• CVE-2024-13089
• Only install update packages from trusted sources. Refer upstream advisory for further information.
• CVE-2025-1501
• Use internal firewall features to limit access to the web management interface. Refer upstream advisory for further information.
• CVE-2025-3718
• Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones
• Apply care when opening untrusted links or visiting external websites while an authenticated session to the web management interface is established
• CVE-2025-3719
• Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones
• CVE-2025-40885
• Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones
• CVE-2025-40886
• Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones
• CVE-2025-40887
• Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones
• CVE-2025-40888
• Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones
• CVE-2025-40889
• Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Nozomi provides a public RSS feed for their security alerts to which customers can also subscribe [1].

[1] https://security.nozominetworks.com/alerts/