Siemens Vulnerabilities and Affected Products
Vulnerabilities associated with SIDIS Prime.
Products
Clear product- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP569 vulnerabilities
- SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP569 vulnerabilities
- SIPLUS S7-1500 CPU 1518-4 PN/DP MFP569 vulnerabilities
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem455 vulnerabilities
- RUGGEDCOM RST2428P276 vulnerabilities
- SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family197 vulnerabilities
- SIMATIC CN 4100186 vulnerabilities
- SCALANCE XCM-/XRM-/XCH-/XRH-300 family179 vulnerabilities
- JT2Go153 vulnerabilities
- Teamcenter Visualization93 vulnerabilities
- RUGGEDCOM APE180880 vulnerabilities
- RUGGEDCOM ROX MX500078 vulnerabilities
- RUGGEDCOM ROX RX140078 vulnerabilities
- RUGGEDCOM ROX RX150078 vulnerabilities
- RUGGEDCOM ROX RX150178 vulnerabilities
- RUGGEDCOM ROX RX151078 vulnerabilities
- RUGGEDCOM ROX RX151178 vulnerabilities
- RUGGEDCOM ROX RX151278 vulnerabilities
- RUGGEDCOM ROX RX152478 vulnerabilities
- RUGGEDCOM ROX RX153678 vulnerabilities
- RUGGEDCOM ROX RX500078 vulnerabilities
- Tecnomatix Plant Simulation V230275 vulnerabilities
- RUGGEDCOM ROX MX5000RE74 vulnerabilities
- TeleControl Server Basic70 vulnerabilities
- SINEC NMS68 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-15467CRITICAL | Stack buffer overflow in CMS (Auth)EnvelopedData parsingIssue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length… | CVSS9.8v3.1 | EPSS47.6% | PoCs6 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-22610HIGH | Angular has XSS Vulnerability via Unsanitized SVG Script AttributesAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in v… CWE-79Jan 10, 2026 | CVSS8.5v4.0 | EPSS0.451% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-66412HIGH | Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML AttributesAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., … CWE-79Dec 1, 2025 | CVSS8.5v4.0 | EPSS0.403% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-66035HIGH | Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLsAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism t… | CVSS7.7v4.0 | EPSS0.645% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-9232MEDIUM | Out-of-bounds read in HTTP client no_proxy handlingIssue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate M… CWE-125Sep 30, 2025 | CVSS5.9v3.1 | EPSS2.25% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-9230HIGH | Out-of-bounds read & write in RFC 3211 KEK UnwrapIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could… | CVSS7.5v3.1 | EPSS1.74% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-6965HIGH | Integer Truncation on SQLiteThere exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. CWE-197Jul 15, 2025 | CVSS7.2v4.0 | EPSS74.9% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-9143MEDIUM | Low-level invalid GF(2^m) parameters lead to OOB memory accessIssue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 en… | CVSS4.3v3.1 | EPSS5.84% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-41996HIGH | Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. CWE-295Aug 26, 2024 | CVSS7.5v3.1 | EPSS1.08% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-5535CRITICAL | SSL_select_next_proto buffer overreadIssue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that di… | CVSS9.1v3.1 | EPSS5.58% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-0727MEDIUM | PKCS12 Decoding crashesIssue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereferen… CWE-476Jan 26, 2024 | CVSS5.5v3.1 | EPSS3.19% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-5678MEDIUM | Excessive time spent in DH check / generation with large Q parameter valueIssue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been ob… | CVSS5.3v3.1 | EPSS4.46% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-5363HIGH | Incorrect cipher key & IV length processingIssue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have… CWE-684Oct 24, 2023 | CVSS7.5v3.1 | EPSS3.33% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |