Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-40210 State: PUBLISHED Published: 2025-11-21T10:21:35.540Z Last Updated: 2025-11-21T10:21:35.540Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An at
rations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now. References: - https://git.kernel.org/stable/c/b3ee7ce432289deac87b9d14e01f2fe6958f7f0b - https://git.kernel.org/stable/c/3e7f011c255582d7c914133785bbba1990441713
CVE ID: CVE-2025-40211 State: PUBLISHED Published: 2025-11-21T10:21:36.438Z Last Updated: 2025-11-24T09:50:00.111Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_s
ideo_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. [ rjw: Changelog edit ] References: - https://git.kernel.org/stable/c/4e85246ec0d019dfba86ba54d841ef6694f97149 - https://git.kernel.org/stable/c/de5fc93275a4a459fe2f7cb746984f2ab3e8292a - https://git.kernel.org/stable/c/293125536ef5521328815fa7c76d5f9eb1635659 - https://git.kernel.org/stable/c/8f067aa59430266386b83c18b983ca583faa6a11
CVE ID: CVE-2025-40212 State: PUBLISHED Published: 2025-11-24T13:04:20.888Z Last Updated: 2025-11-24T13:04:20.888Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct s
s a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service. Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle. To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected. References: - https://git.kernel.org/stable/c/b6bc86ce3944b10b9fc181fc00c1a520a20ed965 - https://git.kernel.org/st
cted. References: - https://git.kernel.org/stable/c/b6bc86ce3944b10b9fc181fc00c1a520a20ed965 - https://git.kernel.org/stable/c/c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2 - https://git.kernel.org/stable/c/8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c
CVE ID: CVE-2025-40213 State: PUBLISHED Published: 2025-11-24T15:59:44.000Z Last Updated: 2025-11-24T15:59:44.000Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array. Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove. Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds. As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report statu
n't memcpy outside bounds. As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error. References: - https://git.kernel.org/stable/c/5c19daa93d9af29f1f46251b47e1ea66bcc8d679 - https://git.kernel.org/stable/c/1c9aca1787e8395a2c59fef20e914467958969c5 - https://git.kernel.org/stable/c/e8785404de06a69d89dcdd1e9a0b6ea42dc6d327
CVE ID: CVE-2025-40300 State: PUBLISHED Published: 2025-09-11T16:49:24.809Z Last Updated: 2025-11-17T16:05:33.433Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before ret
is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ] Additional Analyst Notes: - CVE Program Contain
e cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ac60717f9a8d21c58617d0b34274babf24135835 - https://git.kernel.org/stable/c/c08192b5d6730a914dee6175bc71092ee6a65f14 - https://git.kernel.org/stable/c/d5490dfa35427a2967e00a4c7a1b95fdbc8ede34 - https://git.kernel.org/stable/c/2f4f2f8f860cb4c3336a7435ebe8dcfded0c9c6e - https://git.kernel.org/stable/c/15006289e5c38b2a830e1fba221977a27598176c - https://git.kernel.org/stable/c/893387c18612bb452336a5881da0d015a7e8f4a2 - https://git.kernel.org/stable/c/f866eef8d1c65504d30923c3f14082ad294d0e6d - https://git.kernel.org/stable/c/34e56
8f4a2 - https://git.kernel.org/stable/c/f866eef8d1c65504d30923c3f14082ad294d0e6d - https://git.kernel.org/stable/c/34e5667041050711a947e260fc9ebebe08bddee5 - https://git.kernel.org/stable/c/d7ddc93392e4a7ffcccc86edf6ef3e64c778db52 - https://git.kernel.org/stable/c/459274c77b37ac63b78c928b4b4e748d1f9d05c8 - https://git.kernel.org/stable/c/510603f504796c3535f67f55fb0b124a303b44c8 - https://git.kernel.org/stable/c/9c23a90648e831d611152ac08dbcd1283d405e7f - https://git.kernel.org/stable/c/2f8f173413f1cbf52660d04df92d0069c4306d25
CVE ID: CVE-2025-40325 State: PUBLISHED Published: 2025-04-18T07:01:41.619Z Last Updated: 2025-05-26T05:25:37.942Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: md/raid10: wait barrier before returning discard request with REQ_NOWAIT raid10_handle_discard should wait barrier before returning a discard bio which has REQ_NOWAIT. And there is no need to print warning calltrace if a discard bio has REQ_NOWAIT flag. Quality engineer usually checks dmesg and reports error if dmesg has warning/error calltrace. References: - https://git.kernel.org/stable/c/31d3156efe909b53ba174861a3da880c688f5edc - https://git.kernel.org/stable/c/3db4
ences: - https://git.kernel.org/stable/c/31d3156efe909b53ba174861a3da880c688f5edc - https://git.kernel.org/stable/c/3db4404435397a345431b45f57876a3df133f3b4
CVE ID: CVE-2025-40364 State: PUBLISHED Published: 2025-04-18T13:50:24.257Z Last Updated: 2025-10-11T12:29:35.640Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed. References: - https://git.kernel.org/stable/c/233b210a678bddf8b49b02a070074a52b87e6d43 - https://git.kernel.org/stable/c/a1b17713b32c75a90132ea2f92b1257f3bbc20f3 - https://git.kernel.org/stable/c/b86f1d51731e621e83305dc9564ae14c9ef752bf - https://git.kernel.org/stable/c/a94592ec30f
- https://git.kernel.org/stable/c/b86f1d51731e621e83305dc9564ae14c9ef752bf - https://git.kernel.org/stable/c/a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3 - https://git.kernel.org/stable/c/35ae7910c349fb3c60439992e2e0e79061e95382 - https://git.kernel.org/stable/c/f0ef94553868d07c1b14d7743a7e2553e5a831a3 - https://git.kernel.org/stable/c/d63b0e8a628e62ca85a0f7915230186bb92f8bb4
CVE ID: CVE-2025-40545 State: PUBLISHED Published: 2025-11-18T08:55:52.919Z Last Updated: 2025-11-18T21:42:35.078Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: SolarWinds Observability Self-Hosted Problem Types: CWE-601 Description: SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-405
t Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40545 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4-1_release_notes.htm
CVE ID: CVE-2025-40547 State: PUBLISHED Published: 2025-11-18T08:35:03.970Z Last Updated: 2025-11-19T04:55:23.020Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-116 Description: A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.co
service accounts by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40547 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-3_release_notes.htm
CVE ID: CVE-2025-40548 State: PUBLISHED Published: 2025-11-18T08:38:19.354Z Last Updated: 2025-11-19T04:55:22.266Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-269 Description: A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/tr
vice accounts by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40548 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-3_release_notes.htm
CVE ID: CVE-2025-40549 State: PUBLISHED Published: 2025-11-18T08:41:24.582Z Last Updated: 2025-11-19T04:55:21.438Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-22 Description: A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/tr
directories are handled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40549 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-3_release_notes.htm
CVE ID: CVE-2025-40555 State: PUBLISHED Published: 2025-05-13T09:38:50.440Z Last Updated: 2025-05-13T13:25:06.076Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Siemens Products: APOGEE PXC+TALON TC Series (BACnet) Problem Types: CWE-440 Description: A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted device, and potentially r
pecially crafted message that results in a partial denial of service condition of the targeted device, and potentially reduce the availability of BACnet network. A power cycle is required to restore the device's normal operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-718393.html
CVE ID: CVE-2025-40556 State: PUBLISHED Published: 2025-05-13T09:38:51.701Z Last Updated: 2025-05-13T18:49:32.352Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: BACnet ATEC 550-440, BACnet ATEC 550-441, BACnet ATEC 550-445, BACnet ATEC 550-446 Problem Types: CWE-20 Description: A vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet ATEC 550-445 (All versions), BACnet ATEC 550-446 (All versions). Affected devices improperly handle specific incoming BACnet MSTP messages. This could allow an attacker residing in the same BACnet network to send a specially crafted MSTP message tha
messages. This could allow an attacker residing in the same BACnet network to send a specially crafted MSTP message that results in a denial of service condition of the targeted device. A power cycle is required to restore the device's normal operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-828116.html
CVE ID: CVE-2025-40566 State: PUBLISHED Published: 2025-05-13T09:38:52.993Z Last Updated: 2025-05-13T18:47:35.480Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0 Problem Types: CWE-613 Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Additional Analyst Notes:
ned the session token by other means, to re-use a legitimate user's session even after logout. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-339086.html
CVE ID: CVE-2025-40567 State: PUBLISHED Published: 2025-06-10T15:17:28.878Z Last Updated: 2025-06-10T17:11:51.298Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Siemens Products: RUGGEDCOM RST2428P, SCALANCE XC316-8, SCALANCE XC324-4, SCALANCE XC324-4 EEC, SCALANCE XC332, SCALANCE XC416-8, SCALANCE XC424-4, SCALANCE XC432, SCALANCE XCH328, SCALANCE XCM324, SCALANCE XCM328, SCALANCE XCM332, SCALANCE XR302-32, SCALANCE XR322-12, SCALANCE XR326-8, SCALANCE XR326-8 EEC, SCALANCE XR502-32, SCALANCE XR522-12, SCALANCE XR526-8, SCALANCE XRH334 (24 V DC, 8xFO, CC), SCALANCE XRM334 (230 V AC, 12xFO), SCALANCE XRM334 (230 V AC, 8xFO), SCALANCE XRM334 (230V AC, 2x10G
24 V DC, 8xFO, CC), SCALANCE XRM334 (230 V AC, 12xFO), SCALANCE XRM334 (230 V AC, 8xFO), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+), SCALANCE XRM334 (24 V DC, 12xFO), SCALANCE XRM334 (24 V DC, 8xFO), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+), SCALANCE XRM334 (2x230 V AC, 12xFO), SCALANCE XRM334 (2x230 V AC, 8xFO), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) Problem Types: CWE-863 Description: A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.2), SCALANCE XC324-4 (6GK5328-4TS00-2AC2) (All versions < V3.2), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) (All versions < V3.2), S
E XC324-4 (6GK5328-4TS00-2AC2) (All versions < V3.2), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) (All versions < V3.2), SCALANCE XC332 (6GK5332-0GA00-2AC2) (All versions < V3.2), SCALANCE XC416-8 (6GK5424-8TR00-2AC2) (All versions < V3.2), SCALANCE XC424-4 (6GK5428-4TR00-2AC2) (All versions < V3.2), SCALANCE XC432 (6GK5432-0GR00-2AC2) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.2), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.2), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-2AR3) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-3AR3)
versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-2AR3) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-3AR3) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-4AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-2AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-3AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-4AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-2AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-3AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-4AR3) (All versions < V3.2), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-2AR3) (All versions < V3.2),
CE XR326-8 EEC (6GK5334-2TS00-2ER3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-2AR3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-3AR3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-4AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-2AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-3AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-4AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-2AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-3AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-4AR3) (All versions < V3.2), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.2), SCALAN
TR00-4AR3) (All versions < V3.2), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM3
R3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.2). The "Load Rollback" functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with "guest" role to make the affected product roll back configuration changes made by privileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-693776.html
CVE ID: CVE-2025-40568 State: PUBLISHED Published: 2025-06-10T15:17:31.304Z Last Updated: 2025-06-10T17:11:29.124Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Siemens Products: RUGGEDCOM RST2428P, SCALANCE XC316-8, SCALANCE XC324-4, SCALANCE XC324-4 EEC, SCALANCE XC332, SCALANCE XC416-8, SCALANCE XC424-4, SCALANCE XC432, SCALANCE XCH328, SCALANCE XCM324, SCALANCE XCM328, SCALANCE XCM332, SCALANCE XR302-32, SCALANCE XR322-12, SCALANCE XR326-8, SCALANCE XR326-8 EEC, SCALANCE XR502-32, SCALANCE XR522-12, SCALANCE XR526-8, SCALANCE XRH334 (24 V DC, 8xFO, CC), SCALANCE XRM334 (230 V AC, 12xFO), SCALANCE XRM334 (230 V AC, 8xFO), SCALANCE XRM334 (230V AC, 2x10G
R3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.2). An internal session termination functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with "guest" role to terminate legitimate users' sessions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-693776.html
CVE ID: CVE-2025-40569 State: PUBLISHED Published: 2025-06-10T15:17:33.607Z Last Updated: 2025-06-10T17:11:08.796Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: Siemens Products: RUGGEDCOM RST2428P, SCALANCE XC316-8, SCALANCE XC324-4, SCALANCE XC324-4 EEC, SCALANCE XC332, SCALANCE XC416-8, SCALANCE XC424-4, SCALANCE XC432, SCALANCE XCH328, SCALANCE XCM324, SCALANCE XCM328, SCALANCE XCM332, SCALANCE XR302-32, SCALANCE XR322-12, SCALANCE XR326-8, SCALANCE XR326-8 EEC, SCALANCE XR502-32, SCALANCE XR522-12, SCALANCE XR526-8, SCALANCE XRH334 (24 V DC, 8xFO, CC), SCALANCE XRM334 (230 V AC, 12xFO), SCALANCE XRM334 (230 V AC, 8xFO), SCALANCE XRM334 (230V AC, 2x10G