or later version Additional Metrics Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS Version Base Score Base Severity Vector String 3.1 8.3 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H View CVE Details
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 53：www.cisa.gov
ed Product Siemens Software Center < V4.0.9.8 Product Status: known_affected Remediations Vendor fix Update to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link) Additional Metrics Relevant CWE: CWE-427 Uncontrolled Search Path Element CVSS Version Base Score Base Severity Vector String 3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H View CVE Details
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 54：www.cisa.gov
mmends applicable mitigations for products where patches are currently unavailable. The following versions of Siemens PSS(R)SINCAL are affected: PSS(R)SINCAL V21.5 vers:all/* (CVE-2026-84854) PSS(R)SINCAL V22.0 vers:all/* (CVE-2026-84854) PSS(R)SINCAL V22.5 vers:intdot/<22.5.5 (CVE-2026-84854) CVSS Vendor Equipment v3 7 Siemens PSS(R)SINCAL V21.5 1 Vulnerability Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 55：www.cisa.gov
ected Products SIMATIC IPC BX-21A < V31.01.13 Product Status: known_affected Remediations Mitigation Note: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards. Mitigation As a temporary mitigation, users can manually remove the test key from the database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A or "insyde-ElkhartLake" for IPC227G/277G/327G/377G and BX-21A). Note: Loading default settings will restore the test key, so upgrading remains recommended. Vendor fix Update to V31.01.13 or later version SIMATIC IPC RW-543A < V1.1.4 Product Status: known_affected Remediations Mitigation Note: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards. Mitigation As a temporary mitigation, users can manually remove the test key from the database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A or "insyde-ElkhartLake" for IPC227G/277G/327G/377G and BX-21A). Note: Loading default settings will restore the test key, so upgrading remains recommended. Vendor fix Update to V1.1.4 or later version SIMATIC IPC227G / IPC277G /
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 56：www.cisa.gov
ucts Industrial Edge Device Kit - arm64 V1.10 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only No fix planned Currently no fix is planned Industrial Edge Device Kit - arm64 V1.19 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only No fix planned Currently no fix is planned Industrial Edge Device Kit - arm64 V1.20 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only No fix planned Currently no fix is planned Industrial Edge Device Kit - arm64 V1.21 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only No fix planned Currently no fix is planned Industrial Edge Device Kit - arm64 V1.22 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only No fix planned Currently no fix is planned Industrial Edge Device Kit - arm64 V1.23 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 57：www.cisa.gov
to the latest version. The following versions of Siemens SIMATIC S7 Webserver API are affected: .NET Client Library for SIMATIC S7 Webserver API vers:intdot/<3.3.61, vers:intdot/<3.3.62 (CVE-2026-85114, CVE-2026-85115) CVSS Vendor Equipment v3 7.5 Siemens .NET Client Library for SIMATIC S7 Webserver API 2 Vulnerabilities Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information Background Critical Infrastructure
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 58：www.cisa.gov
Library for SIMATIC S7 Webserver API < V3.3.61 Product Status: known_affected Remediations Vendor fix Update to V3.3.61 or later version Additional Metrics Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N View CVE Details CVE-2026-85115 Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC. Read More 2 Affected Products .NET Client Library for SIMATIC S7 Webserver API < V3.3.61 Product Status: known_affected Remediations .NET Client Library for SIMATIC S7 Webserver API < V3.3.62 Product Status: known_affected Remediations Vendor fix Update to V3.3.62 or later version Additional Metrics Relevant CWE: CWE-209 Generation of Error Message Containing Sensitive Information CVSS Version Base Score Base Severity Vector String 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N View CVE Details
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 59：www.cisa.gov
r fixes and recommends mitigations for products where fixes are not or not yet available. The following versions of Siemens WinCC are affected: SIMATIC WinCC V7.5 vers:all/* (CVE-2026-59241) SIMATIC WinCC V8.0 vers:intdot/<8.0.0.11 (CVE-2026-59241) SIMATIC WinCC V8.1 vers:intdot/<8.1.7 (CVE-2026-59241) CVSS Vendor Equipment v3 8.8 Siemens SIMATIC WinCC V7.5 1 Vulnerability Incorrect Privilege Assignment Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 60：www.cisa.gov
518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 61：www.cisa.gov
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available Additional Metrics Relevant CWE: CWE-20 Improper Input Validation CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2023-52927 CVE-2023-53292 CVE-2023-54271 CVE-2024-26982 CVE-2024-36922 CVE-2024-40945 CVE-2024-47809 CVE-2024-49998 CVE-2024-53166 CVE-2024-56647 CVE-2024-56657 CVE-2024-56719 CVE-2024-57977 CVE-2024-57979 CVE-2024-57980 CVE-2024-57981 CVE-2024-57986 CVE-2024-57993 CVE-2024-57996 CVE-2024-58002 CVE-2024-58005 CVE-2024-58009 CVE-2024-58013 CVE-2024-58014 CVE-2024-58017 CVE-2024-58020 CVE-2024-58058 CVE-2024-58061 CVE-2024-58063 CVE-2024-58068 CVE-2024-58071 CVE-2024-58072 CVE-2024-58077 CVE-2024-58079 CVE-2024-58083 CVE-2025-21682 CVE-2025-21700 CVE-2025-21702 CVE-2025-21703 CVE-2025-21704 CVE-2025-21705 CVE-2025-21706 CVE-2025-21707 CVE-2025-21708 CVE-2025-21716 CVE-2025-21719 CVE-2025-21724 CVE-2025-
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 62：www.cisa.gov
ct RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine CVSS Version Base Score Base Severity Vector String 3.1 4.6 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L View CVE Details CVE-2026-33388 An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials. Read More 2 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affecte
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 63：www.cisa.gov
cbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS. Mitigation InterSystems documentation explains how to configure the server to require TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver Mitigation For more information about how to configure a system to mitiga
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 64：www.cisa.gov
Industrial Edge Cloud Device (IECD) < V1.28.1 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version Industrial Edge Own Device (IEOD) < V1.28.1 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version Industrial Edge Virtual Device (IEVD) < V1.28.1 Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SCALANCE LPE9433 (6GK5998-3GS11-2AC2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) < V1.28.1-2 Product Status: known_affected Remediations Mitigation Ensure network access to af
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 65：www.cisa.gov
Affected Product Kiloview E3 Firmware: <1.30 Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H View CVE Details CVE-2026-111100 The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks. Read More 2 Affected Products Kiloview E3 Firmware: <1.30 Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: <1.30 Product Status: known_affected Remediations Mitigation KiloView recommends u
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en
抜粋 66：www.cisa.gov
ion InterSystems IRIS for Health: 2026.2.0.221 Product Status: known_affected Remediations Mitigation InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS. Mitigation InterSystems documentation explains how to configure the server to require TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver Mitigation For more information about how to configure a system to mitigate this vulnerability, contact InterSystems at their world wide response center: https://wrc.intersystems.com (login required) InterSystems Corporation InterSystems IRIS for Health: 2026.1.0.235 Product Status: known_affected Remediations Mitigation InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist Note that there are three settings: "Di
この抜粋の出典を開く
取得元の項目：article:summary-vulnerabilities-remediations ／言語：en

悪用状況の「未確認」は、悪用されていないことを意味しません。対策は製品・バージョン・利用条件によって異なります。適用前に情報源とご自身の環境を確認してください。

情報の出典と更新日時

識別子: JVNVU98747108
情報源での公開: 2026/10/23 11:00 JST
情報源での更新: 2026/10/23 11:00 JST
当サイトの取得: 2026/10/23 12:17 JST
CVSSスコア: このデータでは未評価
説明の作成方法: 公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。

情報源ごとの取得日時

原典の更新日時と当サイトの取得日時は、情報源ごとに異なります。上の更新・取得日時は、それぞれの最新値です。

JVN原典の更新：2026/10/23 11:00 JST取得：2026/10/23 11:17 JST
JVN原典の更新：2026/10/23 11:00 JST取得：2026/10/23 12:17 JST

原文と条件を確認

米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。