Siemens vulnerabilities
We track 1,652 vulnerabilities in Siemens products across 60+ products. 1,648 are rated high or critical, and 38 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Siemens vulnerabilities
- 8.8 High severity
IEC 1Ph 7.4kW Child socket: Initialization of a Resource with an Insecure Default
A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2EN04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Parent cable 7m (8EM1310-2EJ04-3GA1) (All versions <
- 7.5 High severity
SIMATIC PCS neo V4.1: Out-of-bounds Read
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote Connect (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totall
- 7.5 High severity
SIMATIC PCS neo V4.1: Out-of-bounds Write
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote Connect (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totall
- 7.5 High severity
SIMATIC PCS neo V4.1: Out-of-bounds Read
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote Connect (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totall
- 9.8 Critical severity
OZW672: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL injection when checking authentication data. This could allow an unauthenticated remote attacker to bypa
- 9.8 Critical severity
OZW672: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated rem
- 7.5 High severity
SIRIUS 3RK3 Modular Safety System (MSS): Use of a Broken or Risky Cryptographic Algorithm
A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). Affected devices only provide weak password obfuscation. An attacker with network access could retrieve and de-obfuscate th
- 7.5 High severity
Desigo CC: Missing Authentication for Critical Functionality
A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone), Desigo CC (All versions if access from Installed Clients to Desigo CC server is on
- 7.1 High severity
Linux: Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when
- 8.1 High severity
Nullsoft Scriptable Install System: Improper Check for Unusual or Exceptional Conditions
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted execu
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetOverview' method. This could allow an authenticated remote attacker to bypass aut
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'MigrateDatabase' method. This could allow an authenticated remote attacker to bypass
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetTraces' method. This could allow an authenticated remote attacker to bypass autho
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ImportCertificate' method. This could allow an authenticated remote attacker to bypa
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ExportCertificate' method. This could allow an authenticated remote attacker to bypa
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateBackup' method. This could allow an authenticated remote attacker to bypass au
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetLogs' method. This could allow an authenticated remote attacker to bypass authori
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateLog' method. This could allow an authenticated remote attacker to bypass autho
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetSettings' method. This could allow an authenticated remote attacker to bypass aut
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockTraceLevelSettings' method. This could allow an authenticated remote attacker
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockTraceLevelSettings' method. This could allow an authenticated remote attacker to
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateTraceLevelSettings' method. This could allow an authenticated remote attacker
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockWebServerGatewaySettings' method. This could allow an authenticated remote att
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockWebServerGatewaySettings' method. This could allow an authenticated remote attac
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateWebServerGatewaySettings' method. This could allow an authenticated remote att
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockBufferingSettings' method. This could allow an authenticated remote attacker t
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockBufferingSettings' method. This could allow an authenticated remote attacker to
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockOpcSettings' method. This could allow an authenticated remote attacker to bypa
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockOpcSettings' method. This could allow an authenticated remote attacker to bypass
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockDatabaseSettings' method. This could allow an authenticated remote attacker to
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockDatabaseSettings' method. This could allow an authenticated remote attacker to b
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockTcmSettings' method. This could allow an authenticated remote attacker to bypa
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockTcmSettings' method. This could allow an authenticated remote attacker to bypass
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockSmtpSettings' method. This could allow an authenticated remote attacker to byp
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockSmtpSettings' method. This could allow an authenticated remote attacker to bypas
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockGeneralSettings' method. This could allow an authenticated remote attacker to
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockGeneralSettings' method. This could allow an authenticated remote attacker to by
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateGeneralSettings' method. This could allow an authenticated remote attacker to
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockUser' method. This could allow an authenticated remote attacker to bypass auth
- 8.8 High severity
TeleControl Server Basic: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockUser' method. This could allow an authenticated remote attacker to bypass author