Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 with Industrial OS
Siemens is aware of the recently published research regarding exploitation targeting VulnCheck’s vulnerable Node-RED canary instances.
News
Siemens ProductCERT and Siemens CERT continously monitor the cyber threat landscape as well as dedicated cyber-attack campaigns against Siemens products, solutions, services, or infrastructure. In order to provide timely support to Siemens customers and operators on imminent cyber threats, Siemens issues Security Alerts and News.
Node2Shell/Broccoli2Shell - Vulnerability in Google's C decoder (affecting Node.js, Python, ...) (CVE-2026-111497)
Siemens is aware of the vulnerability, CVE-2026-111497, referred to as Broccoli2Shell or Node2Shell, in Google's decoder. An out-of-bounds write can potentially result in a crash, a memory leak or a remote code execution in software which uses a vulnerable version of Brotli.
PHP2Shell - Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Siemens is aware of two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, jointly referred to as PHP2Shell, in PHP. Both result from use-after-free conditions triggered during out-of-memory handling, where stale or uninitialized request memory can be read or branched on by a subsequent request, allowing remote code execution.
Active Exploitation of CVE-2026-110936 in Siemens Software Center
Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center. Siemens fixed the weakness in version 4.0.9.8 and published advisory SSA-580366 on 15 October. Existing installations update automatically the next time they start.
No Siemens system, product or update channel was breached to our knowledge. EDR vendors and authorities have been engaged for intelligence sharing, enabling broader detection coverage and coordinated defensive actions.
Increasing Vulnerability Transparency with Supplier-ADP
Since 2024, the Cybersecurity and Infrastructure Security Agency (CISA) has implemented the “Vulnrichment” program to enrich CVE data with additional information. The goal is to give additional context and help defenders in assessing the specific risk of these vulnerabilities. Each CVE from cve.org or github has an Authorized Data Publisher (ADP) container where this data is stored.
As a next level, Siemens PSIRT was advocating a further extension of this: The Supplier-ADP (SADP), which was piloted in the last months and finally introduced in April 2026. The SADP comes handy if a supplier like Siemens wants to add information to a vulnerability, which originates in an upstream dependency.
Discontinuation of PDF and TXT Advisory Formats
In the article "New Siemens Security Advisory (SSA) Formats" which was published on 2022-04-20, the shortcomings of the PDF and TXT formats for security advisories were laid out and the introduction of the HTML format (for human readers) and CSAF (machine readable) was explained.
On the Malicious NuGet Packages Containing Logic Bombs
Siemens is aware of the following nine malicious NuGet packages reported recently by Socket researchers.
- MyDbRepository (Last updated on May 13, 2023),
- MCDbRepository (Last updated on June 5, 2024),
- Sharp7Extend (Last updated on August 14, 2024),
- SqlDbRepository (Last updated on October 24, 2024),
- SqlRepository (Last updated on October 25, 2024),
- SqlUnicornCoreTest (Last updated on October 26, 2024),
- SqlUnicornCore (Last updated on October 26, 2024),
- SqlUnicorn.Core (Last updated on October 27, 2024), and
- SqlLiteRepository (Last updated on October 28, 2024)
Remarks regarding SSB-201698 for the Discovery and Basic Configuration Protocol
Siemens is aware of the behavior that is described in the PROFINET Security Advisory PISA-001 by the PI Organization and published a related Security Bulletin containing possible mitigations.
Vulnerability in libwebp (CVE-2023-4863)
Siemens is aware of the heap buffer overflow vulnerability CVE-2023-4863 in Google’s libwebp library, that could be exploited by unauthenticated remote attackers, when the library is rendering maliciously crafted images in WebP format.
Introduction of "Known Not Affected Products" in Siemens Security Advisories
Last year's improvements in Siemens Security Advisories, where we introduced the ability to describe a product-specific impact to a vulnerability, raised the next logical and expected question: "...but what if a product is not impacted at all by that vulnerability?"
Starting with Advisory Day in June 2025 we're excited to introduce the support of "Known not affected products" in both human-readable HTML advisories, and machine-readable CSAF documents.