Republished vendor advisory. This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Credit: Siemens ProductCERT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-41940 | CWE-20 Improper Input Validation | 9.1 Critical |
CVE-2024-41940 The affected application does not properly validate user input to a privileged command queue. This could allow an authenticated attacker to execute OS commands with elevated privileges. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-5869 | CWE-20 Improper Input Validation | 8.8 High |
CVE-2023-5869 A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-41939 | CWE-863 Incorrect Authorization | 8.8 High |
CVE-2024-41939 The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and elevate their privileges on the application. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-0985 | CWE-271 Privilege Dropping / Lowering Errors | 8.0 High |
CVE-2024-0985 Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-36398 | CWE-250 Execution with Unnecessary Privileges | 7.8 High |
CVE-2024-36398 The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`. This could allow a local attacker to execute operating system commands with elevated privileges. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-31122 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-31122 Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-43622 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-43622 An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-44487 KEV | CWE-400 Uncontrolled Resource Consumption | 7.5 High |
CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-46589 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-46589 Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-52425 | CWE-400 Uncontrolled Resource Consumption | 7.5 High |
CVE-2023-52425 libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-6378 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-6378 A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-6481 | CWE-20 Improper Input Validation | 7.5 High |
CVE-2023-6481 A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-28757 | CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | 7.5 High |
CVE-2024-28757 libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-39615 | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | 6.5 Medium |
CVE-2023-39615 Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-46280 | CWE-125 Out-of-bounds Read | 6.5 Medium |
CVE-2023-46280 The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-4611 | CWE-416 Use After Free | 6.3 Medium |
CVE-2023-4611 A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-42794 | CWE-20 Improper Input Validation | 5.9 Medium |
CVE-2023-42794 Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-45802 | CWE-20 Improper Input Validation | 5.9 Medium |
CVE-2023-45802 When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-25062 | CWE-416 Use After Free | 5.9 Medium |
CVE-2024-25062 An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-52426 | CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | 5.5 Medium |
CVE-2023-52426 libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-41938 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 5.5 Medium |
CVE-2024-41938 The importCertificate function of the SINEC NMS Control web application contains a path traversal vulnerability. This could allow an authenticated attacker it to delete arbitrary certificate files on the drive SINEC NMS is installed on. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-42795 | CWE-20 Improper Input Validation | 5.3 Medium |
CVE-2023-42795 Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-45648 | CWE-20 Improper Input Validation | 5.3 Medium |
CVE-2023-45648 Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-28182 | CWE-770 Allocation of Resources Without Limits or Throttling | 5.3 Medium |
CVE-2024-28182 nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-34050 | CWE-502 Deserialization of Untrusted Data | 5.0 Medium |
CVE-2023-34050 In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-46120 | CWE-400 Uncontrolled Resource Consumption | 4.9 Medium |
CVE-2023-46120 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-5870 | CWE-20 Improper Input Validation | 4.4 Medium |
CVE-2023-5870 A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-5868 | CWE-20 Improper Input Validation | 4.3 Medium |
CVE-2023-5868 A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-41941 | CWE-863 Incorrect Authorization | 4.3 Medium |
CVE-2024-41941 The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and modify settings in the application without authorization. Vendor fix: Update to V3.0 or later version ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-41940 | 9.1 Critical | Siemens SINEC NMS A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a privilege… |
| CVE-2023-5869 | 8.8 High | Red Hat Red Hat Advanced Cluster Security 4.2 A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array va… |
| CVE-2024-41939 | 8.8 High | Siemens SINEC NMS A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This… |
| CVE-2024-0985 | 8.0 High | n/a PostgreSQL Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the comman… |
| CVE-2024-36398 | 7.8 High | Siemens SINEC NMS A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\S… |
| CVE-2023-44487 | 7.5 High | IETF HTTP/2 HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS). |
| CVE-2023-46589 | 7.5 High | Apache Software Foundation Apache Tomcat Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 thro… |
| CVE-2023-52425 | 7.5 High | n/a n/a libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for w… |
| CVE-2024-25062 | 7.5 High | n/a n/a An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expan… |
| CVE-2024-28757 | 7.5 High | n/a n/a libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCrea… |
| CVE-2023-6378 | 7.1 High | QOS.CH Sarl logback A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack b… |
| CVE-2023-6481 | 7.1 High | QOS.CH Sarl logback A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-O… |
| CVE-2023-4611 | 7.0 High | n/a Kernel A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbin… |
| CVE-2023-46280 | 6.5 Medium | Siemens Security Configuration Tool (SCT) A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC B… |
| CVE-2023-52426 | 5.5 Medium | n/a n/a libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. |
| CVE-2024-41938 | 5.5 Medium | Siemens SINEC NMS A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web application conta… |
| CVE-2023-42795 | 5.3 Medium | Apache Software Foundation Apache Tomcat Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10… |
| CVE-2023-45648 | 5.3 Medium | Apache Software Foundation Apache Tomcat Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 thro… |
| CVE-2024-28182 | 5.3 Medium | nghttp2 nghttp2 nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbound… |
| CVE-2023-34050 | 5.0 Medium | Spring Spring AMQP In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP… |
| CVE-2023-46120 | 4.9 Medium | rabbitmq rabbitmq-java-client The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used … |
| CVE-2023-5868 | 4.3 Medium | Red Hat Red Hat Advanced Cluster Security 4.2 A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate fu… |
| CVE-2024-41941 | 4.3 Medium | Siemens SINEC NMS A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This… |
| CVE-2023-5870 | 2.2 Low | Red Hat Red Hat Advanced Cluster Security 4.2 A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, auto… |
| CVE-2023-31122 | — | Apache Software Foundation Apache HTTP Server Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. |
| CVE-2023-39615 | — | n/a n/a Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability… |
| CVE-2023-42794 | — | Apache Software Foundation Apache Tomcat Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5… |
| CVE-2023-43622 | — | Apache Software Foundation Apache HTTP Server An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP … |
| CVE-2023-45802 | — | Apache Software Foundation Apache HTTP Server When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. I… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.