Siemens and other ICS vendors publish new vulnerability advisories
Node2Shell exploitation attempts have been seen, but Siemens reports no attacks aimed at its products.
Stories per day · 30 days
5 RSS
Relatedics18clickfix6romulus6simatic5dll-side-loading4software-center4cisa3dll-sideloading3industrial-edge3kev3plc3plex3ruggedcom3siteguard3authentication-bypass2control-systems2crossbow2denial-of-service2
56 stories, newest first · one card per story
Stories tagged #siemens
Static ramp model leaves detectable residuals on Siemens PROFINET drives
PASAD and CUSUM flag the omitted overshoot residual, and evaluated N4SID models did not improve stealth.
Improper device certificate validation in Siemens SICAM Toolbox II enables AiTM attacks
SEC Consult warns of adversary-in-the-middle attacks due to missing certificate validation in Siemens SICAM Toolbox II device communication; fixed in version 07.11.
Siemens security advisory AV26-802 details control system vulnerabilities
Open source reporting indicates exploitation in the wild; users should apply updates to affected products.
1
Critical Node-RED flaw exploited in attacks
Attackers deploy Linux bots and webshells via single HTTP request; Siemens devices patched.
Attackers exploit Siemens IoT2050 missing authentication flaw
VulnCheck observed in-the-wild exploitation of CVE-2026-58115 on Siemens SIMATIC IoT2050 Advanced devices, deploying Node-RED flows that download and run Linux bots.
Siemens Mendix SAML module allows assertion-replay login bypass
Unauthenticated attackers can replay a valid IdP-initiated SAML response; fixes are V4.2.4 and V3.6.29.
Siemens Mendix SAML module has an authentication-bypass flaw
Mendix 9 builds before V3.6.29 and Mendix 10 and 11 builds before V4.2.4 are affected; Canada urges administrators to apply updates.
Siemens SENTRON 3NA COM Fuse before 5.2 can be forced into DoS
An unsolicited encrypted ZigBee rejoin response can change the node ID; recovery requires rebuilding the network.
Siemens Software Center before 4.0.9.8 allows local DLL hijack
Siemens says the flaw has known active exploitation and that existing installs auto-update to 4.0.9.8 on next startup.
5
Siemens SIMATIC S7-1500 TM MFP Linux subsystem has unfixed flaws
All GNU/Linux subsystem versions on the TM MFP V1.1.1 are affected, and Siemens says no fix is available yet.
SIMATIC S7-1500 web server flaws can hijack authorized browser sessions
All listed firmware versions are affected, Siemens is still preparing fixes, and eight CVEs are named.
SIMATIC WinCC flaw lets database users run host commands
WinCC V7.5 has no fix; V8.0 and V8.1 are fixed in Update 11 and Update 7.
1
Siemens SIMATIC IPCs allow UEFI Secure Boot bypass (CVE-2026-72895)
Physical access attackers can boot arbitrary OS signed with AMI test key; fixes released for BX-21A, RW-543A, and IPC227G series.
Siemens Industrial Edge App Publisher before 1.27.9 vulnerable to RCE (CVE-2026-78556, CVE-2026-78557)
Update to V1.27.9 or later to prevent network attackers from impersonating the management server and achieving RCE via Node.js.
1
RUGGEDCOM CROSSBOW before 6.0 allows SQL injection and credential theft
Authenticated attackers can run SQL, steal admin credentials, or change configuration; Siemens says to update to V6.0 or later.
RUGGEDCOM CROSSBOW SAC before 6.0 includes vulnerable SQLite code
Five SQLite flaws can yield code execution, denial of service, or information disclosure; the product fix is V6.0 or later.
PSS SINCAL WibuKey flaw can crash systems (CVE-2026-84854)
Only legacy WibuKey dongle licensing is affected; V22.5 is fixed in Update 5, while V21.5 and V22.0 need a manual runtime install.
1
RUGGEDCOM APE1808 inherits Nozomi Guardian and CMC flaws
All listed APE1808 versions are affected; the highest detailed score is 7.5 for unvalidated Smart Polling connections.
Siemens Software Center DLL side-loading flaw exploited before 4.0.9.8
Attackers shipped signed Software Center 3.5.8.7 with malicious DLLs; every build before 4.0.9.8 is affected.
2
Siemens Software Center DLL flaw exploited in ClickFix attacks
CVE-2026-110936, fixed in 4.0.9.8, was used to side-load malware beside an unmodified signed executable in the Romulus campaign.
3
CISA says attackers chain Plex flaws in Plex2Shell server breaches
Federal agencies must patch or mitigate by October 23; honeypots were hit with a cryptominer.
CISA Orders Patch for Exploited Plex2Shell, Siemens and SiteGuard Flaws
CISA added four Plex2Shell vulnerabilities and two other exploited flaws to its KEV catalog, ordering federal agencies to patch them by October 23 and November 3, 2026.
Attackers exploit Siemens Software Center flaw in ClickFix campaign
CVE-2026-110936 let version 3.5.8.7 load attacker files beside a signed binary; 4.0.9.8 fixes it.
1