Simatic S7-plcsim Advanced (Siemens) - vulnerabilities (CVEs)

33 CVEs, 8 in the last 30 days, 6 known versions, newest CVE from 2026-10-13. Vendor: Siemens.

CVEs of Simatic S7-plcsim Advanced

CVE-2026-63357 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This…
CVE-2026-63356 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace…
CVE-2026-63355 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This…
CVE-2026-63354 - CVSS 9.6 (critical), 2026-10-13: Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This…
CVE-2026-63353 - CVSS 9.6 (critical), 2026-10-13: Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an…
CVE-2026-63352 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow…
CVE-2026-63351 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on…
CVE-2026-63350 - CVSS 9.6 (critical), 2026-10-13: Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized…
CVE-2026-54429 - CVSS 7.4 (high), 2026-07-14: A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network…
CVE-2026-25789 - CVSS 7.2 (high), 2026-05-12: Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user…
CVE-2026-25787 - CVSS 9.3 (critical), 2026-05-12: Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface.…
CVE-2026-25786 - CVSS 9.3 (critical), 2026-05-12: Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow…
CVE-2025-40943 - CVSS 9.6 (critical), 2026-03-10: Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering an authorized user,…
CVE-2025-30033 - CVSS 8.5 (high), 2025-08-12: The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an…
CVE-2023-37482 - CVSS 6.9 (medium), 2025-02-11: The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker…
CVE-2024-46887 - CVSS 6.9 (medium), 2024-10-08: The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an…
CVE-2024-46886 - CVSS 5.1 (medium), 2024-10-08: The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server…
CVE-2023-46156 - CVSS 7.5 (high), 2023-12-12: Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to create a denial of service condition. A…
CVE-2023-28831 - CVSS 8.7 (high), 2023-09-12: The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an…
CVE-2021-44694 - CVSS 7.5 (high), 2022-12-13: Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in…
CVE-2021-44693 - CVSS 7.5 (high), 2022-12-13: Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in…
CVE-2021-40365 - CVSS 7.5 (high), 2022-12-13: Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in…
CVE-2021-44695 - CVSS 7.5 (high), 2022-12-13: Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in…
CVE-2022-30694 - CVSS 6.5 (medium), 2022-11-08: The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the…
CVE-2022-38465 - CVSS 9.3 (critical), 2022-10-11: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS…
CVE-2022-0778 - CVSS 7.5 (high), 2022-03-15: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this…
CVE-2021-37205 - CVSS 7.5 (high), 2022-02-09: A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2…
CVE-2021-37204 - CVSS 7.5 (high), 2022-02-09: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controller family (All versions >= V2.9.2 <…
CVE-2021-37185 - CVSS 7.5 (high), 2022-02-09: A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2…
CVE-2020-15782 - CVSS 9.8 (critical), 2021-05-28: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS…
CVE-2019-10943 - CVSS 7.5 (high), 2019-08-13: A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)…
CVE-2019-10929 - CVSS 5.9 (medium), 2019-08-13: A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions),…
CVE-2019-6568 - CVSS 7.5 (high), 2019-04-17: The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service…