Siemens AG

A critical vulnerability, CVE-2026-56451, in Siemens Opcenter X versions prior to V2604 allows unauthenticated remote attackers to forge arbitrary JSON Web Tokens (JWTs) due to improper algorithm validation, leading to full authentication bypass, user impersonation including administrative accounts, and complete unauthorized access to the application.

CVE-2026-33893 describes a vulnerability in Siemens Teamcenter where hardcoded keys used for obfuscation are stored directly within the application, potentially allowing an attacker to obtain these keys and gain unauthorized access.

ROS# versions prior to V2.2.2 are vulnerable to path traversal (CVE-2026-41551) due to insufficient sanitization of user input, potentially enabling remote attackers to read arbitrary files.

CVE-2026-25789 describes a vulnerability where affected devices do not properly validate and sanitize filenames on the Firmware Update page, potentially allowing a remote attacker to execute malicious JavaScript in the context of the user's session through social engineering, leading to session hijacking or credential theft.

Siemens SIMATIC CN 4100 versions before V5.0 are vulnerable to resource exhaustion due to processing a high volume of TCP SYN packets, leading to a denial-of-service condition.

A null pointer dereference vulnerability exists in affected devices while processing specially crafted IPv4 requests, potentially allowing a remote attacker to cause a denial of service, requiring a manual restart to recover the system.