Siemens vulnerabilities
We track 1,652 vulnerabilities in Siemens products across 60+ products. 1,648 are rated high or critical, and 38 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Siemens vulnerabilities
- 7.8 High severity
SIMATIC WinCC V7.5: Insufficient UI Warning of Dangerous Operations
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected devices implicitly execute active content when opening files. This could allow an attacker to make the user
- 7.5 High severity
SIMATIC BATCH V9.1: Weak Authentication
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC
- 8.8 High severity
Mendix Studio Pro 11: Binding to an Unrestricted IP Address
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback inte
- 7.3 High severity
meta-iot2050: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user
- 8.2 High severity
ROS#: Improper Control of Generation of Code
A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary c
- 7.5 High severity
FortiOS: Improper Locking
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
- 9.8 Critical severity
Google Brotli Unchecked Return Value Exploited
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a
- 8.1 High severity
PHP Stale Internal Request-State Exploited
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subse
- 9.8 Critical severity
PHP Memory Corruption Exploited
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The su
- 6.7 Medium severity
Siemens Software Center Uncontrolled Search Path Element Exploited
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially craft
- 7.2 High severity
Palo Alto Networks PAN-OS Code Injection Exploited
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this
- 7.5 High severity
RUGGEDCOM CROSSBOW: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker
- 8.8 High severity
RUGGEDCOM CROSSBOW: Authorization Bypass Through User-Controlled Key
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrat
- 8.8 High severity
RUGGEDCOM CROSSBOW: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to
- 8.8 High severity
RUGGEDCOM CROSSBOW: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow
- 8.8 High severity
RUGGEDCOM CROSSBOW: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with spe
- 7.5 High severity
.NET Client Library for SIMATIC S7 Webserver API: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who ca
- 8.3 High severity
Industrial Edge App Publisher: Improper Neutralization of Input During Web Page Generation
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated wi
- 7.4 High severity
Industrial Edge App Publisher: Improper Certificate Validation
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communicatio
- 7.7 High severity
SIMATIC IPC BX-21A: Use of Default Cryptographic Key
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the
- 9.6 Critical severity
SIMATIC Drive Controller CPU 1504D TF: Improper Neutralization of Input During Web Page Generation
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnos
- 9.6 Critical severity
SIMATIC Drive Controller CPU 1504D TF: Improper Neutralization of Input During Web Page Generation
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importin
- 9.6 Critical severity
SIMATIC Drive Controller CPU 1504D TF: Improper Neutralization of Directives in Dynamically Evaluated Code
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Su
- 8.8 High severity
SIMATIC WinCC V7.5: Incorrect Privilege Assignment
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to
- 9.1 Critical severity
Industrial Edge Device Kit - arm64 V1.10: Path Traversal: '.../...//'
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthoriz
- 7.5 High severity
APOGEE MBC (PPC) (BACnet): Stack-based Buffer Overflow
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions <
- 7.5 High severity
APOGEE MBC (PPC) (BACnet): Stack-based Buffer Overflow
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions <
- 7.5 High severity
APOGEE MBC (PPC) (BACnet): Stack-based Buffer Overflow
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions <
- 8.2 High severity
APOGEE MBC (PPC) (BACnet): Integer Underflow (Wrap or Wraparound)
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions <
- 8.2 High severity
libexpat: Out-of-bounds Read
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, s
- 7.0 High severity
wibukey: Out-of-bounds Write
In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under
- 7.6 High severity
CPython: Improper Validation of Certificate with Host Mismatch
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be sil
- 9.2 Critical severity
CPython: Use After Free
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original s
- 8.2 High severity
OpenSSL: Out-of-bounds Read
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspende
- 7.5 High severity
libexpat: Improper Handling of Unicode Encoding
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following co
- 7.2 High severity
Cloud NGFW: Out-of-bounds Write
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-S
- 8.1 High severity
FortiOS: Improper Validation of Certificate with Host Mismatch
A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>
- 7.5 High severity
Guardian: Lack of Administrator Control over Security
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man
- 7.4 High severity
Guardian: Incorrect Authorization
An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials
- 8.6 High severity
SIMOVE Fleetmanager V3.1: Relative Path Traversal
A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All ve