A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.
CVE-2026-102073 is a high-severity integer underflow vulnerability affecting multiple Siemens APOGEE and TALON products. The vulnerability arises from improper validation of user-controllable input length in the affected product web service. Exploitation could allow an unauthenticated remote attacker to read portions of device memory or cause a denial-of-service condition. The issue impacts all versions of APOGEE MBC (PPC) (BACnet and P2 Ethernet), APOGEE MEC (PPC) (BACnet and P2 Ethernet), and TALON TC Modular (BACnet). It also affects APOGEE PXC Compact and Modular (BACnet and P2 Ethernet) versions prior to 3.5.7 and 2.8.21 respectively.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delete scheduled tasks without proper authorization.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.
CVE-2026-89202 is a medium severity vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The flaw involves improper authorization checks on device disconnection requests, allowing an authenticated user with minimal privileges to disconnect active sessions of other users, including administrators. This can result in a denial of service by disrupting legitimate user sessions.
CVE-2026-89201 is a high-severity SQL injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The flaw arises from improper validation or sanitization of input in device group or facility names during the Bulk Export workflow. An authenticated attacker with limited privileges could exploit this to execute arbitrary SQL commands on the underlying database, potentially compromising confidentiality, integrity, and availability.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
CVE-2026-89197 is a high-severity SQL injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The issue arises from improper validation or sanitization of input in the Value field of notification conditions during Notification Profile configuration. An authenticated attacker with specific privileges could exploit this flaw to execute arbitrary SQL commands on the device's underlying database.
CVE-2026-89196 is a high-severity SQL injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The flaw arises from improper validation or sanitization of input in facility names during the Bulk Import/Export workflow. An authenticated attacker with specific privileges could exploit this to execute arbitrary SQL commands on the device's underlying database, potentially leading to full compromise of confidentiality, integrity, and availability.
CVE-2026-85115 is a medium severity vulnerability in Siemens .NET Client Library for SIMATIC S7 Webserver API versions prior to 3.3.62. The flaw involves improper redaction of PLC restore passwords in HTTP error exception messages, potentially exposing sensitive credentials in logs or diagnostic outputs. This exposure could allow an attacker with access to such outputs to obtain plaintext restore passwords and perform unauthorized operations on the PLC.