These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2025-25253 is a high-severity certificate-validation issue (CWE-297) published by CISA on 2025-05-13 and later republished based on Siemens ProductCERT updates. The source description says an unauthenticated attacker in a man-in-the-middle position may intercept and tamper with connections to the ZTNA proxy. For defenders, the key takeaway is that trust validation at the proxy layer is at risk, so aff [truncated]
CVE-2025-25250 is a medium-severity information disclosure advisory in the supplied Siemens/CISA record. The advisory lists Siemens RUGGEDCOM APE1808 as the affected product and describes a situation where an authenticated user may access full SSL-VPN settings via a crafted URL. The source corpus also contains a notable product-text mismatch: the vulnerability description and remediation text reference Fo [truncated]
CVE-2025-25248 is a medium-severity availability issue tied to an integer overflow/wraparound in SSL-VPN RDP and VNC bookmark handling. According to the supplied advisory text, an authenticated user may be able to affect SSL-VPN availability via crafted requests. The corpus also shows a metadata inconsistency: the CVE description names FortiOS, FortiProxy, and FortiPAM, while the source item is labeled Si [truncated]
CVE-2025-24510 affects Siemens MS/TP Point Pickup Module devices that improperly handle specific incoming BACnet MSTP messages. An attacker already on the same BACnet network could send a specially crafted message that causes a denial of service, and the device must be power cycled to return to normal operation. Siemens and CISA published the advisory on 2025-05-13, and the advisory states that no fix is [truncated]
CVE-2025-24008 affects Siemens SIRIUS 3RK3 Modular Safety System (MSS) and SIRIUS Safety Relays 3SK2. The issue is an information-disclosure weakness: affected devices do not encrypt data in transit, so an attacker with network access may eavesdrop communications and recover sensitive information, including obfuscated safety passwords.
CVE-2025-24007 affects Siemens SIRIUS safety products that only use weak obfuscation for the safety password. According to the CISA CSAF advisory, an attacker with network access could retrieve and de-obfuscate that password, undermining protection intended to prevent inadvertent operating errors. The advisory is published with CVSS 3.1 7.5 (High).
CVE-2025-22862 was published on 2025-05-13 in CISA's CSAF advisory ICSA-25-135-01 and later republished on 2026-02-12. The advisory data associates the issue with Siemens RUGGEDCOM APE1808, but the vulnerability description text refers to FortiOS/FortiProxy and an Automation Stitch webhook path, and the remediation text references Fortigate NGFW. Because the supplied source corpus is internally inconsiste [truncated]
CVE-2024-55599 is listed in CISA’s republication of Siemens ProductCERT advisory SSA-864900 / ICSA-25-135-01 for Siemens RUGGEDCOM APE1808. The supplied record describes a network-exploitable, unauthenticated issue with CVSS 5.3 and CWE-358, but the same corpus also contains FortiOS/FortiProxy wording and a Fortigate remediation note that do not align with the Siemens product metadata. Treat the product/r [truncated]
CVE-2024-52963 was publicly disclosed in the supplied CISA CSAF advisory on 2025-05-13 and republished on 2026-02-12 based on Siemens ProductCERT SSA-864900. The core impact described in the corpus is a denial of service caused by an out-of-bounds write triggered by specially crafted packets. The advisory metadata in the source set identifies Siemens RUGGEDCOM APE1808 as the affected product, but the vuln [truncated]
CVE-2024-51447 is a medium-severity information-disclosure issue in Siemens Polarion's login flow. The CISA CSAF advisory and Siemens product advisory describe an observable response discrepancy during username validation, which can let an unauthenticated remote attacker determine whether a username is valid. While this does not affect integrity or availability, it can expose account-enumeration signals t [truncated]
CVE-2024-51446 is a stored cross-site scripting issue in Siemens Polarion. According to the advisory published on 2025-05-13, the application’s XML file upload handling does not properly sanitize uploaded files, allowing an authenticated remote attacker to plant malicious content that can later execute when other users download and view the file. Siemens identifies Polarion V2310 and V2404 as affected, wi [truncated]
CVE-2024-51444 is a medium-severity SQL injection issue in Siemens Polarion V2310 and V2404, publicly disclosed on 2025-05-13. The advisory states that insufficient validation of user input for database read queries could let an authenticated remote attacker bypass authorization controls and download data from the application's database. Siemens lists no fix planned for Polarion V2310 and recommends updat [truncated]
CVE-2024-43485 is a high-severity denial-of-service vulnerability associated with Siemens INTRALOG WMS in the supplied CISA/Siemens advisory material. The advisory indicates a network-reachable issue with no privileges and no user interaction required, and Siemens recommends updating to V5 or later.
According to the supplied CISA/Siemens CSAF record, CVE-2024-43483 is a high-severity denial-of-service issue with a network attack vector, no privileges required, no user interaction, and impact limited to availability. The advisory maps the affected product to Siemens INTRALOG WMS and recommends updating to V5 or later. The CVE description itself names .NET, .NET Framework, and Visual Studio, so defende [truncated]
CVE-2024-38095 is a high-severity denial-of-service vulnerability tracked by CISA in advisory ICSA-25-135-02 and mapped to Siemens INTRALOG WMS. The supplied CVSS vector indicates a network-reachable issue with low attack complexity, no privileges, no user interaction, and availability impact only. Siemens' stated remediation is to update to V5 or later.
CVE-2024-38081 is a HIGH-severity elevation-of-privilege issue in Siemens INTRALOG WMS per the supplied CISA CSAF record. The advisory rates the issue 7.3 and indicates a local attack path that requires low privileges and user interaction, but can still impact confidentiality, integrity, and availability. Siemens' documented remediation is to update affected systems to V5 or later.
CVE-2024-35264 is a high-severity remote code execution vulnerability described in CISA’s Siemens INTRALOG WMS advisory as a ".NET and Visual Studio Remote Code Execution Vulnerability." The advisory maps the issue to Siemens INTRALOG WMS and recommends updating the product to V5 or later. The published CVSS vector indicates network exposure, no privileges required, no user interaction, and high impacts t [truncated]
CVE-2024-32122 is a low-severity credential exposure issue described in the supplied advisory corpus. The vulnerable behavior allows a privileged authenticated attacker to change the LDAP server IP address in device configuration and point it at an attacker-controlled server, potentially causing LDAP credentials to be disclosed. The source corpus associates the issue with Siemens RUGGEDCOM APE1808, while [truncated]
CVE-2024-30105 was publicly disclosed by CISA on 2025-05-13 in advisory ICSA-25-135-02 for Siemens INTRALOG WMS. The advisory describes a .NET and Visual Studio denial-of-service vulnerability with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a remotely reachable availability impact with no confidentiality or integrity impact reported. Siemens’ documented remediation is to update to V5 or later.
CVE-2024-23815 affects Siemens Desigo CC. The advisory states that the server application fails to authenticate specific client requests, and that a modified client binary could let an unauthenticated remote attacker execute arbitrary SQL queries against the server database over the event port (default 4998/tcp). In environments where Installed Client access is limited to highly protected zones, the vendo [truncated]
CVE-2024-0056 is a high-severity security feature bypass issue published by CISA in Siemens INTRALOG WMS advisories on 2025-05-13. The advisory text identifies the problem as a Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability, and Siemens recommends updating to V5 or later. The CVSS vector supplied with the advisory indicates network reachability, [truncated]
CVE-2022-31812 is a high-severity availability issue in Siemens SiPass integrated server applications. According to the CISA CSAF advisory published on 2025-05-13, an attacker can send crafted network traffic that causes an out-of-bounds read while the application checks packet integrity, which can result in a denial of service. The provided source data identifies no impact to confidentiality or integrity [truncated]
CVE-2025-4373 describes an integer overflow in GLib's g_string_insert_unichar() function that can lead to a buffer underwrite when a very large insertion position is used. Siemens and CISA map the issue to affected industrial networking products running SINEC OS firmware, and Siemens provides a fix path to V3.3 or later. The CVE was published on 2026-01-28 and later republished/updated by CISA through 2026-02-25.
CVE-2025-23160 is a medium-severity availability issue described in a CISA/Siemens advisory for Siemens SIMATIC CN 4100 versions before 5.0. The underlying flaw is a Linux kernel media driver resource leak in firmware initialization on Mediatek devices with a system companion processor (SCP). Siemens’ remediation guidance is to update to V5.0 or later. Based on the supplied source corpus, this appears to [truncated]
CVE-2025-32872 is a high-severity SQL injection issue in Siemens TeleControl Server Basic. According to the CISA advisory and Siemens references, an authenticated remote attacker who can reach port 8000 may bypass authorization controls, read and write the application's database, and execute code with NT AUTHORITY\NetworkService privileges. Siemens lists a fixed version, and CISA's revision history shows [truncated]
CVE-2025-32870 is a high-severity SQL injection issue in Siemens TeleControl Server Basic. According to the advisory, an authenticated remote attacker who can reach port 8000 on a vulnerable system may exploit the internally used GetTraces method to bypass authorization controls, read and write the application's database, and execute code with NT AUTHORITY\NetworkService permissions. Siemens and CISA both [truncated]
CVE-2025-32869 is a high-severity vulnerability in Siemens TeleControl Server Basic. According to the CISA/Siemens advisory, an authenticated remote attacker who can reach port 8000 on a vulnerable system may abuse SQL injection in the internally used ImportCertificate method to bypass authorization controls, read and write the application's database, and execute code with NT AUTHORITY\NetworkService perm [truncated]
CVE-2025-32868 affects Siemens TeleControl Server Basic and is described by CISA as an SQL injection issue in the internally used ExportCertificate method. A remote authenticated attacker with access to port 8000 may bypass authorization controls, read and write the database, and execute code as NT AUTHORITY\NetworkService.
CVE-2025-32867 is a high-severity SQL injection vulnerability in Siemens TeleControl Server Basic. According to the advisory, an authenticated remote attacker who can reach port 8000 may bypass authorization controls, read and write the application's database, and execute code with NT AUTHORITY\NetworkService permissions. Siemens and CISA list an update to V3.1.2.2 or later as the vendor fix and recommend [truncated]
CVE-2025-32866 is a high-severity SQL injection vulnerability in Siemens TeleControl Server Basic. The issue is exposed through the internally used GetLogs method and can allow an authenticated remote attacker with access to port 8000 to bypass authorization controls, read and write the application database, and execute code as NT AUTHORITY\NetworkService. Siemens and CISA list update-to-fixed-version gui [truncated]