ByteOS

SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8

Product

Versions

Affected

SINUMERIK 808D V4.7 : All versions
SINUMERIK 808D V4.8 : All versions
SINUMERIK 828D V4.7 : All versions < V4.7 SP6 HF1
SINUMERIK 840D sl V4.7 : All versions < V4.7 SP6 HF5
SINUMERIK 840D sl V4.8 : All versions < V4.8 SP3

Problem Types

Type	CWE ID	Description
CWE	CWE-248	CWE-248: Uncaught Exception

Type: CWE

CWE ID: CWE-248

Description: CWE-248: Uncaught Exception

References

Hyperlink	Resource
http://www.securityfocus.com/bid/106185	vdb-entry x_refsource_BID
https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf	x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/bid/106185

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.securityfocus.com/bid/106185	vdb-entry x_refsource_BID x_transferred
https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf	x_refsource_CONFIRM x_transferred

Hyperlink: http://www.securityfocus.com/bid/106185

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:productcert@siemens.com

Published At:12 Dec, 2018 | 16:29

Updated At:09 Oct, 2019 | 23:33

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.0

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

cpe:2.3:o:siemens:sinumerik_808d_v4.7_firmware:*:*:*:*:*:*:*:*

>>sinumerik_808d_v4.7_firmware>>*

cpe:2.3:h:siemens:sinumerik_808d_v4.7:-:*:*:*:*:*:*:*

>>sinumerik_808d_v4.7>>-

cpe:2.3:o:siemens:sinumerik_808d_v4.8_firmware:*:*:*:*:*:*:*:*

>>sinumerik_808d_v4.8_firmware>>*

cpe:2.3:h:siemens:sinumerik_808d_v4.8:-:*:*:*:*:*:*:*

>>sinumerik_808d_v4.8>>-

cpe:2.3:o:siemens:sinumerik_840d_sl_v4.7_firmware:*:*:*:*:*:*:*:*

>>sinumerik_840d_sl_v4.7_firmware>>Versions up to 4.7(inclusive)

cpe:2.3:h:siemens:sinumerik_840d_sl_v4.7:-:*:*:*:*:*:*:*

>>sinumerik_840d_sl_v4.7>>-

cpe:2.3:o:siemens:sinumerik_840d_sl_v4.8_firmware:*:*:*:*:*:*:*:*

>>sinumerik_840d_sl_v4.8_firmware>>Versions up to 4.8(inclusive)

cpe:2.3:h:siemens:sinumerik_840d_sl_v4.8:-:*:*:*:*:*:*:*

>>sinumerik_840d_sl_v4.8>>-

cpe:2.3:o:siemens:sinumerik_828d_v4.7_firmware:*:*:*:*:*:*:*:*

>>sinumerik_828d_v4.7_firmware>>Versions up to 4.7(inclusive)

cpe:2.3:h:siemens:sinumerik_828d_v4.7:-:*:*:*:*:*:*:*

>>sinumerik_828d_v4.7>>-

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-248	Secondary	productcert@siemens.com

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-248

Type: Secondary

Source: productcert@siemens.com

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/106185	productcert@siemens.com	Third Party Advisory VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf	productcert@siemens.com	Vendor Advisory

Hyperlink: http://www.securityfocus.com/bid/106185

Source: productcert@siemens.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf

Source: productcert@siemens.com

Resource:

Vendor Advisory

Similar CVEs

132Records found

CVE-2021-27384

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.43% / 80.72%

7 Day CHG~0.00%

Published-12 May, 2021 | 13:18

Updated-03 Aug, 2024 | 20:48

A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has an out-of-bounds memory access vulnerability in the device layout handler, represented by a binary data stream on client side, which can potentially result in code execution.

Vendor-Siemens AG

CWE ID-CWE-788

Access of Memory Location After End of Buffer

CVE-2021-27389

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-0.41% / 61.23%

7 Day CHG~0.00%

Published-22 Apr, 2021 | 20:42

Updated-03 Aug, 2024 | 20:48

A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequate protection.

Vendor-Siemens AG

Product-opcenter_quality qms_automotive QMS Automotive Opcenter Quality

CWE ID-CWE-321

Use of Hard-coded Cryptographic Key

CVE-2021-25669

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.71% / 82.40%

7 Day CHG~0.00%

Published-22 Apr, 2021 | 20:42

Updated-03 Aug, 2024 | 20:11

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT PRO (All versions < 5.5.1), SCALANCE X202-2 IRT (All versions < 5.5.1), SCALANCE X202-2P IRT (incl. SIPLUS NET variant) (All versions < 5.5.1), SCALANCE X202-2P IRT PRO (All versions < 5.5.1), SCALANCE X204 IRT (All versions < 5.5.1), SCALANCE X204 IRT PRO (All versions < 5.5.1), SCALANCE X204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X204-2FM (All versions < V5.2.5), SCALANCE X204-2LD (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2TS (All versions < V5.2.5), SCALANCE X206-1 (All versions < V5.2.5), SCALANCE X206-1LD (All versions < V5.2.5), SCALANCE X208 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X208PRO (All versions < V5.2.5), SCALANCE X212-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X212-2LD (All versions < V5.2.5), SCALANCE X216 (All versions < V5.2.5), SCALANCE X224 (All versions < V5.2.5), SCALANCE XF201-3P IRT (All versions < 5.5.1), SCALANCE XF202-2P IRT (All versions < 5.5.1), SCALANCE XF204 (All versions < V5.2.5), SCALANCE XF204 IRT (All versions < 5.5.1), SCALANCE XF204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE XF204-2BA IRT (All versions < 5.5.1), SCALANCE XF206-1 (All versions < V5.2.5), SCALANCE XF208 (All versions < V5.2.5). Incorrect processing of POST requests in the web server may write out of bounds in stack. An attacker might leverage this to denial-of-service of the device or remote code execution.

Vendor-Siemens AG

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-11462

Matching Score-8

Assigner-Siemens

Product-sinumerik_808d_v4.8 sinumerik_840d_sl_v4.7 sinumerik_808d_v4.7_firmware sinumerik_828d_v4.7_firmware sinumerik_840d_sl_v4.7_firmware sinumerik_840d_sl_v4.8 sinumerik_828d_v4.7 sinumerik_840d_sl_v4.8_firmware sinumerik_808d_v4.8_firmware sinumerik_808d_v4.7 SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-10.54% / 93.29%

7 Day CHG~0.00%

Published-12 Dec, 2018 | 16:00

Updated-05 Aug, 2024 | 08:10

A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). By sending a specially crafted authentication request to the affected systems a remote attacker could escalate his privileges to an elevated user account but not to root. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Vendor-Siemens AG

CWE ID-CWE-264

Not Available

CVE-2021-25668

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.28% / 79.64%

7 Day CHG~0.00%

Published-22 Apr, 2021 | 20:42

Updated-03 Aug, 2024 | 20:11

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT PRO (All versions < 5.5.1), SCALANCE X202-2 IRT (All versions < 5.5.1), SCALANCE X202-2P IRT (incl. SIPLUS NET variant) (All versions < 5.5.1), SCALANCE X202-2P IRT PRO (All versions < 5.5.1), SCALANCE X204 IRT (All versions < 5.5.1), SCALANCE X204 IRT PRO (All versions < 5.5.1), SCALANCE X204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X204-2FM (All versions < V5.2.5), SCALANCE X204-2LD (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2TS (All versions < V5.2.5), SCALANCE X206-1 (All versions < V5.2.5), SCALANCE X206-1LD (All versions < V5.2.5), SCALANCE X208 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X208PRO (All versions < V5.2.5), SCALANCE X212-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X212-2LD (All versions < V5.2.5), SCALANCE X216 (All versions < V5.2.5), SCALANCE X224 (All versions < V5.2.5), SCALANCE XF201-3P IRT (All versions < 5.5.1), SCALANCE XF202-2P IRT (All versions < 5.5.1), SCALANCE XF204 (All versions < V5.2.5), SCALANCE XF204 IRT (All versions < 5.5.1), SCALANCE XF204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE XF204-2BA IRT (All versions < 5.5.1), SCALANCE XF206-1 (All versions < V5.2.5), SCALANCE XF208 (All versions < V5.2.5). Incorrect processing of POST requests in the webserver may result in write out of bounds in heap. An attacker might leverage this to cause denial-of-service on the device and potentially remotely execute code.

Vendor-Siemens AG

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-25149

Matching Score-8

Assigner-Hewlett Packard Enterprise (HPE)

Matching Score-8

Assigner-Hewlett Packard Enterprise (HPE)

CVSS Score-9.8||CRITICAL

EPSS-0.71% / 72.27%

7 Day CHG~0.00%

Published-29 Mar, 2021 | 23:58

Updated-03 Aug, 2024 | 19:56

A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

Vendor-n/a Siemens AG Aruba Networks

Product-scalance_w1750d_firmware instant scalance_w1750d Aruba Instant Access Points

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-22930

Matching Score-8

Assigner-HackerOne

Matching Score-8

Assigner-HackerOne

CVSS Score-9.8||CRITICAL

EPSS-0.32% / 55.37%

7 Day CHG~0.00%

Published-07 Oct, 2021 | 00:00

Updated-30 Apr, 2025 | 22:24

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Vendor-Node.js (OpenJS Foundation)NetApp, Inc.Siemens AG Debian GNU/Linux

Product-sinec_infrastructure_network_services nextgen_api debian_linux node.js Node

CWE ID-CWE-416

Use After Free

CVE-2021-22931

Matching Score-8

Assigner-HackerOne

Product-sinec_infrastructure_network_services peoplesoft_enterprise_peopletools graalvm mysql_cluster nextgen_api active_iq_unified_manager oncommand_workflow_automation snapcenter node.js oncommand_insight Node

Matching Score-8

Assigner-HackerOne

CVSS Score-9.8||CRITICAL

EPSS-0.66% / 71.19%

7 Day CHG~0.00%

Published-16 Aug, 2021 | 00:00

Updated-30 Apr, 2025 | 22:24

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

Vendor-Oracle Corporation Node.js (OpenJS Foundation)NetApp, Inc.Siemens AG

CWE ID-CWE-170

Improper Null Termination

CWE ID-CWE-20

Improper Input Validation

CVE-2016-20009

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.42% / 61.77%

7 Day CHG~0.00%

Published-11 Mar, 2021 | 21:39

Updated-06 Aug, 2024 | 04:16

A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Vendor-windriver n/a Siemens AG

Product-sgt-400 sgt-a65_firmware sgt-100 sgt-300_firmware vxworks sgt-200_firmware sgt-400_firmware sgt-a20 sgt-100_firmware sgt-200 sgt-300 sgt-a35 sgt-a65 sgt-a35_firmware sgt-a20_firmware n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-7593

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-17.29% / 95.05%

7 Day CHG~0.00%

Published-14 Jul, 2020 | 13:18

Updated-04 Aug, 2024 | 09:33

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.01), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.02). A buffer overflow vulnerability exists in the Web Server functionality of the device. A remote unauthenticated attacker could send a specially crafted HTTP request to cause a memory corruption, potentially resulting in remote code execution.

Vendor-Siemens AG

Product-logo\!_8_bm logo\!_8_bm_firmware LOGO! 8 BM (incl. SIPLUS variants)

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2017-6869

Matching Score-8

Assigner-Siemens

Product-viewport_for_web_office_portal ViewPort for Web Office Portal before revision number 1453

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.47% / 80.99%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload arbitrary code and execute it with the permissions of the operating-system user running the web server by sending specially crafted network packets to port 443/TCP or port 80/TCP.

Vendor-n/a Siemens AG

CWE ID-CWE-287

Improper Authentication

CVE-2014-1697

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-4.51% / 89.15%

7 Day CHG~0.00%

Published-07 Feb, 2014 | 02:00

Updated-11 Apr, 2025 | 00:51

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.

Vendor-n/a Siemens AG

Product-simatic_wincc_open_architecture n/a

CVE-2018-13816

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-10||CRITICAL

EPSS-2.92% / 86.40%

7 Day CHG~0.00%

Published-12 Dec, 2018 | 16:00

Updated-05 Aug, 2024 | 09:14

A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication on port 102/tcp, although configured. Successful exploitation requires an attacker to be able to send packets to port 102/tcp of the affected device. No user interaction and no user privileges are required to exploit the vulnerability. At the time of advisory publication no public exploitation of this vulnerability was known.

Vendor-Siemens AG

Product-tim_1531_irc_firmware tim_1531_irc TIM 1531 IRC

CWE ID-CWE-284

Improper Access Control

CWE ID-CWE-287

Improper Authentication

CVE-2019-8271

Matching Score-8

Assigner-Kaspersky

Matching Score-8

Assigner-Kaspersky

CVSS Score-9.8||CRITICAL

EPSS-4.00% / 88.44%

7 Day CHG~0.00%

Published-09 Mar, 2019 | 00:00

Updated-16 Sep, 2024 | 23:26

UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which can potentially result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.

Product-sinumerik_pcu_base_win10_software\/ipc ultravnc sinumerik_pcu_base_win7_software\/ipc sinumerik_access_mymachine\/p2p UltraVNC

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2007-1915

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-4.96% / 89.69%

7 Day CHG~0.00%

Published-10 Apr, 2007 | 23:00

Updated-07 Aug, 2024 | 13:13

Buffer overflow in the RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.

Vendor-n/a Microsoft Corporation SAP SE Apple Inc.Siemens AG IBM Corporation HP Inc.Linux Kernel Organization, Inc

Product-os_400 windows_server linux_kernel racf hp-ux tru64 reliant_unix macos rfc_library aix n/a

CVE-2021-31895

Matching Score-8

Assigner-Siemens

Product-ruggedcom_ros_rs900 ruggedcom_ros_m2100 ruggedcom_rst916p ruggedcom_ros_rs900l ruggedcom_ros_rs910w ruggedcom_ros_rs969 ruggedcom_i802 ruggedcom_ros_rs920l ruggedcom_rsg2300p ruggedcom_ros_rs910l ruggedcom_rs910l ruggedcom_rmc30 ruggedcom_ros_rmc30 ruggedcom_rs900w ruggedcom_ros_rsg2200 ruggedcom_ros_rsg900r ruggedcom_rs8000t ruggedcom_rs940g ruggedcom_ros_i803 ruggedcom_m969 ruggedcom_rs930l ruggedcom_ros_m2200 ruggedcom_rsg2100 ruggedcom_ros_rsg2288 ruggedcom_rsg2100p ruggedcom_ros_rmc ruggedcom_rsg900g ruggedcom_rs8000 ruggedcom_rs910w ruggedcom_ros_rsg900 ruggedcom_ros_rsl910 ruggedcom_ros_rs416 ruggedcom_ros_rs930w ruggedcom_ros_m969 ruggedcom_ros_rsg2300p ruggedcom_i803 ruggedcom_ros_rsg900g ruggedcom_ros_rsg920p ruggedcom_rsg900r ruggedcom_ros_rp110 ruggedcom_rs401 ruggedcom_rs900 ruggedcom_ros_rmc8388 ruggedcom_ros_rs900g ruggedcom_rmc41 ruggedcom_rs900g ruggedcom_rs910 ruggedcom_ros_rsg2100 ruggedcom_rsg920p ruggedcom_rp110 ruggedcom_ros_rmc41 ruggedcom_ros_rsg2300 ruggedcom_ros_i802 ruggedcom_rs416 ruggedcom_ros_rst916c ruggedcom_rs8000h ruggedcom_rs920l ruggedcom_ros_rst916p ruggedcom_rmc8388 ruggedcom_ros_rs416v2 ruggedcom_ros_rs8000 ruggedcom_ros_rs8000a ruggedcom_ros_rst2228 ruggedcom_rs400 ruggedcom_ros_rs900w ruggedcom_ros_rs930l ruggedcom_ros_rs940g ruggedcom_rs969 ruggedcom_m2100 ruggedcom_ros_i800 ruggedcom_rsg2288 ruggedcom_rsg900 ruggedcom_m2200 ruggedcom_ros_rs920w ruggedcom_ros_rs401 ruggedcom_ros_rs910 ruggedcom_rsg2300 ruggedcom_rsg2488 ruggedcom_rsg900c ruggedcom_ros_rsg900c ruggedcom_rsg2200 ruggedcom_rmc20 ruggedcom_rs416v2 ruggedcom_ros_rsg2488 ruggedcom_ros_rsg2100p ruggedcom_rmc40 ruggedcom_rs930w ruggedcom_rs920w ruggedcom_rs900l ruggedcom_ros_rs8000t ruggedcom_rmc ruggedcom_rs900gp ruggedcom_ros_rs400 ruggedcom_rs8000a ruggedcom_ros_rmc40 ruggedcom_ros_rs900gp ruggedcom_ros_rs8000h ruggedcom_ros_rmc20 ruggedcom_i801 ruggedcom_rst2228 ruggedcom_ros_i801 ruggedcom_rsl910 ruggedcom_i800 ruggedcom_rst916c RUGGEDCOM RST916P RUGGEDCOM RSG2488 V4.X RUGGEDCOM RS969 RUGGEDCOM RS900G RUGGEDCOM i801 RUGGEDCOM RSG920P V5.X RUGGEDCOM RS930L RUGGEDCOM RS1600T RUGGEDCOM RS401 RUGGEDCOM RS900G (32M) V5.X RUGGEDCOM RSG920P V4.X RUGGEDCOM RS920L RUGGEDCOM M2200 RUGGEDCOM RSG910C RUGGEDCOM RS416Pv2 V4.X RUGGEDCOM RSG2100P RUGGEDCOM RSG2288 V4.X RUGGEDCOM RS8000T RUGGEDCOM RS8000H RUGGEDCOM RS900 (32M) V4.X RUGGEDCOM M2100 RUGGEDCOM RSG2100 (32M) V4.X RUGGEDCOM RSG2300 V4.X RUGGEDCOM RS416Pv2 V5.X RUGGEDCOM RSG2300 V5.X RUGGEDCOM RS8000 RUGGEDCOM RS900L RUGGEDCOM RMC8388 V5.X RUGGEDCOM RS400 RUGGEDCOM RS910L RUGGEDCOM RSG907R RUGGEDCOM RSL910 RUGGEDCOM RS900GP RUGGEDCOM RST916C RUGGEDCOM RSG2200 RUGGEDCOM RSG2488 V5.X RUGGEDCOM RS940G RUGGEDCOM RMC8388 V4.X RUGGEDCOM RSG2100 (32M) V5.X RUGGEDCOM RSG2100P (32M) V4.X RUGGEDCOM RS910W RUGGEDCOM RS910 RUGGEDCOM RS1600F RUGGEDCOM RS900G (32M) V4.X RUGGEDCOM RSG2100 RUGGEDCOM RMC30 RUGGEDCOM RSG2288 V5.X RUGGEDCOM RSG2300P V4.X RUGGEDCOM RSG908C RUGGEDCOM RS416v2 V4.X RUGGEDCOM i800 RUGGEDCOM RSG909R RUGGEDCOM i802 RUGGEDCOM RP110 RUGGEDCOM RS1600 RUGGEDCOM RS416P RUGGEDCOM RST2228P RUGGEDCOM RSG2100P (32M) V5.X RUGGEDCOM RS8000A RUGGEDCOM RS416v2 V5.X RUGGEDCOM RS920W RUGGEDCOM M969 RUGGEDCOM RS900 (32M) V5.X RUGGEDCOM RST2228 RUGGEDCOM RS416 RUGGEDCOM RS930W RUGGEDCOM RSG2300P V5.X RUGGEDCOM i803 RUGGEDCOM RS900W

Matching Score-8

Assigner-Siemens

CVSS Score-8.1||HIGH

EPSS-1.16% / 78.62%

7 Day CHG~0.00%

Published-13 Jul, 2021 | 11:02

Updated-14 Oct, 2025 | 10:15

A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.7), RUGGEDCOM i801 (All versions < V4.3.7), RUGGEDCOM i802 (All versions < V4.3.7), RUGGEDCOM i803 (All versions < V4.3.7), RUGGEDCOM M2100 (All versions < V4.3.7), RUGGEDCOM M2200 (All versions < V4.3.7), RUGGEDCOM M969 (All versions < V4.3.7), RUGGEDCOM RMC30 (All versions < V4.3.7), RUGGEDCOM RMC8388 V4.X (All versions < V4.3.7), RUGGEDCOM RMC8388 V5.X (All versions < V5.5.4), RUGGEDCOM RP110 (All versions < V4.3.7), RUGGEDCOM RS1600 (All versions < V4.3.7), RUGGEDCOM RS1600F (All versions < V4.3.7), RUGGEDCOM RS1600T (All versions < V4.3.7), RUGGEDCOM RS400 (All versions < V4.3.7), RUGGEDCOM RS401 (All versions < V4.3.7), RUGGEDCOM RS416 (All versions < V4.3.7), RUGGEDCOM RS416P (All versions < V4.3.7), RUGGEDCOM RS416Pv2 V4.X (All versions < V4.3.7), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.5.4), RUGGEDCOM RS416v2 V4.X (All versions < V4.3.7), RUGGEDCOM RS416v2 V5.X (All versions < 5.5.4), RUGGEDCOM RS8000 (All versions < V4.3.7), RUGGEDCOM RS8000A (All versions < V4.3.7), RUGGEDCOM RS8000H (All versions < V4.3.7), RUGGEDCOM RS8000T (All versions < V4.3.7), RUGGEDCOM RS900 (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RS900G (All versions < V4.3.7), RUGGEDCOM RS900G (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RS900GP (All versions < V4.3.7), RUGGEDCOM RS900L (All versions < V4.3.7), RUGGEDCOM RS900W (All versions < V4.3.7), RUGGEDCOM RS910 (All versions < V4.3.7), RUGGEDCOM RS910L (All versions < V4.3.7), RUGGEDCOM RS910W (All versions < V4.3.7), RUGGEDCOM RS920L (All versions < V4.3.7), RUGGEDCOM RS920W (All versions < V4.3.7), RUGGEDCOM RS930L (All versions < V4.3.7), RUGGEDCOM RS930W (All versions < V4.3.7), RUGGEDCOM RS940G (All versions < V4.3.7), RUGGEDCOM RS969 (All versions < V4.3.7), RUGGEDCOM RSG2100 (All versions < V4.3.7), RUGGEDCOM RSG2100 (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RSG2100P (All versions < V4.3.7), RUGGEDCOM RSG2100P (32M) V4.X (All versions < V4.3.7), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.5.4), RUGGEDCOM RSG2200 (All versions < V4.3.7), RUGGEDCOM RSG2288 V4.X (All versions < V4.3.7), RUGGEDCOM RSG2288 V5.X (All versions < V5.5.4), RUGGEDCOM RSG2300 V4.X (All versions < V4.3.7), RUGGEDCOM RSG2300 V5.X (All versions < V5.5.4), RUGGEDCOM RSG2300P V4.X (All versions < V4.3.7), RUGGEDCOM RSG2300P V5.X (All versions < V5.5.4), RUGGEDCOM RSG2488 V4.X (All versions < V4.3.7), RUGGEDCOM RSG2488 V5.X (All versions < V5.5.4), RUGGEDCOM RSG907R (All versions < V5.5.4), RUGGEDCOM RSG908C (All versions < V5.5.4), RUGGEDCOM RSG909R (All versions < V5.5.4), RUGGEDCOM RSG910C (All versions < V5.5.4), RUGGEDCOM RSG920P V4.X (All versions < V4.3.7), RUGGEDCOM RSG920P V5.X (All versions < V5.5.4), RUGGEDCOM RSL910 (All versions < V5.5.4), RUGGEDCOM RST2228 (All versions < V5.5.4), RUGGEDCOM RST2228P (All versions < V5.5.4), RUGGEDCOM RST916C (All versions < V5.5.4), RUGGEDCOM RST916P (All versions < V5.5.4). The DHCP client in affected devices fails to properly sanitize incoming DHCP packets. This could allow an unauthenticated remote attacker to cause memory to be overwritten, potentially allowing remote code execution.

Vendor-Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE ID-CWE-787

Out-of-bounds Write

CVE-2005-2424

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.64% / 81.99%

7 Day CHG~0.00%

Published-03 Aug, 2005 | 04:00

Updated-16 Apr, 2026 | 00:27

The management interface for Siemens SANTIS 50 running firmware 4.2.8.0, and possibly other products including Ericsson HN294dp and Dynalink RTA300W, allows remote attackers to access the Telnet port without authentication via certain packets to the web interface that cause the interface to freeze.

Vendor-n/a Siemens AG

Product-santis_50 n/a

CVE-2019-6580

Matching Score-8

Assigner-Siemens

Product-siveillance_video_management_software_2017_r2 siveillance_video_management_software_2019_r1 siveillance_video_management_software_2018_r2 siveillance_video_management_software_2018_r1 siveillance_video_management_software_2018_r3 Siveillance VMS 2018 R3 Siveillance VMS 2018 R1 Siveillance VMS 2019 R1 Siveillance VMS 2017 R2 Siveillance VMS 2018 R2

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-0.38% / 59.48%

7 Day CHG~0.00%

Published-12 Jun, 2019 | 13:47

Updated-04 Aug, 2024 | 20:23

A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R2 (All versions < V12.2a), Siveillance VMS 2018 R3 (All versions < V12.3a), Siveillance VMS 2019 R1 (All versions < V13.1a). An attacker with network access to port 80/TCP could change device properties without authorization. No user interaction is required to exploit this security vulnerability. Successful exploitation compromises confidentiality, integrity and availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Vendor-Siemens AG

CWE ID-CWE-862

Missing Authorization

CVE-2013-3958

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.42% / 62.20%

7 Day CHG~0.00%

Published-14 Jun, 2013 | 19:00

Updated-11 Apr, 2025 | 00:51

The login implementation in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, has a hardcoded account, which makes it easier for remote attackers to obtain access via an unspecified request.

Vendor-n/a Siemens AG

Product-simatic_pcs7 wincc n/a

CVE-2013-3957

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.34% / 56.58%

7 Day CHG~0.00%

Published-14 Jun, 2013 | 19:00

Updated-11 Apr, 2025 | 00:51

SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Vendor-n/a Siemens AG

Product-simatic_pcs7 wincc n/a

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2013-3634

Matching Score-8

Assigner-MITRE Corporation

Product-scalance_x204irt scalance_x200-4p_irt scalance_x202-2p_irt scalance_x202-2irt scalance_x200irt_firmware scalance_xf204irt scalance_x201-3p_irt n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.30% / 52.93%

7 Day CHG~0.00%

Published-24 May, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions < V5.0.0 for CVE-2013-3633 and versions < V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.1.0). The implementation of SNMPv3 does not check the user credentials sufficiently. Therefore, an attacker is able to execute SNMP commands without correct credentials.

Vendor-n/a Siemens AG

CWE ID-CWE-20

Improper Input Validation

CVE-1999-0017

Matching Score-8

Assigner-MITRE Corporation

Vendor-washington_university sco n/a Siemens AG IBM Corporation NetBSD FreeBSD Foundation GNU Sun Microsystems (Oracle Corporation)The MITRE Corporation (Caldera)

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.55% / 67.84%

7 Day CHG~0.00%

Published-29 Sep, 1999 | 04:00

Updated-16 Apr, 2026 | 00:27

FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce.

Product-openserver sunos openlinux reliant_unix wu-ftpd inet freebsd aix unixware netbsd open_desktop n/a

CVE-2020-27304

Matching Score-8

Assigner-JFrog

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-8

Assigner-JFrog

CVSS Score-9.8||CRITICAL

EPSS-1.00% / 76.98%

7 Day CHG~0.00%

Published-21 Oct, 2021 | 15:42

Updated-04 Aug, 2024 | 16:11

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API. Web applications that use the file upload form handler, and use parts of the user-controlled filename in the output path, are susceptible to directory traversal

Vendor-civetweb_project civetweb_project Siemens AG

Product-sinec_infrastructure_network_services civetweb civetweb

CWE ID-CWE-23

Relative Path Traversal

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2012-3020

Matching Score-8

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-8

CVSS Score-7.5||HIGH

EPSS-0.44% / 63.29%

7 Day CHG~0.00%

Published-06 Aug, 2012 | 16:00

Updated-11 Apr, 2025 | 00:51

The Siemens Synco OZW Web Server devices OZW672.*, OZW772.*, and OZW775 with firmware before 4 have an unspecified default password, which makes it easier for remote attackers to obtain administrative access via a network session.

Vendor-n/a Siemens AG

Product-synco_ozw_web_server synco_ozw_web_server_firmware n/a

CVE-2022-29873

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.3||CRITICAL

EPSS-2.95% / 86.48%

7 Day CHG~0.00%

Published-10 May, 2022 | 09:47

Updated-09 Dec, 2025 | 16:17

A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device.

Vendor-Siemens AG

CWE ID-CWE-141

Improper Neutralization of Parameter/Argument Delimiters

CVE-2019-18293

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-2.55% / 85.52%

7 Day CHG~0.00%

Published-12 Dec, 2019 | 19:08

Updated-05 Aug, 2024 | 01:47

A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18289, CVE-2019-18295, and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.

Vendor-Siemens AG

Product-sppa-t3000_ms3000_migration_server SPPA-T3000 MS3000 Migration Server

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-15782

Matching Score-8

Assigner-Siemens

Product-s7-1200_cpu_firmware 6es7515-2fm01-0ab0 6es7516-3an02-0ab0 6es7515-2rm00-0ab0 6es7515-2am02-0ab0 6es7512-1ck00-0ab0 6es7513-1fl02-0ab0 6es7516-3fn02-0ab0 cpu_1214c simatic_driver_controller_firmware cpu_1212fc 6es7512-1dk01-0ab0 6es7517-3up00-0ab0 cpu_1515sp_pc 6es7513-1rl00-0ab0 6es7517-3fp00-0ab0 cpu_1211c 6es7512-1ck01-0ab0 6es7511-1uk01-0ab0 6es7515-2fm02-0ab0 6es7511-1fk02-0ab0 6es7515-2um01-0ab0 cpu_1507d_tf 6es7511-1ak02-0ab0 6es7513-1al02-0ab0 cpu_1217c 6es7513-2gl00-0ab0 et_200sp_open_controller_firmware cpu_1215fc 6es7510-1sj01-0ab0 cpu_1214fc 6es7516-3an01-0ab0 6es7518-4fp00-0ab0 6es7518-4fp00-3ab0 simatic_s7-1500__software_controller 6es7511-1fk01-0ab0 6es7515-2tm01-0ab0 6es7511-1ak01-0ab0 6es7513-2pl00-0ab0 cpu_1215c 6es7518-4ap00-0ab0 6es7516-3tn00-0ab0 6es7517-3ap00-0ab0 6es7517-3hp00-0ab0 6es7512-1sk01-0ab0 6es7518-4ap00-3ab0 cpu_1515sp_pc2 6es7515-2am01-0ab0 cpu_1504d_tf 6es7511-1ck00-0ab0 6es7511-1tk01-0ab0 6es7513-1al01-0ab0 6es7510-1dj01-0ab0 6es7513-1fl01-0ab0 6es7516-3fn01-0ab0 cpu_1212c 6es7517-3tp00-0ab0 6es7516-3un00-0ab0 6es7511-1ck01-0ab0 simatic_s7-plcsim_advanced 6es7516-2gn00-0ab0 s7-1500_cpu_firmware 6es7516-2pn00-0ab0 SINUMERIK ONE SIMATIC S7-1500 Software Controller SINAMICS PERFECT HARMONY GH180 Drives SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)SIMATIC Drive Controller family SIMATIC S7-1200 CPU family (incl. SIPLUS variants)SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)SINUMERIK MC SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)SIMATIC S7-PLCSIM Advanced

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-0.30% / 53.55%

7 Day CHG~0.00%

Published-28 May, 2021 | 16:10

Updated-04 Aug, 2024 | 13:22

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINAMICS PERFECT HARMONY GH180 Drives (Drives manufactured before 2021-08-13), SINUMERIK MC (All versions < V6.15), SINUMERIK ONE (All versions < V6.15). Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to port 102/tcp could potentially write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks.

Vendor-Siemens AG

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8274

Matching Score-8

Assigner-Kaspersky

Matching Score-8

Assigner-Kaspersky

CVSS Score-9.8||CRITICAL

EPSS-4.00% / 88.44%

7 Day CHG~0.00%

Published-09 Mar, 2019 | 00:00

Updated-16 Sep, 2024 | 19:35

UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.

Product-sinumerik_pcu_base_win10_software\/ipc ultravnc sinumerik_pcu_base_win7_software\/ipc sinumerik_access_mymachine\/p2p UltraVNC

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18922

Matching Score-8

Assigner-MITRE Corporation

Product-ubuntu_linux simatic_itc1500_pro simatic_itc1900 simatic_itc2200_pro_firmware simatic_itc2200 simatic_itc1500_pro_firmware simatic_itc1500 simatic_itc1900_firmware simatic_itc1900_pro_firmware simatic_itc1500_firmware fedora simatic_itc2200_firmware simatic_itc2200_pro libvncserver simatic_itc1900_pro leap n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.78% / 89.48%

7 Day CHG~0.00%

Published-30 Jun, 2020 | 11:00

Updated-05 Aug, 2024 | 21:45

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.

Vendor-libvncserver_project n/a Siemens AG Canonical Ltd.openSUSE Fedora Project

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-11656

Matching Score-8

Assigner-MITRE Corporation

Product-sinec_infrastructure_network_services communications_messaging_server ontap_select_deploy_administration_utility sqlite communications_network_charging_and_control zfs_storage_appliance_kit outside_in_technology tenable.sc hyperion_infrastructure_technology mysql_workbench enterprise_manager_ops_center mysql n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-6.08% / 90.78%

7 Day CHG+1.51%

Published-09 Apr, 2020 | 02:49

Updated-04 Aug, 2024 | 11:35

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

Vendor-sqlite n/a NetApp, Inc.Oracle Corporation Tenable, Inc.Siemens AG

CWE ID-CWE-416

Use After Free

CVE-2020-10042

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.30% / 79.73%

7 Day CHG~0.00%

Published-14 Jul, 2020 | 13:18

Updated-04 Aug, 2024 | 10:50

A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network.

Vendor-Siemens AG

Product-sicam_t_firmware sicam_mmu sicam_sgu_firmware sicam_mmu_firmware sicam_sgu sicam_t SICAM T SICAM MMU SICAM SGU

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2020-10038

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-0.39% / 60.24%

7 Day CHG~0.00%

Published-14 Jul, 2020 | 13:18

Updated-04 Aug, 2024 | 10:50

A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with access to the device's web server might be able to execute administrative commands without authentication.

Vendor-Siemens AG

Product-sicam_t_firmware sicam_mmu sicam_sgu_firmware sicam_mmu_firmware sicam_sgu sicam_t SICAM T SICAM MMU SICAM SGU

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2019-8272

Matching Score-8

Assigner-Kaspersky

Matching Score-8

Assigner-Kaspersky

CVSS Score-9.8||CRITICAL

EPSS-1.40% / 80.48%

7 Day CHG~0.00%

Published-09 Mar, 2019 | 00:00

Updated-16 Sep, 2024 | 16:43

UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.

Product-sinumerik_pcu_base_win10_software\/ipc ultravnc sinumerik_pcu_base_win7_software\/ipc sinumerik_access_mymachine\/p2p UltraVNC

CWE ID-CWE-193

Off-by-one Error

CVE-2019-8273

Matching Score-8

Assigner-Kaspersky

Matching Score-8

Assigner-Kaspersky

CVSS Score-9.8||CRITICAL

EPSS-4.00% / 88.44%

7 Day CHG~0.00%

Published-09 Mar, 2019 | 00:00

Updated-16 Sep, 2024 | 23:16

UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.

Product-sinumerik_pcu_base_win10_software\/ipc ultravnc sinumerik_pcu_base_win7_software\/ipc sinumerik_access_mymachine\/p2p UltraVNC

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8268

Matching Score-8

Assigner-Kaspersky

Matching Score-8

Assigner-Kaspersky

CVSS Score-9.8||CRITICAL

EPSS-1.40% / 80.48%

7 Day CHG~0.00%

Published-09 Mar, 2019 | 00:00

Updated-17 Sep, 2024 | 01:16

UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which can potentially result code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1207.

Product-sinumerik_pcu_base_win10_software\/ipc ultravnc sinumerik_pcu_base_win7_software\/ipc sinumerik_access_mymachine\/p2p UltraVNC

CWE ID-CWE-193

Off-by-one Error

CVE-2019-8275

Matching Score-8

Assigner-Kaspersky

Matching Score-8

Assigner-Kaspersky

CVSS Score-9.8||CRITICAL

EPSS-4.33% / 88.93%

7 Day CHG~0.00%

Published-09 Mar, 2019 | 00:00

Updated-17 Sep, 2024 | 03:12

UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote users. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.

Product-sinumerik_pcu_base_win10_software\/ipc ultravnc sinumerik_pcu_base_win7_software\/ipc sinumerik_access_mymachine\/p2p UltraVNC

CWE ID-CWE-170

Improper Null Termination

CVE-2019-8262

Matching Score-8

Assigner-Kaspersky

Product-sinumerik_pcu_base_win10_software\/ipc ultravnc sinumerik_pcu_base_win7_software\/ipc sinumerik_access_mymachine\/p2p UltraVNC

Matching Score-8

Assigner-Kaspersky

CVSS Score-9.8||CRITICAL

EPSS-5.40% / 90.15%

7 Day CHG~0.00%

Published-05 Mar, 2019 | 15:00

Updated-16 Sep, 2024 | 16:49

UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1204.

Vendor-uvnc UltraVNC Siemens AG

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8258

Matching Score-8

Assigner-Kaspersky

Product-sinumerik_pcu_base_win10_software\/ipc ultravnc sinumerik_pcu_base_win7_software\/ipc sinumerik_access_mymachine\/p2p UltraVNC

Matching Score-8

Assigner-Kaspersky

CVSS Score-9.8||CRITICAL

EPSS-4.00% / 88.44%

7 Day CHG~0.00%

Published-05 Mar, 2019 | 15:00

Updated-16 Sep, 2024 | 19:15

UltraVNC revision 1198 has a heap buffer overflow vulnerability in VNC client code which results code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1199.

Vendor-uvnc UltraVNC Siemens AG

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-6579

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.33% / 79.94%

7 Day CHG~0.00%

Published-17 Apr, 2019 | 13:40

Updated-04 Aug, 2024 | 20:23

A vulnerability has been identified in Spectrum Power 4 (with Web Office Portal). An attacker with network access to the web server on port 80/TCP or 443/TCP could execute system commands with administrative privileges. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises confidentiality, integrity or availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Vendor-Siemens AG

Product-spectrum_power_4 Spectrum Power™ 4

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2019-3822

Matching Score-8

Assigner-Red Hat, Inc.

Product-libcurl ubuntu_linux communications_operations_monitor oncommand_insight enterprise_linux active_iq_unified_manager services_tools_bundle oncommand_workflow_automation snapcenter http_server clustered_data_ontap debian_linux secure_global_desktop sinema_remote_connect_client enterprise_manager_ops_center mysql_server curl

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-7.1||HIGH

EPSS-16.57% / 94.93%

7 Day CHG~0.00%

Published-06 Feb, 2019 | 20:00

Updated-15 Apr, 2026 | 20:52

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

Vendor-Oracle Corporation Debian GNU/Linux Canonical Ltd.NetApp, Inc.Red Hat, Inc.Siemens AG CURL

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-20788

Matching Score-8

Assigner-MITRE Corporation

Product-simatic_itc1500_pro_firmware ubuntu_linux debian_linux simatic_itc1500_pro simatic_itc1500 simatic_itc1900 simatic_itc1900_firmware simatic_itc1900_pro_firmware simatic_itc1500_firmware simatic_itc2200_firmware simatic_itc2200_pro simatic_itc2200_pro_firmware libvncserver simatic_itc1900_pro simatic_itc2200 n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.80% / 74.03%

7 Day CHG~0.00%

Published-23 Apr, 2020 | 18:06

Updated-05 Aug, 2024 | 02:53

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.

Vendor-libvnc_project n/a Debian GNU/Linux Siemens AG Canonical Ltd.

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2019-19317

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.98% / 76.87%

7 Day CHG~0.00%

Published-05 Dec, 2019 | 13:53

Updated-05 Aug, 2024 | 02:16

lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.

Vendor-sqlite n/a NetApp, Inc.Oracle Corporation Siemens AG

Product-sinec_infrastructure_network_services cloud_backup sqlite ontap_select_deploy_administration_utility mysql_workbench n/a

CWE ID-CWE-681

Incorrect Conversion between Numeric Types

CVE-2017-14491

Matching Score-8

Assigner-MITRE Corporation

Vendor-thekelleys n/a Huawei Technologies Co., Ltd.Debian GNU/Linux SUSE Red Hat, Inc.Aruba Networks Synology, Inc.NVIDIA Corporation Arista Networks, Inc.Canonical Ltd.openSUSE Microsoft Corporation Siemens AG

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-57.79% / 98.18%

7 Day CHG-4.86%

Published-02 Oct, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-13918

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-0.48% / 65.10%

7 Day CHG~0.00%

Published-13 Sep, 2019 | 16:38

Updated-05 Aug, 2024 | 00:05

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing attacks. The vulnerability could be exploited by an attacker with network access to the vulnerable software, requiring no privileges and no user interaction. The vulnerability could allow full access to the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known.

Vendor-Siemens AG

Product-sinema_remote_connect_server SINEMA Remote Connect Server

CWE ID-CWE-307

Improper Restriction of Excessive Authentication Attempts

CWE ID-CWE-521

Weak Password Requirements

CVE-2019-12256

Matching Score-8

Assigner-MITRE Corporation

Product-power_meter_9810_firmware hirschmann_rsp20 ruggedcom_win7025_firmware hirschmann_ees25 sonicos hirschmann_grs1030 hirschmann_grs1142 ruggedcom_win7018_firmware hirschmann_rspe32 hirschmann_grs1130 garrettcom_magnum_dx940e hirschmann_rspe35 hirschmann_eesx20 hirschmann_rspe37 ruggedcom_win7018 power_meter_9410_firmware hirschmann_grs1042 siprotec_5_firmware ruggedcom_win7000 ruggedcom_win7200 hirschmann_rsp35 garrettcom_magnum_dx940e_firmware e-series_santricity_os_controller vxworks hirschmann_msp40 hirschmann_octopus_os3 hirschmann_rsp30 hirschmann_dragon_mach4000 hirschmann_dragon_mach4500 hirschmann_msp32 hirschmann_rsp25 hirschmann_rail_switch_power_smart hirschmann_eesx30 hirschmann_grs1020 hirschmann_rail_switch_power_lite hirschmann_eagle20 hirschmann_eagle30 hirschmann_hios ruggedcom_win7025 hirschmann_rspe30 hirschmann_eagle_one ruggedcom_win7200_firmware siprotec_5 hirschmann_ees20 hirschmann_red25 power_meter_9410 power_meter_9810 ruggedcom_win7000_firmware hirschmann_msp30 hirschmann_grs1120 n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-13.84% / 94.31%

7 Day CHG~0.00%

Published-09 Aug, 2019 | 17:57

Updated-04 Aug, 2024 | 23:17

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.

Vendor-windriver belden n/a NetApp, Inc.Siemens AG SonicWall Inc.

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2016-2031

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.97% / 76.72%

7 Day CHG-0.34%

Published-31 Jan, 2020 | 19:33

Updated-05 Aug, 2024 | 23:17

Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters, which could allow a malicious user to bypass security restrictions, obtain sensitive information, perform unauthorized actions and execute arbitrary code.

Vendor-n/a Siemens AG Aruba Networks

Product-aruba_instant airwave arubaos scalance_w1750d_firmware scalance_w1750d n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2015-7705

Matching Score-8

Assigner-MITRE Corporation

Product-oncommand_unified_manager oncommand_performance_manager tim_4r-ie_dnp3_firmware clustered_data_ontap tim_4r-ie_dnp3 xenserver tim_4r-ie_firmware tim_4r-ie ntp data_ontap n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-31.03% / 96.75%

7 Day CHG~0.00%

Published-07 Aug, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.

Vendor-ntp n/a NetApp, Inc.Siemens AG Citrix (Cloud Software Group, Inc.)

CWE ID-CWE-20

Improper Input Validation

CVE-2017-9944

Matching Score-8

Assigner-Siemens

Product-7kt_pac1200_data_manager_firmware 7kt_pac1200_data_manager Siemens 7KT PAC1200 data manager (7KT1260) All versions < V2.03

Matching Score-8

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-2.60% / 85.65%

7 Day CHG~0.00%

Published-26 Dec, 2017 | 04:00

Updated-20 Apr, 2025 | 01:37

A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03. The integrated web server (port 80/tcp) of the affected devices could allow an unauthenticated remote attacker to perform administrative operations over the network.

Vendor-n/a Siemens AG

CWE ID-CWE-269

Improper Privilege Management

CWE ID-CWE-288

Authentication Bypass Using an Alternate Path or Channel

CVE-2022-32262

Matching Score-8

Assigner-Siemens

Matching Score-8

Assigner-Siemens

CVSS Score-8.8||HIGH

EPSS-2.15% / 84.27%

7 Day CHG~0.00%

Published-14 Jun, 2022 | 09:22

Updated-21 Apr, 2025 | 13:52

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution.

Vendor-Siemens AG

Product-sinema_remote_connect_server SINEMA Remote Connect Server

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2022-32260

Matching Score-8

Assigner-Siemens