#siemens
6 articles
CVE-2026-56451: JWT algorithm confusion enabling authentication bypass in Siemens Opcenter X (CVSS 10.0)
A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an...
CVE-2025-40949: Unauthenticated RCE in Siemens RUGGEDCOM ROX
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX15...
CVE-2026-22924: Resource Exhaustion DoS in Siemens SIMATIC CN 4100
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion ...
CVE-2026-25786: Stored XSS via PLC Name in Siemens SIMATIC Web Interface
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authoriz...
CVE-2026-25787: Stored XSS via Technology Object Name in Siemens SIMATIC
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker wh...
CVE-2026-41551: Path Traversal in Siemens ROS#
Path traversal vulnerability in Siemens ROS# (versions prior to 2.2.2) allows a remote attacker to access arbitrary files due to insufficient sanitization of user input...