Siemens vulnerabilities

We track 1,652 vulnerabilities in Siemens products across 60+ products. 1,648 are rated high or critical, and 38 have been exploited in real attacks. The most recent was published on November 10, 2026.

1,652vulnerabilities

215critical

1,433high

38exploited

8.0average CVSS score

Latest Siemens vulnerabilities

9.8 Critical severity
Aruba Access Points: 100 Series; 103 Series…: Buffer Copy without Checking Size of Input
CVE-2022-37887Oct 7, 2022Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;EPSS 2.13%
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exp
9.8 Critical severity
Aruba Access Points: 100 Series; 103 Series…: Buffer Copy without Checking Size of Input
CVE-2022-37886Oct 7, 2022Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;EPSS 1.87%
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exp
9.8 Critical severity
Aruba Access Points; 100 Series; 103 Series…: Buffer Copy without Checking Size of Input
CVE-2022-37885Oct 7, 2022Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;EPSS 1.87%
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exp
9.8 Critical severity
Aruba Access Points: 100 Series; 103 Series…: Buffer Copy without Checking Size of Input
CVE-2022-37888Oct 6, 2022Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;EPSS 2.05%
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exp
7.1 High severity
Uboot: Out-of-bounds Write
CVE-2022-2347Sep 23, 2022Uboot
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physic
9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Improper Authentication
CVE-2022-28321Sep 19, 2022SiemensEPSS 1.61%
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditio
7.5 High severity
RUGGEDCOM i800: Uncontrolled Resource Consumption
CVE-2022-39158Sep 13, 2022SiemensEPSS 1.5%
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M220
7.8 High severity
Parasolid V33.1: Out-of-bounds Read
CVE-2022-39156Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39155Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39154Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Read
CVE-2022-39153Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39152Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39151Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39150Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39149Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39148Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Access of Uninitialized Pointer
CVE-2022-39147Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Access of Uninitialized Pointer
CVE-2022-39146Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Read
CVE-2022-39145Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39144Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39143Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39142Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <
7.8 High severity
Parasolid V33.1: Out-of-bounds Read
CVE-2022-39141Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39140Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39139Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022
7.8 High severity
Parasolid V33.1: Out-of-bounds Write
CVE-2022-39138Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022
7.8 High severity
Parasolid V33.1: Out-of-bounds Read
CVE-2022-39137Sep 13, 2022Siemens
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022
7.8 High severity
CoreShield One-Way Gateway (OWG) Software: Incorrect Default Permissions
CVE-2022-38466Sep 13, 2022Siemens
A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator.
9.8 Critical severity
Mendix SAML (Mendix 7 compatible): Authentication Bypass by Capture-replay
CVE-2022-37011Sep 13, 2022SiemensEPSS 1.26%
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible
7.0 High severity
Linux kernel: Concurrent Execution using Shared Resource with Improper Synchronization
CVE-2022-3028Aug 31, 2022Linux kernel
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak
8.8 High severity
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.
CVE-2022-1271Aug 31, 2022Gzip, Xz-utilsEPSS 5.55%
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw
7.0 High severity
kernel: Concurrent Execution using Shared Resource with Improper Synchronization
CVE-2022-2959Aug 25, 2022Kernel
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. T
7.8 High severity
Kernel: Use After Free
CVE-2022-2978Aug 24, 2022Kernel
A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate
7.5 High severity
RUGGEDCOM RM1224 LTE(4G) EU: Allocation of Resources Without Limits or Throttling
CVE-2022-36324Aug 10, 2022SiemensEPSS 1.8%
Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute force prevention and lead to a denial of service condition for the duration of the attack.
7.2 High severity
RUGGEDCOM RM1224 LTE(4G) EU: Improper Neutralization of Special Elements in Output Used by a Downstream Component
CVE-2022-36323Aug 10, 2022SiemensEPSS 1.93%
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.
7.5 High severity
Teamcenter V12.4: Loop with Unreachable Exit Condition
CVE-2022-34661Aug 10, 2022Siemens
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3
9.8 Critical severity
Teamcenter V12.4: Improper Neutralization of Special Elements used in a Command
CVE-2022-34660Aug 10, 2022SiemensEPSS 1.21%
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3
7.5 High severity
Simcenter STAR-CCM+: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2022-34659Aug 10, 2022Siemens
A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license server is used). Affected applications expose user, host and display name of users, when the public license server is used. This could allow an
8.2 High severity
Kernel: Missing Release of Memory after Effective Lifetime
CVE-2022-1012Aug 5, 2022KernelEPSS 4.39%
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.
9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Out-of-bounds Write
CVE-2022-37434Aug 5, 2022SiemensEPSS 19.2%
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code