Loading story…
CERT-FR issued advisories for multiple vulnerabilities affecting Belden NetModule Router Software and a range of Siemens products. The flaws in Belden NetModule Router Software could allow a remote attacker to execute arbitrary code on affected systems and trigger a remote denial of service, raising concern for organizations that rely on these devices in operational and industrial environments.
A separate CERT-FR notice reported multiple vulnerabilities across Siemens products that could enable remote code execution, privilege escalation, and remote denial of service. While the available notice summary did not list specific product names, CVE identifiers, or patch details, the combined disclosures indicate broad exposure across industrial technology vendors and underscore the need for defenders to identify affected assets and apply vendor guidance as updates become available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CERT-FR published an advisory reporting multiple vulnerabilities affecting Siemens products. The notice said the flaws could enable remote arbitrary code execution, privilege escalation, and remote denial of service, though the provided content did not name specific products or patches.
CERT-FR published an advisory stating that multiple vulnerabilities were discovered in Belden NetModule Router Software. According to the notice, the flaws could allow remote arbitrary code execution and remote denial of service on affected systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Siemens disclosed multiple vulnerabilities in **SICAM 8** industrial control system products affecting **CPCI85 Central Processing/Communication**, **RTUM85 RTU Base**, and the **SICORE Base system**, with vulnerable versions identified as releases prior to **V26.10** or **V26.10.0** depending on the product. The issues are tracked as **`CVE-2026-27663`** and **`CVE-2026-27664`**, and can allow denial-of-service conditions in operational technology environments. Siemens published advisory **`SSA-246443`**, while the Canadian Centre for Cyber Security and CISA both urged asset owners to review the vendor guidance and apply the recommended updates. According to CISA, **`CVE-2026-27663`** is a resource exhaustion flaw in remote operation mode that can block parameterization and may require a reset or reboot, while **`CVE-2026-27664`** is an out-of-bounds write triggered by specially crafted XML input that can crash the affected service. Siemens has released fixed versions and advised organizations to validate patches before deployment and harden network access with segmentation, firewalls, and VPNs; CISA further recommended minimizing internet exposure of control systems and isolating OT networks from business networks to reduce the risk of disruption.
Jun 29, 2026
Siemens RUGGEDCOM ROX industrial networking devices contain a **critical** OS command injection flaw, tracked as `CVE-2025-40949`, in the Scheduler function of the Web UI. The vulnerability stems from improper input validation in the task scheduling backend, allowing an authenticated remote attacker to inject arbitrary commands and execute them with **root privileges** on the underlying operating system. The issue carries a **CVSS v3.1 score of 9.1** and was reported by researchers at the Palo Alto Networks OT Threat Research Lab. Affected products include multiple Siemens RUGGEDCOM ROX lines, including **MX5000**, **MX5000RE**, **RX1400**, **RX1500-series**, **RX1536**, and **RX5000** devices running versions earlier than **2.17.1**. CISA republished Siemens ProductCERT guidance urging organizations to upgrade to fixed releases, restrict network exposure, and follow Siemens industrial security recommendations to reduce the risk of exploitation in operational technology environments.
Jun 29, 2026
**Siemens published security advisories for multiple products**, prompting both CISA ICS advisories and a Canadian Centre for Cyber Security alert covering a broad set of affected industrial/engineering software and OT-adjacent components. Reported issues include a **stored XSS** in *Siemens Polarion* (CVE-2025-40587; CVSS 7.6) where authenticated users can inject JavaScript via crafted document titles, and **local privilege escalation** paths in *Siemens SINEC NMS* and its *User Management Component (UMC)* (CVE-2026-25655, CVE-2026-25656; CVSS 7.8) that allow low-privileged users to modify configuration/search paths to load malicious DLLs and potentially gain elevated execution (including SYSTEM-level impact). Siemens also addressed a **missing authorization** condition affecting *Siveillance Video Management Servers* Webhooks/MIP Webhooks API (CVSS 6.3), enabling a read-only user to obtain full API access. Additional advisories cover file-parsing and third-party component risks that can lead to crashes or potential code execution. *Siemens NX* is affected by multiple **CGM file parsing** flaws (CVE-2026-22923/22924/22925; CVSS 7.8) that can be triggered when a user opens a malicious file, and *Siemens Solid Edge* includes an **out-of-bounds read** in the PS/IGES Parasolid translator when processing crafted IGS files (CVSS 7.8). *Desigo CC* and *SENTRON Powermanager* are impacted via the third-party *WIBU Systems CodeMeter Runtime* chain tied to **CVE-2023-38545** (curl SOCKS5 heap overflow; CVSS 8.8), with Siemens providing component update instructions. *Siemens SINEC OS* before V3.3 aggregates a large set of third-party CVEs across supported platforms, and *Siemens COMOS* advisories include multiple issues (up to CVSS 10) spanning potential code execution, DoS, data exposure, and access control violations; Siemens recommends updating where fixes are available and applying countermeasures where they are not yet released.
Jun 29, 2026