csaf_abbcritical · 9.8
9akk108473a4963
ABB's ASPECT building management system, versions 3.09.00 and earlier, contains PHP vulnerabilities that could let an attacker with network access insert and run arbitrary code and take control of the system node, potentially compromising the confidentiality, integrity and availability of the system and its log files. Exploitation requires a misconfigured system, such as one exposed to the internet or an unsecured network, and ABB notes ASPECT is not intended to be internet-facing. No firmware update is currently available, and ABB advises applying the documented mitigations; the advisory does not state a severity rating.
csaf_mettlertoledogmbhcritical · 9.8
vde-2026-137
METTLER TOLEDO's OCTO Image Server includes a vulnerable version of PHP affected by two PHP2Shell issues that may allow remote code execution, meaning an attacker could execute arbitrary code on the system hosting the server. The advisory states the risk to installations is low because the product is typically installed on internal networks and not intended to be directly exposed to the public internet, and it recommends upgrading PHP to version 8.2.35. The advisory does not establish any automotive connection for this product.
csaf_abbcritical · 9.8
sa26p015
B&R's APROL industrial automation product is affected by publicly disclosed PHP vulnerabilities that, if successfully exploited, could let an attacker insert and run arbitrary code on affected devices. An attacker would need network access to an affected system node, for example by connecting directly, through a misconfigured or compromised firewall, or by infecting the network with malicious software, and could then send a specially crafted message to exploit the flaw. B&R states it had received no reports of these vulnerabilities being exploited in APROL when the advisory was issued, and the advisory does not assign a severity rating.
csaf_abbcritical · 9.8
4hzk000017
ABB's Manufacturing Execution System uses DokuWiki help servers running PHP, and two publicly reported PHP vulnerabilities could let an attacker with network access run arbitrary code remotely on that server, which ABB describes as a critical security issue. Fixed PHP updates are available and no active exploitation had been reported when the advisory was issued. This is an automotive-relevant manufacturing system, so confirm which PHP version your DokuWiki servers run and apply the update.
csaf_siemenscritical · 9.8
ssa-566512
Siemens reports that PAN-OS software on RUGGEDCOM APE1808 devices is affected by PHP2Shell vulnerabilities documented by Palo Alto Networks, and directs customers to apply the workarounds in Palo Alto Networks' upstream advisories. An attacker could exploit improper memory handling in PHP to achieve remote code execution. The advisory does not state a severity rating and does not describe the specific impact on the RUGGEDCOM devices beyond the referenced upstream vulnerabilities.
csaf_festosecokgcritical · 9.8
fsa-202602
Festo AX OS versions 25.0.1.46 and 25.9.2.4, used in the Festo CEPE product and based on PLCnext, are affected by two OpenSSL vulnerabilities, CVE-2025-15467 and CVE-2025-69419, which can be triggered when maliciously crafted firmware, key files, PKCS#12 files, CMS/PKCS#7 content, or digitally signed objects are uploaded and processed by the system. A successful attack may cause memory corruption, application crashes, or denial of service, and depending on the code path and platform protections, execution of malicious code may be possible, jeopardizing confidentiality, integrity, and availability; in the device context, exploitation typically requires a logged-in high-privileged user or the processing of attacker-supplied cryptographic objects. Festo recommends updating to Festo AX OS 26.3.1.4 or later as soon as the fixed version becomes available.
csaf_mettlertoledogmbhcritical · 9.8
vde-2026-112
The advisory covers a vulnerability, CVE-2026-10109, in the IBM Db2 12.1.2 component shipped with METTLER TOLEDO STARe Software v20.00, caused by improper handling of the pre-authentication DRDA handshake. Successful exploitation could allow an attacker to execute remote code on systems using the affected Db2 component. The advisory does not state a severity rating; the fix is to update the Db2 component of STARe Software V20.00 to version 12.1.4 Update 87349. The advisory does not establish an automotive connection, so this could be relevant only where STARe Software or its bundled Db2 component is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
csaf_ncscnlcritical · 9.8
ncsc-2026-0431
IBM has released patches for multiple security vulnerabilities in DataPower Gateway versions 10.5 through 11.0 and its underlying subcomponents, including issues such as use-after-free bugs, buffer overflows, race conditions, and cryptographic errors. An attacker could exploit these to achieve remote code execution, denial of service, cross-site scripting, or authorization bypass, with some attacks requiring authentication and others not; the advisory rates the likelihood as medium and the potential damage as high. This could be relevant where DataPower Gateway is deployed in automotive systems, for example as an integration or API gateway in vehicle back-end or manufacturing environments. Confirm applicability through the product SBOM or dependency inventory.
csaf_cisacritical · 9.8
icsa-26-288-02
The advisory covers vulnerabilities in Guangzhou Juan IoT Technology EseeCloud IP cameras, where an attacker could exploit a hard-coded credential to log in to affected devices and could also unbind a device from its current owner and rebind it to the attacker's account, potentially gaining control over the affected IP cameras. The advisory lists Transportation Systems among the critical infrastructure sectors where these products may be deployed, so this could be relevant where EseeCloud cameras are used in automotive or road-transport environments. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.8
cve-2026-105016
A heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network, affecting Microsoft .NET versions 8.0 through 11.0, Microsoft Visual Studio 2022 and 2026, and various Windows 11 and Windows Server releases. This could be relevant where Microsoft QUIC is deployed in automotive systems, since the affected platforms may be used in vehicle or automotive-manufacturing environments. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.8
cve-2026-100219
Microsoft QUIC on the listed Windows 11 and Windows Server versions contains a use-after-free vulnerability that lets an unauthorized attacker execute code over a network. The advisory does not state a severity rating or confirm any automotive deployment. This could be relevant where Microsoft QUIC is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
csaf_ncscnlcritical · 9.8
ncsc-2026-0415
Siemens has fixed vulnerabilities across products including Desigo, Industrial Plus, RUGGEDCOM, SIMATIC and SIPLUS, and the advisory states an attacker would need access to the production environment to exploit them. Successful attacks could cause denial of service, data manipulation, bypass of security measures, remote code execution with root or admin rights, access to system and sensitive data, and privilege escalation, with the advisory rating likelihood as medium and damage as high. This could be relevant where these Siemens products are deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
csaf_siemenscritical · 9.8
ssa-765416
The RUGGEDCOM CROSSBOW Station Access Controller (SAC) is affected by multiple vulnerabilities in its integrated SQLite component, which could let an attacker execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version of the product and recommends updating to the latest version. Siemens also recommends protecting network access to these devices with appropriate mechanisms and operating them in a protected IT environment.
cvelistv5critical · 9.8
cve-2026-55330
A use-after-free vulnerability exists in the Bluetooth CCC handler component of Google Android, which could allow a remote attacker to execute code without any user interaction or additional privileges. This could be relevant where Android is deployed in automotive systems, such as in-vehicle infotainment units or telematics platforms. Confirm applicability through the product SBOM or dependency inventory.
csaf_murrelektronikgmbhcritical · 9.8
vde-2026-108
The aas-edge-client is a Murrelektronik reference implementation of an Asset Administration Shell edge application, and all versions are affected by a missing authentication flaw in its REST API. An unauthenticated remote attacker, or a malicious web page opened by a user on a reachable network, can read and modify the Asset Administration Shell submodel data of the edge device, and modified data is stored locally and forwarded to the configured central AAS server, so downstream systems may receive manipulated device information. No fix will be provided; the vendor advises discontinuing use and removing all deployments, source code copies, and container images.
cvelistv5critical · 9.8
cve-2026-94293
The advisory describes a missing authentication flaw in the Murrelektronik Software AAS Edge Client REST API affecting all versions, which allows an unauthenticated remote attacker to modify Asset Administration Shell submodel data via PATCH requests and read all data exposed by the GET endpoints. This could be relevant where the AAS Edge Client is deployed in automotive systems, since Asset Administration Shell components are used in industrial and manufacturing environments. Confirm applicability through the product SBOM or dependency inventory.
csaf_cisacritical · 9.8
icsa-26-279-02
The advisory describes a buffer overflow in the Savannah lwIP SMTP client because it does not check the size of inputs, and successful exploitation could crash the affected device or potentially allow remote code execution. The advisory does not state an automotive connection, so this could be relevant where lwIP is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
csaf_carlogavazziautomationcritical · 9.8
vde-2026-028
Carlo Gavazzi YL212 and YN115 devices contain multiple security vulnerabilities that let attackers bypass authentication, run code with high privileges, and read sensitive data such as password hashes and private keys. An unauthenticated remote attacker can upload a malicious IODD file that executes a persistent root-level shell script, while other flaws allow command injection, path traversal, and local file inclusion through various endpoints. The advisory states these issues can falsify device integrity and expose sensitive information, and remediation is to install firmware update 1.7.8.
csaf_phoenixcontactgmbhcokgcritical · 9.8
vde-2026-027
Phoenix Contact reports that the firmware in its IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices contains multiple vulnerabilities, including authentication bypass, command injection, local file inclusion, and path traversal. An attacker could bypass authentication, run code with high or root privileges on the device, falsify device integrity, and read sensitive data such as password hashes or private keys. These are industrial I/O devices, so this is relevant to industrial and potentially automotive manufacturing environments where such equipment is deployed; confirm applicability through the product SBOM or dependency inventory.
csaf_pepperlfuchssecritical · 9.8
vde-2026-014
Pepperl+Fuchs ICE2-* and ICE3-* devices contain multiple security vulnerabilities that let attackers bypass authentication, run code with high (root) privileges, and read sensitive data such as password hashes and SSH private keys. Some flaws can be exploited remotely without any credentials, and successful exploitation can falsify device integrity or leave malicious code running even after a reboot. Pepperl+Fuchs rates the impact as serious and directs users to install firmware update 1.7.8, minimize network exposure, isolate the devices from corporate networks, and use VPNs for any required remote access.
csaf_ncscnlcritical · 9.8
ncsc-2026-0370
Apple has released updates for iOS and iPadOS that fix multiple security vulnerabilities in core operating system components and subsystem functions such as file handling, memory management, authentication, and web content processing. An attacker could exploit these flaws to gain unauthorized access to user data, read or corrupt kernel memory, escalate privileges, bypass sandbox restrictions, manipulate network traffic, or cause system and application crashes, and some could leak sensitive information such as Wi-Fi passwords, device identifiers, and user locations. The advisory rates the likelihood of exploitation as medium and the potential damage as high. This could be relevant where Apple iOS or iPadOS devices are deployed in automotive systems, for example as in-vehicle infotainment or companion device platforms. Confirm applicability through the product SBOM or dependency inventory.
nvdcritical · 9.8
cve-2026-54334
UEFI Firmware Parser, a tool for parsing BIOS, Intel ME, and UEFI firmware structures, contains a heap out-of-bounds write in its Tiano decompressor prior to version 1.14. An attacker could use crafted Tiano or EFI compressed firmware to corrupt heap memory, crash the parsing process, and potentially execute code depending on build and runtime details. This could be relevant where this parser is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdcritical · 9.8
cve-2026-54333
UEFI Firmware Parser, a tool that parses BIOS, Intel ME, and UEFI firmware structures, contains a stack out-of-bounds write in its Tiano decompressor prior to version 1.14. An attacker can exploit this by supplying a crafted Tiano or EFI compressed firmware bitstream, which corrupts stack memory, reliably crashes the parsing process, and may allow code execution depending on build and runtime details. This could be relevant where this parser is deployed in automotive firmware analysis or embedded-system tooling; confirm applicability through the product SBOM or dependency inventory.
csaf_ncscnlcritical · 9.8
ncsc-2026-0346
Siemens has released updates addressing multiple vulnerabilities across its product lines, including Desigo, SIMATIC, SCALANCE, SINAMICS, Reyrolle, and Siveillance. The flaws could allow an attacker with access to the production environment to cause denial of service, manipulate data, bypass security measures, execute code with various privilege levels, access sensitive data, or escalate privileges, with an overall medium likelihood of exploitation and high potential damage. These products are used in industrial and building automation, which could include automotive manufacturing environments, so confirm applicability through the product SBOM or dependency inventory.
csaf_siemenscritical · 9.8
ssa-142885
Siemens Reyrolle 7SR5 protection relays before version V2.70 contain multiple vulnerabilities, including issues in the Cesanta Mongoose web server that could allow remote attackers to crash the device or read unintended memory, as well as weak session ID generation that could permit authentication bypass and unauthorized access. Additional flaws could allow low-privileged users to escalate to administrative rights, unauthenticated attackers to cause denial-of-service via crashes and reboots, and attackers with physical access to execute arbitrary code or unsigned firmware. Siemens recommends updating to the latest version to address these risks.