Siemens vulnerabilities
We track 1,652 vulnerabilities in Siemens products across 60+ products. 1,648 are rated high or critical, and 38 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Siemens vulnerabilities
- 7.5 High severity
SINEMA Remote Connect Server: Improper Handling of Parameters
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application.
- 9.8 Critical severity
SINEMA Remote Connect Server: Incorrect User Management
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary user credentials for UMC (User Management Component) users. An attacker could use these temporary credentials for authenti
- 7.5 High severity
SINEMA Remote Connect Server: Obsolete Feature in UI
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for info
- 7.5 High severity
SINEMA Remote Connect Server: Insertion of Sensitive Information into Log File
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valu
- 7.5 High severity
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1).
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker.
- 7.8 High severity
SINEMA Remote Connect Server: Insufficient Verification of Data Authenticity
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting
- 9.8 Critical severity
SINEMA Remote Connect Server: Missing Authentication for Critical Functionality
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions
- 8.8 High severity
Teamcenter V12.4: Use of Hard-coded Credentials
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All versions < V13.1.0.9), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0
- 7.8 High severity
Xpedition Designer VX.2.10: Incorrect Permission Assignment for Critical Resource
A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions < VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions < VX.2.12 Update 5), Xpedition Designer VX.2.13 (All v
- 7.5 High severity
EN100 Ethernet module DNP3 IP variant: Out-of-bounds Write
A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module Modbus TCP variant (All ver
- 9.8 Critical severity
SICAM GridEdge (Classic): Missing Authentication for Critical Functionality
A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to create a new user with administrat
- 8.8 High severity
Spectrum Power 4: Use of Hard-coded Credentials
A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS (All versions using Shared HIS). An unauthenticated attacker could log into the component Shared HIS
- 7.8 High severity
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem: Use After Free
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
- 7.5 High severity
https://github.com/curl/curl: Improper Certificate Validation
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches t
- 7.5 High severity
https://github.com/curl/curl: Loop with Unreachable Exit Condition
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop whe
- 7.5 High severity
https://github.com/curl/curl: Server-Side Request Forgery
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, wou
- 8.1 High severity
https://github.com/curl/curl: Use of Incorrectly-Resolved Name or Reference
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
- 7.5 High severity
https://github.com/curl/curl: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
- 9.8 Critical severity
Biograph Horizon PET/CT Systems: Deserialization of Untrusted Data
A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (All VC20 versions < VC20D), NAEOTOM Alpha (All VA40 versions <
- 8.1 High severity
https://github.com/curl/curl: Missing Authentication for Critical Functionality
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfe
- 7.8 High severity
kernel: Use After Free
A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate t
- 8.1 High severity
SICAM T: Authentication Bypass by Capture-replay
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-respons
- 7.5 High severity
SICAM T: Cleartext Transmission of Sensitive Information
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communicate in cleartext via HTTP. This could allow an unauthenticated attacker to capture the traffic and interfere with the fun
- 9.8 Critical severity
SICAM T: Improper Neutralization of Parameter/Argument Delimiters
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an unauthenticated attacker to set the device to a denial of service state or to contr
- 8.8 High severity
A vulnerability has been identified in SICAM T (All versions < V3.0).
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of POST requests. This could allow an authenticated attacker to set the device to a denial of service state or to control the program cou
- 7.5 High severity
Teamcenter V12.4: Improper Restriction of XML External Entity Reference
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the ap
- 7.8 High severity
JT2Go: Access of Uninitialized Pointer
A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll library is vulnerable to uninitialized pointe
- 7.8 High severity
JT2Go: Double Free
A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll library contains a double free vulnerability
- 7.8 High severity
Simcenter Femap: Out-of-bounds Write
A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted .NEU files. This could allow an attacker to execute
- 7.5 High severity
Teamcenter V12.4: Out-of-bounds Write
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All versions), Teamcenter V13.2 (All versions < V13.2.0.8), Teamcenter V13.3 (All versions < V13.3.0.3), Teamcen
- 7.8 High severity
SIMATIC PCS 7 V8.2: Initialization of a Resource with an Insecure Default
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Run
- 7.5 High severity
Desigo DXR2: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of th
- 7.8 High severity
Busybox: Use After Free
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
- 7.8 High severity
Kernel: Use After Free
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privile
- 9.1 Critical severity
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo…
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application returns a
- 9.0 Critical severity
Desigo PXC4: Failure to Sanitize Special Elements into a Different Plane
A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generat
- 9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Improper Neutralization of Special Elements used in an SQL Command
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is process
- 7.5 High severity
OpenSSL: Incomplete Cleanup
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cert
- 7.3 High severity
OpenSSL: Improper Neutralization of Special Elements used in an OS Command
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrar
- 7.8 High severity
e2fsprogs: Out-of-bounds Read
An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.