FAIL › dossier
Siemens
VENDOR· dossier confidence 40%
Siemens is a major industrial automation vendor with a concerning security track record, repeatedly shipping critical vulnerabilities in its OT, ICS, and physical security product lines. Its devices have been exploited for remote code execution, arbitrary file upload, and authentication bypass, posing significant risks to critical infrastructure and industrial operations.
PROFILE
CategoryIndustrial Automation & OT VendorWhat they doSiemens is a German multinational conglomerate that designs, manufactures, and distributes industrial automation products, including PLCs, SCADA systems, and physical security control platforms.HQMunich, Germany
Websitehttps://www.siemens.com ↗
SECURITY POSTURE
Siemens exhibits a high-risk security posture characterized by a history of critical and high-severity vulnerabilities across its industrial and physical security product lines, including remote code execution, arbitrary file upload, and authentication bypass flaws in widely deployed OT and CPS devices.
Notable failures
- CVE-2026-50093: Arbitrary file upload in Siveillance Control OIS yielding root access
- CVE-2026-62645: Authentication bypass and RCE in Reyrolle 7SR5 protection relays (CVSS 9.8)
- CVE-2026-58115: Critical RCE flaw in SIMATIC IoT2050
- CVE-2021-44228: Log4j2 RCE affecting Siemens infrastructure components
- CVE-2026-62653: Memory corruption in Reyrolle 7SR5 firmware-update mode
Patterns: repeated critical RCE and authentication bypass in OT/ICS devices; unvalidated file upload and input in physical security control platforms; vulnerabilities in third-party components (e.g., Mongoose Web Server, Log4j2) affecting industrial products
FAILURE HISTORY · 20
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2022-03-03 | CVE-2016-8562 | high | Siemens SIMATIC CP 1543-1 improper privilege management allowed remote denial of service. |
| 2026-06-09 | CVE-2026-46749 | high | CVE-2026-46749: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update |
| 2026-05-13 | CVE-2026-0264 | critical | CVE-2026-0264: A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo |
| 2026-05-13 | CVE-2026-0258 | critical | CVE-2026-0258: A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation o |
| 2025-12-09 | CVE-2025-40938 | high | CVE-2025-40938: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). |
| 2025-09-24 | CVE-2025-10585 | critical | CVE-2025-10585: Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote a |
| 2025-09-05 | CVE-2025-39682 | critical | CVE-2025-39682: In the Linux kernel, the following vulnerability has been resolved: tls: fix ha |
| 2022-02-18 | CVE-2022-25315 | critical | CVE-2022-25315: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNa |
| 2022-02-16 | CVE-2022-25236 | critical | CVE-2022-25236: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert names |
| 2022-02-16 | CVE-2022-25235 | critical | CVE-2022-25235: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of e |
| 2022-01-24 | CVE-2022-23852 | critical | CVE-2022-23852: Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer |
| 2022-01-10 | CVE-2022-22824 | critical | CVE-2022-22824: defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an intege |
| 2022-01-10 | CVE-2022-22822 | critical | CVE-2022-22822: addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer ove |
| 2022-01-10 | CVE-2022-22823 | critical | CVE-2022-22823: build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer ov |
| 2021-12-10 | CVE-2021-44228 | critical | CVE-2021-44228: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12 |
| 2021-09-23 | CVE-2021-22945 | critical | CVE-2021-22945: When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some |
| 2021-09-16 | CVE-2021-40438 | critical | CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an orig |
| 2020-04-09 | CVE-2020-11656 | critical | CVE-2020-11656: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, a |
| 2019-12-09 | CVE-2019-19646 | critical | CVE-2019-19646: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAG |
| 2019-12-05 | CVE-2019-19317 | critical | CVE-2019-19317: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
Vulnerability in critical industrial control system component, allowing remote DoS, represents a significant security failure for Siemens in the ICS domain.
Vulnerability in critical industrial control system component, allowing remote DoS, represents a significant security failure for Siemens in the ICS domain.
"An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service."
DOSSIER SOURCES
- CF Infobase - cfib.cf.siemens.com · cfib.cf.siemens.com
- Overseer Infobase - overseer1.erlm.siemens.de · overseer1.erlm.siemens.de
- Siemens CVEs and Security Vulnerabilities - OpenCVE · app.opencve.io
- Daily OT Security News: September 12, 2026 - Viakoo, Inc · www.viakoo.com
- CVE-2026-50093: Arbitrary File Upload in Siemens Siveillance Control ... · breachspider.com
- Siemens Reyrolle 7SR5 Critical Vulnerabilities - ICS Security Alert · aviatrix.ai
- Siemens Reyrolle 7SR5 V2.70 Fixes 14 Relay Vulnerabilities · windowsforum.com
- Siemens Patches SIMATIC IoT2050 Critical RCE Flaw CVE-2026-58115 · koeed.com
Open questions: Current patching SLA for industrial control system vulnerabilities · Specific remediation timelines for CVE-2026-50093 and CVE-2026-0264
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-17 04:46:48.036598+00:00