{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Siemens heeft kwetsbaarheden verholpen in diverse producten zoals SIMATIC en COMOS.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:\n\n- Denial-of-Service (DoS)\n- Manipulatie, wijziging of verwijdering van gegevens\n- Omzeilen van beveiligingsmaatregelen\n- Omzeilen van authenticatie\n- Ongeautoriseerde toegang tot systemen en gevoelige gegevens\n- (Remote) code execution met gebruikersrechten\n- (Remote) code execution met root-/administratorrechten\n- Verhogen van rechten", "title": "Interpretaties" }, { "category": "description", "text": "Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Zie de bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an OS Command", "title": "CWE-78" }, { "category": "general", "text": "Improper Control of Generation of Code", "title": "CWE-94" }, { "category": "general", "text": "Unchecked Return Value", "title": "CWE-252" }, { "category": "general", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "general", "text": "Cross-Site Request Forgery", "title": "CWE-352" }, { "category": "general", "text": "Double Free", "title": "CWE-415" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Binding to an Unrestricted IP Address", "title": "CWE-1327" }, { "category": "general", "text": "Weak Authentication", "title": "CWE-1390" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-045512.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-242944.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-435267.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-443410.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-651988.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-678870.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-710379.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-724261.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-898633.html" }, { "category": "external", "summary": "Reference", "url": "https://cert-portal.siemens.com/productcert/html/ssa-970803.html" } ], "title": "Kwetsbaarheden verholpen in Siemens producten", "tracking": { "current_release_date": "2026-11-11T10:15:57.755952Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0479", "initial_release_date": "2026-11-11T10:15:57.755952Z", "revision_history": [ { "date": "2026-11-11T10:15:57.755952Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "COMOS Walkinside" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "Project Server Web Administration Tool" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-3" } } ], "category": "product_name", "name": "SIMATIC BRAUMAT" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-4" } } ], "category": "product_name", "name": "SIMATIC SISTAR" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-5" } } ], "category": "product_name", "name": "Simatic Wincc" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-6" } } ], "category": "product_name", "name": "TIA Administrator" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-7" } } ], "category": "product_name", "name": "User Management Component" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-58114", "cwe": { "id": "CWE-1390", "name": "Weak Authentication" }, "notes": [ { "category": "other", "text": "Weak Authentication", "title": "CWE-1390" }, { "category": "description", "text": "Multiple versions of SIMATIC software are vulnerable to NTLM relay attacks allowing unauthenticated remote attackers to impersonate users and potentially impact services such as SQL servers used by WinCC.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "self", "summary": "CVE-2026-58114 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58114.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] } ], "title": "CVE-2026-58114" }, { "cve": "CVE-2026-106175", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "other", "text": "Double Free", "title": "CWE-415" }, { "category": "description", "text": "A Double Free vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitch allows a local authenticated attacker to crash the newcli daemon using crafted CLI commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "self", "summary": "CVE-2026-106175 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-106175.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "baseScore": 2.3, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] } ], "title": "CVE-2026-106175" }, { "cve": "CVE-2026-109097", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code" }, "notes": [ { "category": "other", "text": "Improper Control of Generation of Code", "title": "CWE-94" }, { "category": "description", "text": "ROS# versions prior to V2.3.1 improperly escape text in message definition files, allowing attackers to inject arbitrary code into generated programs via crafted files.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "self", "summary": "CVE-2026-109097 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109097.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] } ], "title": "CVE-2026-109097" }, { "cve": "CVE-2026-109830", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command", "title": "CWE-78" }, { "category": "description", "text": "A vulnerability in meta-iot2050 (versions >= V01.03.01) allows attackers who can manipulate the device's configuration file to execute arbitrary code due to lack of execution checks on configuration file parts.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "self", "summary": "CVE-2026-109830 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109830.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] } ], "title": "CVE-2026-109830" }, { "cve": "CVE-2026-111497", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "other", "text": "Unchecked Return Value", "title": "CWE-252" }, { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "description", "text": "Multiple out-of-bounds write vulnerabilities in Google and Node.js Brotli decoders across various versions allow remote code execution, memory corruption, denial of service, and data disclosure.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "self", "summary": "CVE-2026-111497 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-111497.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] } ], "title": "CVE-2026-111497" }, { "cve": "CVE-2026-112136", "cwe": { "id": "CWE-1327", "name": "Binding to an Unrestricted IP Address" }, "notes": [ { "category": "other", "text": "Binding to an Unrestricted IP Address", "title": "CWE-1327" }, { "category": "description", "text": "Mendix Studio Pro versions 11.12.6 to 11.16.0 have a vulnerability where the MCP Server's HTTP listener is not restricted to the loopback interface, allowing remote attackers with network access to interact with the server.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "self", "summary": "CVE-2026-112136 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112136.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] } ], "title": "CVE-2026-112136" }, { "cve": "CVE-2026-112137", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery" }, "notes": [ { "category": "other", "text": "Cross-Site Request Forgery", "title": "CWE-352" }, { "category": "description", "text": "Mendix Studio Pro versions 11.12.6 to 11.12.7 and 11.15.0 to 11.16.0, including the MCP Server, are vulnerable to Cross-Site Request Forgery due to improper validation of Content-Type and Origin headers on HTTP requests.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "self", "summary": "CVE-2026-112137 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112137.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5", "CSAFPID-6", "CSAFPID-7" ] } ], "title": "CVE-2026-112137" } ] }