Siemens ProductCERT Security Alerts and News

Node2Shell/Broccoli2Shell - Vulnerability in Google's C decoder (affecting Node.js, Python, ...)

2026-10-28T00:00:00+00:00

Siemens is aware of the vulnerabilitiy CVE-2026-111497, referred to as Node2Shell/Broccoli2Shell, in Node.js and Brotli.
Corresponding security advisories (SSA) will be published for affected Siemens products as soon as related information becomes available.

PHP2Shell - Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

2026-10-22T00:00:00+00:00

Siemens is aware of two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, jointly referred to as PHP2Shell, in PHP.
Corresponding security advisories (SSA) will be published for affected Siemens products as soon as related information becomes available.

Active Exploitation of CVE-2026-110936 in Siemens Software Center

2026-10-19T00:00:00+00:00

Siemens has validated active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.
Siemens fixed the weakness in version 4.0.9.8 and published SSA-580366 on 15 October 2026. Existing installations update automatically the next time they start.

Increasing Vulnerability Transparency with Supplier-ADP

2026-04-14T00:00:00+00:00

Siemens PSIRT advocated for the Supplier-ADP (SADP), piloted and finally introduced in April 2026, which allows a supplier like Siemens to add information to a vulnerability that originates in an upstream dependency.
As an example, see SSA-628843 for CVE-2025-2884, which originates in TCG TPM2.0.

Vulnerability in libwebp (CVE-2023-4863)

2025-11-14T00:00:00+00:00

Siemens is aware of the heap buffer overflow vulnerability CVE-2023-4863 in Google's libwebp library, that could be exploited by unauthenticated remote attackers when rendering maliciously crafted WebP images.
For affected Siemens products, corresponding security advisories (SSA) will be published, including SSA-268517 for Mendix Studio Pro.

Remarks regarding SSB-201698 for the Discovery and Basic Configuration Protocol

2025-11-14T00:00:00+00:00

Siemens is aware of the behavior described in the PROFINET Security Advisory PISA-001 by the PI Organization regarding the Discovery and Basic Configuration Protocol (DCP), and published Security Bulletin SSB-201698 containing possible mitigations.

On the Malicious NuGet Packages Containing Logic Bombs

2025-11-14T00:00:00+00:00

Siemens is aware of nine malicious NuGet packages reported by Socket researchers, aimed at disrupting industrial operations by manipulating communication with Siemens PLCs via the legacy PUT/GET protocol.
Siemens has confirmed that no Siemens products use any of these NuGet packages and that they have not compromised any Siemens products.

Discontinuation of PDF and TXT Advisory Formats

2025-11-14T00:00:00+00:00

Following the introduction of the HTML and CSAF formats in 2022, download rates of PDF and TXT advisories decreased further.
Siemens phased out TXT advisories in June 2025 and stopped publishing PDF advisories in November 2025.

Introduction of \"Known Not Affected Products\" in Siemens Security Advisories

2025-11-07T00:00:00+00:00

Starting with Advisory Day in June 2025, Siemens introduced support for "known not affected products" in both human-readable HTML advisories and machine-readable CSAF documents, allowing a more precise description of which products are impacted by a vulnerability.

New Terms of Use for Siemens Security Advisories and Bulletins Issued by Siemens ProductCERT

2024-11-06T00:00:00+00:00

Starting from 2024-11-06, new Terms of Use apply to all new and updated Siemens Security Advisories (SSA) and Bulletins (SSB), which now explicitly allow e.g. the commercial redistribution and modification of the advisories under certain circumstances.

RADIUS Advisory and the benefits of ProductCERT's improved formats

2024-07-14T00:00:00+00:00

When confronted with the RADIUS CVE-2024-3596 vulnerability (SSA-723487), Siemens faced the task of identifying nearly 500 affected products.
This article summarizes the timeline of improvements to Siemens Security Advisories, including HTML format, MLFB identifiers, collapsible chapters, CVSSv4.0 rating, and product grouping.

Black Hat Europe 2023 - Details of the Legacy PG/PC and HMI Communication in SIMATIC S7-1500 SW Controller

2023-12-06T00:00:00+00:00

Siemens is aware of the talk at the Black Hat Conference Europe (December 6, 2023, London), titled "A Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven", describing details of the legacy PG/PC and HMI communication protocol used between TIA Portal / HMIs and SIMATIC S7-1500 SW Controller in versions before V17.
No previously unknown security vulnerabilities were disclosed in this talk.

Deactivation of Siemens ProductCERT Twitter Feed

2023-07-13T00:00:00+00:00

Siemens ProductCERT no longer maintains the Twitter feed previously used to distribute Siemens Security Advisories, and has deleted the account.
Advisory distribution is now limited to the Website, the CSAF feed, and the mailing list.

Remarks by ETM regarding SSA-111512 for SIMATIC WinCC OA

2022-06-21T00:00:00+00:00

ETM, the company that develops SIMATIC WinCC OA, provides additional insights related to SSA-111512, following the "OT:ICEFALL" findings reported by FORESCOUT Vedere Labs regarding the WinCC OA proprietary protocol and Desktop UI authentication.
Server-side authentication is available since V3.15 and is the default configuration since V3.17.

Siemens S7-1200 4.5 Unauthenticated Access

2022-05-17T00:00:00+00:00

Siemens analyzed the exploit titled "Siemens S7-1200 4.5 Unauthenticated Access", published on PacketStorm by researcher "RoseSecurity".
Based on current knowledge, this exploit only works if the PLC is misconfigured to allow everybody to change the operating mode; in the default configuration this is not possible.

Vulnerability in the Spring Framework (CVE-2022-22965, also referred to as \"SpringShell\", or \"Spring4Shell\")

2022-04-20T00:00:00+00:00

Siemens is aware of the security vulnerability in the Spring Framework (CVE-2022-22965), also referred to as "SpringShell", or "Spring4Shell".
For Siemens products, a security advisory (SSA-254054) was issued on 2022-04-19 and will be updated in the following days as more information becomes available.

New Siemens Security Advisory (SSA) Formats

2022-04-20T00:00:00+00:00

Siemens ProductCERT introduced new formats - namely HTML and CSAF - for its security advisories and will phase out the traditional formats (PDF, TXT, and CVRF) over time.

Apply Defense in Depth

2022-02-22T00:00:00+00:00

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms and to configure the environment according to Siemens' Operational Guidelines for Industrial Security.

Vulnerabilities in the Apache Log4j (\"Log4Shell\")

2021-12-14T23:00:00+00:00

Siemens is aware of the security vulnerabilities in Apache Log4j (CVE-2021-44228 and CVE-2021-45046), also named \"Log4Shell\".
For Siemens products, a security advisory (SSA-661247) was issued on 2021-12-13 and will be updated in the following days as more information becomes available.

Vulnerabilities in the Nucleus TCP/IP Stack (\"NUCLEUS:13\")

2021-11-09T12:00:00+00:00

Today, in coordination with Forescout, CISA and other contributors, Siemens has disclosed the security vulnerabilities CVE-2021-31344 through CVE-2021-31346 and CVE-2021-31881 through CVE-2021-31890, also named \"NUCLEUS:13\".
The impact and remediations of these vulnerabilities in Nucleus RTOS (a real-time operating system provided by Siemens EDA, formerly Mentor Graphics) is described in the following Security Advisory:
- SSA-044112: Multiple Vulnerabilities (NUCLEUS:13) in the TCP/IP Stack of Nucleus RTOS"

Vulnerabilities in Interniche TCP/IP Stack (\"INFRA:HALT\")

2021-08-04T18:00:00+00:00

Siemens is aware of the security vulnerabilities named INFRA:HALT. The impact to Siemens products is described in the following Security Advisory:
- SSA-789208: Multiple Vulnerabilities (INFRA:HALT) in Interniche IP-Stack based Low Voltage Devices

Please note that SIMATIC S7 PLCs are not affected by these vulnerabilities.

New Vulnerabilities in Treck TCP/IP Stack

2020-12-23T15:00:00+00:00

Siemens is aware of the new security vulnerabilities in the Treck TCP/IP stack, disclosed on 2020-12-08 on Treck, Inc.'s advisory page.
No Siemens product is known to use Treck Inc.'s TCP/IP stack, or otherwise be affected by the reported vulnerabilities.
Note that Siemens products and systems might interact with products from other manufacturers which are affected by the reported vulnerabilities. In such cases Siemens recommends that owners of operational infrastructures verify if these products are affected and evaluate the potential impact of the Ripple20 vulnerabilities. Siemens ProductCERT may release additional information via specific Security Advisories.

AMNESIA:33 Vulnerabilities

2020-12-09T11:30:00+00:00

Siemens is aware of the security vulnerabilities in several TCP/IP stacks, also named and disclosed on . The impact to Siemens products is described in the Security Advisory SSA541017, published on on the same day.
Note that Siemens products and systems might interact with products from other manufacturers which are affected by the reported vulnerabilities. In such cases Siemens recommends that owners of operational infrastructures verify if these products are affected and evaluate the potential impact of the vulnerabilities.

Ripple20 Vulnerabilities

2020-07-09T18:30:00+00:00

Siemens is aware of the recently disclosed set of security vulnerabilities in Treck, Inc.'s TCP/IP stack, known as Ripple20, disclosed by the JSOF research lab. Siemens experts had conducted an internal investigation to assess impact on Siemens products. No Siemens product is known to use Treck Inc.'s TCP/IP stack, or otherwise be affected by the reported vulnerabilities.
Note that Siemens products and systems might interact with products from other manufacturers which are affected by the reported vulnerabilities. In such cases Siemens recommends that owners of operational infrastructures verify if these products are affected and evaluate the potential impact of the Ripple20 vulnerabilities.

Operational Guidelines for Industrial Security

2020-03-18T00:00:00+00:00

Siemens has released an updated version 2.1 of the Operational Guidelines for Industrial Security.
The guidelines provide recommendations for the secure operation of plant and machinery in industrial environments, including a 'Defense-in-Depth' security concept.
Version 2.1 replaces all former versions of the guidelines and is referenced in Siemens Security Advisories related with Siemens Industrial Products.

SIPLUS products - Advisories

2019-12-16T00:00:00+00:00

SIPLUS products are rebranded standard products offering improved resistance to mechanical loads, chemical and biological substances, condensation, and temperature fluctuations. They are also designed to cope with temperatures between -40° and +70° Celsius. These devices share the same firmware than the products they are based on.
Although these devices were already implicitly mentioned in our existing advisories we were made aware that if not explicitly mentioned it could leave these devices out-of-scope. Therefore, starting with Advisory Day December 2019, Siemens will explicitly mention this product family and in the future also update old Siemens advisories.

Cyber Security topics @ Siemens Healthineers

2019-10-15T00:00:00+00:00

Starting by October 15 all topics related to the Siemens Healthineers Cyber Security (including security advisories) will be published at the Siemens Healthineers Cyber Security webpage.

Should you have further questions regarding this announcement, please use the contact form at the Siemens Healthineers Cyber Security webpage.

Microsoft DejaBlue Vulnerability in Siemens Industrial Products

2019-08-21T00:00:00+00:00

Siemens is aware of the reports about the vulnerabilities reported by Microsoft on August 13th, known as DejaBlue or CVE-2019-1181/1182. Microsoft released updates for several supported Windows operating systems on 2019-08-13, which fix a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network.

A number of Siemens Industrial products can be installed on Microsoft Windows. Siemens recommends that customers of these products test the compatibility of the patches in their environment and apply the patches if found to be compatible. Information on patch compatibility for Microsoft Windows patches for SIMATIC PCS 7 is published in this FAQ entry.

Further information on this vulnerability can be found at:

https://msrc-blog.microsoft.com/2019/08/13/patch-new-wormable-vulnerabilities-in-remote-desktop-services-cve-2019-1181-1182/

DejaBlue Vulnerabilities - Siemens Healthineers Products

2019-09-10T00:00:00+00:00

Siemens Healthineers is aware of the reports about the vulnerabilities reported by Microsoft on August 13th, known as DejaBlue or CVE-2019-1181/1182. Microsoft released updates for Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions on 2019-08-13, which fix a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network.

All Siemens Healthineers products from all business lines have been evaluated. Most Siemens Healthineers products are not affected by the vulnerabilities because they do not provide the option to activate the Remote Desktop Service, implement other controls that mitigate the vulnerabilities, use a version of Microsoft Windows that is not affected, or are not based on Microsoft Windows. This advisory (https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf) provides a full list of affected products from Siemens Healthineers and provides recommendations to mitigate the vulnerabilities.