In the article "New Siemens Security Advisory (SSA) Formats" which was published on 2022-04-20, the shortcomings of the PDF and TXT formats for security advisories were laid out and the introduction of the HTML format (for human readers) and CSAF (machine readable) was explained.
Siemens is aware of the following nine malicious NuGet packages reported recently by Socket researchers.
Siemens is aware of the behavior that is described in the PROFINET Security Advisory PISA-001 by the PI Organization and published a related Security Bulletin containing possible mitigations.
Siemens is aware of the heap buffer overflow vulnerability CVE-2023-4863 in Google’s libwebp library, that could be exploited by unauthenticated remote attackers, when the library is rendering maliciously crafted images in WebP format.
Last year's improvements in Siemens Security Advisories, where we introduced the ability to describe a product-specific impact to a vulnerability, raised the next logical and expected question: "...but what if a product is not impacted at all by that vulnerability?"
Starting with Advisory Day in June 2025 we're excited to introduce the support of "Known not affected products" in both human-readable HTML advisories, and machine-readable CSAF documents.