deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1661
Published: 2025-03-11
Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_text/index.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249621%40woocommerce-products-filter&new=3249621%40woocommerce-products-filter&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3253169%40woocommerce-products-filter&new=3253169%40woocommerce-products-filter&sfp_email=&sfph_mail=
CVE: CVE-2025-26707
Published: 2025-03-11
Description: Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]484646470
CVE: CVE-2025-2169
Published: 2025-03-11
Description: The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/currency-switcher/trunk/index.php#L1920; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249625%40currency-switcher&new=3249625%40currency-switcher&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3253183%40currency-switcher&new=3253183%40currency-switcher&sfp_email=&sfph_mail=
CVE: CVE-2024-13413
Published: 2025-03-11
Description: The ProductDyno plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘res’ parameter in all versions up to, and including, 1.0.24 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is potentially a duplicate of CVE-2025-22320.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/productdyno/trunk/admin/partials/productdyno-admin-display.php#L81; https://plugins.trac.wordpress.org/changeset/3251678/; https://wordpress.org/plugins/productdyno/#developers
CVE: CVE-2024-13574
Published: 2025-03-11
Description: The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7eb9ef20-5d34-425e-b7fc-38a769d0a822/; https://wpscan.com/vulnerability/7eb9ef20-5d34-425e-b7fc-38a769d0a822/
CVE: CVE-2024-13580
Published: 2025-03-11
Description: The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/48cffe03-adcf-4da2-a331-464ae511a805/; https://wpscan.com/vulnerability/48cffe03-adcf-4da2-a331-464ae511a805/
CVE: CVE-2024-13615
Published: 2025-03-11
Description: The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e8401973-f4c2-4ccf-a6ad-507dde8d2259/; https://wpscan.com/vulnerability/e8401973-f4c2-4ccf-a6ad-507dde8d2259/
CVE: CVE-2024-13836
Published: 2025-03-11
Description: The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/26c2026a-1490-4a0f-9d1d-54ee43c69f22/; https://wpscan.com/vulnerability/26c2026a-1490-4a0f-9d1d-54ee43c69f22/
CVE: CVE-2024-13853
Published: 2025-03-11
Description: The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/52991dd9-41f7-4cf8-b8c9-56dd4e62bf0c/
CVE: CVE-2024-13862
Published: 2025-03-11
Description: The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7692b768-a33f-45a2-90f1-1f[PII_REDACTED]/; https://wpscan.com/vulnerability/7692b768-a33f-45a2-90f1-1f[PII_REDACTED]/
CVE: CVE-2024-13864
Published: 2025-03-11
Description: The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b95b32b6-218a-4d02-b294-ab13458006b2/; https://wpscan.com/vulnerability/b95b32b6-218a-4d02-b294-ab13458006b2/
CVE: CVE-2025-0629
Published: 2025-03-11
Description: The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/39c36d6d-5522-422b-b890-524e27e67f7c/; https://wpscan.com/vulnerability/39c36d6d-5522-422b-b890-524e27e67f7c/
CVE: CVE-2024-13228
Published: 2025-03-11
Description: The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-359
References: https://plugins.trac.wordpress.org/browser/qubely/trunk/core/QUBELY.php#L1172; https://plugins.trac.wordpress.org/changeset/3253223/; https://www.wordfence.com/threat-intel/vulnerabilities/id/72c66e71-dddb-4142-ae13-da3caffd8714?source=cve
CVE: CVE-2025-26702
Published: 2025-03-11
Description: Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]71819342
CVE: CVE-2025-26703
Published: 2025-03-11
Description: Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]221570627
CVE: CVE-2025-26704
Published: 2025-03-11
Description: Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-269
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]484646494
CVE: CVE-2025-26705
Published: 2025-03-11
Description: Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]71263576
CVE: CVE-2025-26706
Published: 2025-03-11
Description: Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-269
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]484646486
CVE: CVE-2025-2173
Published: 2025-03-11
Description: A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-824, CWE-908, CWE-824
References: https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce; https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44; https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf
CVE: CVE-2025-2174
Published: 2025-03-11
Description: A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-189, CWE-190, CWE-190
References: https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f; https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44; https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf
CVE: CVE-2025-2175
Published: 2025-03-11
Description: A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189, CWE-190, CWE-190
References: https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44; https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf; https://vuldb.com/?ctiid.299204
CVE: CVE-2025-2190
Published: 2025-03-11
Description: The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-297
References: https://security.tecno.com/SRC/blogdetail/393?lang=en_US; https://security.tecno.com/SRC/securityUpdates
CVE: CVE-2024-58102
Published: 2025-03-11
Description: An issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing user-supplied queries containing deeply nested expressions.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-674
References: https://datalust.co/seq; https://github.com/datalust/seq-tickets/issues/2086; https://github.com/datalust/seq-tickets/issues/2367
CVE: CVE-2025-1434
Published: 2025-03-11
Description: The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.areal-topkapi.com/en/topkapi/security-bulletins; https://www.areal-topkapi.com/topkapi/bulletins-de-securite
CVE: CVE-2025-27911
Published: 2025-03-11
Description: An issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system "Event body limit bytes" setting, leading to increased resource consumption. With sufficiently large events, there can be disk space exhaustion (if saved to disk) or a termination of the server process with an out-of-memory error.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://datalust.co/seq; https://github.com/datalust/seq-tickets/issues/2365
CVE: CVE-2025-27912
Published: 2025-03-11
Description: An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when (1) Entra ID or OpenID Connect authentication is in use and a user visits a compromised/malicious site, or (2) when username/password or Active Directory authentication is in use and a user visits a compromised/malicious site under the same effective top-level domain as the Seq server. Exploitation of the vulnerability allows the attacker to conduct impersonation attacks and perform actions in Seq on behalf of the targeted user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://datalust.co/seq; https://github.com/datalust/seq-tickets/issues/2366
CVE: CVE-2025-2176
Published: 2025-03-11
Description: A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
CVSS Score: 7.3 (HIGH)
CWE: CWE-189, CWE-190, CWE-190
References: https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f; https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44; https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf
CVE: CVE-2025-2177
Published: 2025-03-11
Description: A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
CVSS Score: 7.3 (HIGH)
CWE: CWE-189, CWE-190, CWE-190
References: https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f; https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44; https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf
CVE: CVE-2024-28607
Published: 2025-03-11
Description: The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.
CVSS Score: 2.9 (LOW)
CWE: CWE-180
References: https://gist.github.com/aydinnyunus/4d71e7d9a433f3afc658724b903f4d23; https://github.com/librasean/IP-Utils/blob/4f88799f94f21efe6ea9135129ab2bbeb0c58edc/src/IsPrivate.ts#L4
CVE: CVE-2025-1550
Published: 2025-03-11
Description: The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/keras-team/keras/pull/20751; https://towerofhanoi.it/writeups/cve-2025-1550/
CVE: CVE-2025-27893
Published: 2025-03-11
Description: In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. NOTE: the Supplier analyzed the reported exploitation steps and found that, although the user can modify the immutable field, upon switching to View mode the field is reverted to its original value, without anything being saved to the database (and consequently there is no impact).
CVSS Score: 1.8 (LOW)
CWE: CWE-472
References: https://archerirm.com; https://github.com/NastyCrow/CVE-2025-27893; https://github.com/NastyCrow/CVE-2025-27893
CVE: CVE-2024-52285
Published: 2025-03-11
Description: A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.8), SiPass integrated ACC-AP (All versions < V6.4.8). Affected devices expose several MQTT URLs without authentication. This could allow an unauthenticated remote attacker to access sensitive data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-515903.html
CVE: CVE-2024-56181
Published: 2025-03-11
Description: A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions), SIMATIC IPC RC-543B (All versions < V35.01.12), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC RW-543B (All versions < V35.02.10), SIMATIC IPC127E (All versions < V27.01.11), SIMATIC IPC227E (All versions), SIMATIC IPC227G (All versions < V28.01.14), SIMATIC IPC277E (All versions), SIMATIC IPC277G (All versions < V28.01.14), SIMATIC IPC277G PRO (All versions < V28.01.14), SIMATIC IPC3000 SMART V3 (All versions), SIMATIC IPC327G (All versions < V28.01.14), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions < V28.01.14), SIMATIC IPC427E (All versions), SIMATIC IPC477E (All versions), SIMATIC IPC477E PRO (All versions), SIMATIC IPC527G (All versions), SIMATIC IPC627E (All versions < V25.02.15), SIMATIC IPC647E (All versions < V25.02.15), SIMATIC IPC677E (All versions < V25.02.15), SIMATIC IPC847E (All versions < V25.02.15), SIMATIC ITP1000 (All versions). The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to alter the secure boot configuration without proper authorization by directly communicate with the flash controller.
CVSS Score: 8.2 (HIGH)
CWE: CWE-693
References: https://cert-portal.siemens.com/productcert/html/ssa-216014.html
CVE: CVE-2024-56182
Published: 2025-03-11
Description: A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions), SIMATIC IPC RC-543B (All versions < V35.01.12), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC RW-543B (All versions < V35.02.10), SIMATIC IPC127E (All versions < V27.01.11), SIMATIC IPC227E (All versions), SIMATIC IPC227G (All versions < V28.01.14), SIMATIC IPC277E (All versions), SIMATIC IPC277G (All versions < V28.01.14), SIMATIC IPC277G PRO (All versions < V28.01.14), SIMATIC IPC3000 SMART V3 (All versions), SIMATIC IPC327G (All versions < V28.01.14), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions < V28.01.14), SIMATIC IPC427E (All versions), SIMATIC IPC477E (All versions), SIMATIC IPC477E PRO (All versions), SIMATIC IPC527G (All versions), SIMATIC IPC627E (All versions < V25.02.15), SIMATIC IPC647E (All versions < V25.02.15), SIMATIC IPC677E (All versions < V25.02.15), SIMATIC IPC847E (All versions < V25.02.15), SIMATIC ITP1000 (All versions). The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to disable the BIOS password without proper authorization by directly communicate with the flash controller.
CVSS Score: 8.2 (HIGH)
CWE: CWE-693
References: https://cert-portal.siemens.com/productcert/html/ssa-216014.html
CVE: CVE-2024-56336
Published: 2025-03-11
Description: A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The affected device contains an unlocked bootloader. This security oversight enables attackers to inject malicious code, or install untrusted firmware. The intrinsic security features designed to protect against data manipulation and unauthorized access are compromised when the bootloader is not secured.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cert-portal.siemens.com/productcert/html/ssa-787280.html