# Recent vulnerabilities from CSAF Siemens
## [ssa-392349](https://vulnerability.circl.lu/vuln/ssa-392349)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multiple industrial devices contain a vulnerability that could allow an attacker to cause a denial of service condition.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-392349: Denial of Service Vulnerability in Industrial Devices - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-392349.html"
},
{
"category": "self",
"summary": "SSA-392349: Denial of Service Vulnerability in Industrial Devices - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-392349.json"
}
],
"title": "SSA-392349: Denial of Service Vulnerability in Industrial Devices",
"tracking": {
"current_release_date": "2026-08-11T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-392349",
"initial_release_date": "2026-05-12T00:00:00.000Z",
"revision_history": [
{
"date": "2026-05-12T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added fix for SCALANCE SC-600 family"
},
{
"date": "2026-08-11T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added fix for IE/PB LINK HA"
}
],
"status": "interim",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.2",
"product": {
"name": "IE/PB LINK HA (6GK1411-5BB00) < V4.1.2",
"product_id": "1",
"product_identification_helper": {
"model_numbers": [
"6GK1411-5BB00"
]
}
}
}
],
"category": "product_name",
"name": "IE/PB LINK HA (6GK1411-5BB00)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "IE/PB link PN IO (6GK1411-5AB10)",
"product_id": "2",
"product_identification_helper": {
"model_numbers": [
"6GK1411-5AB10"
]
}
}
}
],
"category": "product_name",
"name": "IE/PB link PN IO (6GK1411-5AB10)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) < V8.3",
"product_id": "3",
"product_identification_helper": {
"model_numbers": [
"6GK6108-4AM00-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) < V8.3",
"product_id": "4",
"product_identification_helper": {
"model_numbers": [
"6GK6108-4AM00-2DA2"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M804PB (6GK5804-0AP00-2AA2) < V8.3",
"product_id": "5",
"product_identification_helper": {
"model_numbers": [
"6GK5804-0AP00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M804PB (6GK5804-0AP00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) < V8.3",
"product_id": "6",
"product_identification_helper": {
"model_numbers": [
"6GK5812-1AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) < V8.3",
"product_id": "7",
"product_identification_helper": {
"model_numbers": [
"6GK5812-1BA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) < V8.3",
"product_id": "8",
"product_identification_helper": {
"model_numbers": [
"6GK5816-1AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) < V8.3",
"product_id": "9",
"product_identification_helper": {
"model_numbers": [
"6GK5816-1BA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) < V8.3",
"product_id": "10",
"product_identification_helper": {
"model_numbers": [
"6GK5826-2AB00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M874-2 (6GK5874-2AA00-2AA2) < V8.3",
"product_id": "11",
"product_identification_helper": {
"model_numbers": [
"6GK5874-2AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-2 (6GK5874-2AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M874-3 (6GK5874-3AA00-2AA2) < V8.3",
"product_id": "12",
"product_identification_helper": {
"model_numbers": [
"6GK5874-3AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-3 (6GK5874-3AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) < V8.3",
"product_id": "13",
"product_identification_helper": {
"model_numbers": [
"6GK5874-3AA00-2FA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M876-3 (6GK5876-3AA02-2BA2) < V8.3",
"product_id": "14",
"product_identification_helper": {
"model_numbers": [
"6GK5876-3AA02-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-3 (6GK5876-3AA02-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) < V8.3",
"product_id": "15",
"product_identification_helper": {
"model_numbers": [
"6GK5876-3AA02-2EA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M876-4 (6GK5876-4AA10-2BA2) < V8.3",
"product_id": "16",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA10-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (6GK5876-4AA10-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) < V8.3",
"product_id": "17",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA00-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) < V8.3",
"product_id": "18",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA00-2DA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1) < V8.3",
"product_id": "19",
"product_identification_helper": {
"model_numbers": [
"6GK5852-1EA10-1AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1) < V8.3",
"product_id": "20",
"product_identification_helper": {
"model_numbers": [
"6GK5852-1EA10-1BA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) < V8.3",
"product_id": "21",
"product_identification_helper": {
"model_numbers": [
"6GK5853-2EA10-2AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) < V8.3",
"product_id": "22",
"product_identification_helper": {
"model_numbers": [
"6GK5853-2EA10-2BA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) < V8.3",
"product_id": "23",
"product_identification_helper": {
"model_numbers": [
"6GK5853-2EA00-2DA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) < V8.3",
"product_id": "24",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA10-3AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) < V8.3",
"product_id": "25",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA10-3BA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) < V8.3",
"product_id": "26",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3FA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) < V8.3",
"product_id": "27",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3DA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) < V8.3",
"product_id": "28",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) < V8.3",
"product_id": "29",
"product_identification_helper": {
"model_numbers": [
"6GK5615-0AA01-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) < V8.3",
"product_id": "30",
"product_identification_helper": {
"model_numbers": [
"6GK5615-0AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC622-2C (6GK5622-2GS00-2AC2) < V3.2",
"product_id": "31",
"product_identification_helper": {
"model_numbers": [
"6GK5622-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC622-2C (6GK5622-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC626-2C (6GK5626-2GS00-2AC2) < V3.2",
"product_id": "32",
"product_identification_helper": {
"model_numbers": [
"6GK5626-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC626-2C (6GK5626-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC632-2C (6GK5632-2GS00-2AC2) < V3.2",
"product_id": "33",
"product_identification_helper": {
"model_numbers": [
"6GK5632-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC632-2C (6GK5632-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC636-2C (6GK5636-2GS00-2AC2) < V3.2",
"product_id": "34",
"product_identification_helper": {
"model_numbers": [
"6GK5636-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC636-2C (6GK5636-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC642-2C (6GK5642-2GS00-2AC2) < V3.2",
"product_id": "35",
"product_identification_helper": {
"model_numbers": [
"6GK5642-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC642-2C (6GK5642-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC646-2C (6GK5646-2GS00-2AC2) < V3.2",
"product_id": "36",
"product_identification_helper": {
"model_numbers": [
"6GK5646-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC646-2C (6GK5646-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0)",
"product_id": "37",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1GY01-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0)",
"product_id": "38",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1GY01-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0)",
"product_id": "39",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1GY01-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0)",
"product_id": "40",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GY01-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0)",
"product_id": "41",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GY01-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1788-2IA M12 (6GK5788-2HY01-0AA0)",
"product_id": "42",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2HY01-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1788-2IA M12 (6GK5788-2HY01-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) < V6.6.0",
"product_id": "43",
"product_identification_helper": {
"model_numbers": [
"6GK5721-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) < V6.6.0",
"product_id": "44",
"product_identification_helper": {
"model_numbers": [
"6GK5721-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0) < V6.6.0",
"product_id": "45",
"product_identification_helper": {
"model_numbers": [
"6GK5722-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0) < V6.6.0",
"product_id": "46",
"product_identification_helper": {
"model_numbers": [
"6GK5722-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0) < V6.6.0",
"product_id": "47",
"product_identification_helper": {
"model_numbers": [
"6GK5722-1FC00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0) < V6.6.0",
"product_id": "48",
"product_identification_helper": {
"model_numbers": [
"6GK5734-1FX00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6) < V6.6.0",
"product_id": "49",
"product_identification_helper": {
"model_numbers": [
"6GK5734-1FX00-0AA6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0) < V6.6.0",
"product_id": "50",
"product_identification_helper": {
"model_numbers": [
"6GK5734-1FX00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6) < V6.6.0",
"product_id": "51",
"product_identification_helper": {
"model_numbers": [
"6GK5734-1FX00-0AB6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0) < V6.6.0",
"product_id": "52",
"product_identification_helper": {
"model_numbers": [
"6GK5738-1GY00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0) < V6.6.0",
"product_id": "53",
"product_identification_helper": {
"model_numbers": [
"6GK5738-1GY00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0) < V6.6.0",
"product_id": "54",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1GD00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0) < V6.6.0",
"product_id": "55",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1GD00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0) < V6.6.0",
"product_id": "56",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0) < V6.6.0",
"product_id": "57",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0) < V6.6.0",
"product_id": "58",
"product_identification_helper": {
"model_numbers": [
"6GK5761-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0) < V6.6.0",
"product_id": "59",
"product_identification_helper": {
"model_numbers": [
"6GK5761-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0) < V6.6.0",
"product_id": "60",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FY00-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0) < V6.6.0",
"product_id": "61",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FY00-0TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0) < V6.6.0",
"product_id": "62",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6) < V6.6.0",
"product_id": "63",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AA6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0) < V6.6.0",
"product_id": "64",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0) < V6.6.0",
"product_id": "65",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6) < V6.6.0",
"product_id": "66",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AB6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0) < V6.6.0",
"product_id": "67",
"product_identification_helper": {
"model_numbers": [
"6GK5778-1GY00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0) < V6.6.0",
"product_id": "68",
"product_identification_helper": {
"model_numbers": [
"6GK5778-1GY00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0) < V6.6.0",
"product_id": "69",
"product_identification_helper": {
"model_numbers": [
"6GK5778-1GY00-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0) < V6.6.0",
"product_id": "70",
"product_identification_helper": {
"model_numbers": [
"6GK5778-1GY00-0TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0) < V6.6.0",
"product_id": "71",
"product_identification_helper": {
"model_numbers": [
"6GK5786-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AB0) < V6.6.0",
"product_id": "72",
"product_identification_helper": {
"model_numbers": [
"6GK5786-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AA0) < V6.6.0",
"product_id": "73",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AB0) < V6.6.0",
"product_id": "74",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AC0) < V6.6.0",
"product_id": "75",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FC00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 SFP (6GK5786-2FE00-0AA0) < V6.6.0",
"product_id": "76",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FE00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 SFP (6GK5786-2FE00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 SFP (6GK5786-2FE00-0AB0) < V6.6.0",
"product_id": "77",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FE00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 SFP (6GK5786-2FE00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AA0) < V6.6.0",
"product_id": "78",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2HC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AB0) < V6.6.0",
"product_id": "79",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2HC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-1 M12 (6GK5788-1GD00-0AA0) < V6.6.0",
"product_id": "80",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1GD00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-1 M12 (6GK5788-1GD00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-1 M12 (6GK5788-1GD00-0AB0) < V6.6.0",
"product_id": "81",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1GD00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-1 M12 (6GK5788-1GD00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AA0) < V6.6.0",
"product_id": "82",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AB0) < V6.6.0",
"product_id": "83",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 (6GK5788-2GD00-0AA0) < V6.6.0",
"product_id": "84",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 (6GK5788-2GD00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 (6GK5788-2GD00-0AB0) < V6.6.0",
"product_id": "85",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 (6GK5788-2GD00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TA0) < V6.6.0",
"product_id": "86",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TB0) < V6.6.0",
"product_id": "87",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TC0) < V6.6.0",
"product_id": "88",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0TC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AA0) < V6.6.0",
"product_id": "89",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AB0) < V6.6.0",
"product_id": "90",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AC0) < V6.6.0",
"product_id": "91",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2FC00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) < V3.2.0",
"product_id": "92",
"product_identification_helper": {
"model_numbers": [
"6GK5762-1AJ00-6AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) < V3.2.0",
"product_id": "93",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-7DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) < V3.2.0",
"product_id": "94",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-7DC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) < V3.2.0",
"product_id": "95",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-7DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) < V3.2.0",
"product_id": "96",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (6GK5766-1GE00-7DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) < V3.2.0",
"product_id": "97",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) < V3.2.0",
"product_id": "98",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) < V3.2.0",
"product_id": "99",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) < V3.2.0",
"product_id": "100",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) < V3.2.0",
"product_id": "101",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) < V3.2.0",
"product_id": "102",
"product_identification_helper": {
"model_numbers": [
"6GK5762-1AJ00-1AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) < V3.2.0",
"product_id": "103",
"product_identification_helper": {
"model_numbers": [
"6GK5762-1AJ00-2AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) < V3.2.0",
"product_id": "104",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) < V3.2.0",
"product_id": "105",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) < V3.2.0",
"product_id": "106",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) < V3.2.0",
"product_id": "107",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) < V3.2.0",
"product_id": "108",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (6GK5766-1GE00-3DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) < V3.2.0",
"product_id": "109",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2.0",
"product": {
"name": "SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) < V3.2.0",
"product_id": "110",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X204-2 (6GK5204-2BB10-2AA3)",
"product_id": "111",
"product_identification_helper": {
"model_numbers": [
"6GK5204-2BB10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X204-2 (6GK5204-2BB10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X204-2FM (6GK5204-2BB11-2AA3)",
"product_id": "112",
"product_identification_helper": {
"model_numbers": [
"6GK5204-2BB11-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X204-2FM (6GK5204-2BB11-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X204-2LD (6GK5204-2BC10-2AA3)",
"product_id": "113",
"product_identification_helper": {
"model_numbers": [
"6GK5204-2BC10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X204-2LD (6GK5204-2BC10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X204-2LD TS (6GK5204-2BC10-2CA2)",
"product_id": "114",
"product_identification_helper": {
"model_numbers": [
"6GK5204-2BC10-2CA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X204-2LD TS (6GK5204-2BC10-2CA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X204-2TS (6GK5204-2BB10-2CA2)",
"product_id": "115",
"product_identification_helper": {
"model_numbers": [
"6GK5204-2BB10-2CA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X204-2TS (6GK5204-2BB10-2CA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X206-1 (6GK5206-1BB10-2AA3)",
"product_id": "116",
"product_identification_helper": {
"model_numbers": [
"6GK5206-1BB10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X206-1 (6GK5206-1BB10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X206-1LD (6GK5206-1BC10-2AA3)",
"product_id": "117",
"product_identification_helper": {
"model_numbers": [
"6GK5206-1BC10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X206-1LD (6GK5206-1BC10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X208 (6GK5208-0BA10-2AA3)",
"product_id": "118",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0BA10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X208 (6GK5208-0BA10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X208PRO (6GK5208-0HA10-2AA6)",
"product_id": "119",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0HA10-2AA6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X208PRO (6GK5208-0HA10-2AA6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X212-2 (6GK5212-2BB00-2AA3)",
"product_id": "120",
"product_identification_helper": {
"model_numbers": [
"6GK5212-2BB00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X212-2 (6GK5212-2BB00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X212-2LD (6GK5212-2BC00-2AA3)",
"product_id": "121",
"product_identification_helper": {
"model_numbers": [
"6GK5212-2BC00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X212-2LD (6GK5212-2BC00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X216 (6GK5216-0BA00-2AA3)",
"product_id": "122",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0BA00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X216 (6GK5216-0BA00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X224 (6GK5224-0BA00-2AA3)",
"product_id": "123",
"product_identification_helper": {
"model_numbers": [
"6GK5224-0BA00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X224 (6GK5224-0BA00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X302-7 EEC (230V, coated) (6GK5302-7GD00-3GA3)",
"product_id": "124",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-3GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (230V, coated) (6GK5302-7GD00-3GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X302-7 EEC (230V) (6GK5302-7GD00-3EA3)",
"product_id": "125",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-3EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (230V) (6GK5302-7GD00-3EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X302-7 EEC (24V, coated) (6GK5302-7GD00-1GA3)",
"product_id": "126",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-1GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (24V, coated) (6GK5302-7GD00-1GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X302-7 EEC (24V) (6GK5302-7GD00-1EA3)",
"product_id": "127",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-1EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (24V) (6GK5302-7GD00-1EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X302-7 EEC (2x 230V, coated) (6GK5302-7GD00-4GA3)",
"product_id": "128",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-4GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (2x 230V, coated) (6GK5302-7GD00-4GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X302-7 EEC (2x 230V) (6GK5302-7GD00-4EA3)",
"product_id": "129",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-4EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (2x 230V) (6GK5302-7GD00-4EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X302-7 EEC (2x 24V, coated) (6GK5302-7GD00-2GA3)",
"product_id": "130",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-2GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (2x 24V, coated) (6GK5302-7GD00-2GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X302-7 EEC (2x 24V) (6GK5302-7GD00-2EA3)",
"product_id": "131",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-2EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (2x 24V) (6GK5302-7GD00-2EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X304-2FE (6GK5304-2BD00-2AA3)",
"product_id": "132",
"product_identification_helper": {
"model_numbers": [
"6GK5304-2BD00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X304-2FE (6GK5304-2BD00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X306-1LD FE (6GK5306-1BF00-2AA3)",
"product_id": "133",
"product_identification_helper": {
"model_numbers": [
"6GK5306-1BF00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X306-1LD FE (6GK5306-1BF00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-2 EEC (230V, coated) (6GK5307-2FD00-3GA3)",
"product_id": "134",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-3GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (230V, coated) (6GK5307-2FD00-3GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-2 EEC (230V) (6GK5307-2FD00-3EA3)",
"product_id": "135",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-3EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (230V) (6GK5307-2FD00-3EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-2 EEC (24V, coated) (6GK5307-2FD00-1GA3)",
"product_id": "136",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-1GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (24V, coated) (6GK5307-2FD00-1GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-2 EEC (24V) (6GK5307-2FD00-1EA3)",
"product_id": "137",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-1EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (24V) (6GK5307-2FD00-1EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-2 EEC (2x 230V, coated) (6GK5307-2FD00-4GA3)",
"product_id": "138",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-4GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (2x 230V, coated) (6GK5307-2FD00-4GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-2 EEC (2x 230V) (6GK5307-2FD00-4EA3)",
"product_id": "139",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-4EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (2x 230V) (6GK5307-2FD00-4EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-2 EEC (2x 24V, coated) (6GK5307-2FD00-2GA3)",
"product_id": "140",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-2GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (2x 24V, coated) (6GK5307-2FD00-2GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-2 EEC (2x 24V) (6GK5307-2FD00-2EA3)",
"product_id": "141",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-2EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (2x 24V) (6GK5307-2FD00-2EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-3 (6GK5307-3BL00-2AA3)",
"product_id": "142",
"product_identification_helper": {
"model_numbers": [
"6GK5307-3BL00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-3 (6GK5307-3BL00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-3 (6GK5307-3BL10-2AA3)",
"product_id": "143",
"product_identification_helper": {
"model_numbers": [
"6GK5307-3BL10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-3 (6GK5307-3BL10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-3LD (6GK5307-3BM00-2AA3)",
"product_id": "144",
"product_identification_helper": {
"model_numbers": [
"6GK5307-3BM00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-3LD (6GK5307-3BM00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X307-3LD (6GK5307-3BM10-2AA3)",
"product_id": "145",
"product_identification_helper": {
"model_numbers": [
"6GK5307-3BM10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-3LD (6GK5307-3BM10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2 (6GK5308-2FL00-2AA3)",
"product_id": "146",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FL00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2 (6GK5308-2FL00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2 RD (inkl. SIPLUS variants)",
"product_id": "147"
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2 RD (inkl. SIPLUS variants)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2LD (6GK5308-2FM00-2AA3)",
"product_id": "148",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FM00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LD (6GK5308-2FM00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2LD (6GK5308-2FM10-2AA3)",
"product_id": "149",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FM10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LD (6GK5308-2FM10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2LH (6GK5308-2FN00-2AA3)",
"product_id": "150",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FN00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LH (6GK5308-2FN00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2LH (6GK5308-2FN10-2AA3)",
"product_id": "151",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FN10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LH (6GK5308-2FN10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2LH+ (6GK5308-2FP00-2AA3)",
"product_id": "152",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FP00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LH+ (6GK5308-2FP00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2LH+ (6GK5308-2FP10-2AA3)",
"product_id": "153",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FP10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LH+ (6GK5308-2FP10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2M (6GK5308-2GG00-2AA2)",
"product_id": "154",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2GG00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M (6GK5308-2GG00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2M (6GK5308-2GG10-2AA2)",
"product_id": "155",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2GG10-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M (6GK5308-2GG10-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2M PoE (6GK5308-2QG00-2AA2)",
"product_id": "156",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2QG00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M PoE (6GK5308-2QG00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2M PoE (6GK5308-2QG10-2AA2)",
"product_id": "157",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2QG10-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M PoE (6GK5308-2QG10-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2M TS (6GK5308-2GG00-2CA2)",
"product_id": "158",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2GG00-2CA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M TS (6GK5308-2GG00-2CA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X308-2M TS (6GK5308-2GG10-2CA2)",
"product_id": "159",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2GG10-2CA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M TS (6GK5308-2GG10-2CA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X310 (6GK5310-0FA00-2AA3)",
"product_id": "160",
"product_identification_helper": {
"model_numbers": [
"6GK5310-0FA00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X310 (6GK5310-0FA00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X310 (6GK5310-0FA10-2AA3)",
"product_id": "161",
"product_identification_helper": {
"model_numbers": [
"6GK5310-0FA10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X310 (6GK5310-0FA10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X310FE (6GK5310-0BA00-2AA3)",
"product_id": "162",
"product_identification_helper": {
"model_numbers": [
"6GK5310-0BA00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X310FE (6GK5310-0BA00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X310FE (6GK5310-0BA10-2AA3)",
"product_id": "163",
"product_identification_helper": {
"model_numbers": [
"6GK5310-0BA10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X310FE (6GK5310-0BA10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X320-1 FE (6GK5320-1BD00-2AA3)",
"product_id": "164",
"product_identification_helper": {
"model_numbers": [
"6GK5320-1BD00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X320-1 FE (6GK5320-1BD00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X320-1-2LD FE (6GK5320-3BF00-2AA3)",
"product_id": "165",
"product_identification_helper": {
"model_numbers": [
"6GK5320-3BF00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X320-1-2LD FE (6GK5320-3BF00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE X408-2 (6GK5408-2FD00-2AA2)",
"product_id": "166",
"product_identification_helper": {
"model_numbers": [
"6GK5408-2FD00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X408-2 (6GK5408-2FD00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XF204 (6GK5204-0BA00-2AF2)",
"product_id": "167",
"product_identification_helper": {
"model_numbers": [
"6GK5204-0BA00-2AF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF204 (6GK5204-0BA00-2AF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XF204-2 (6GK5204-2BC00-2AF2)",
"product_id": "168",
"product_identification_helper": {
"model_numbers": [
"6GK5204-2BC00-2AF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF204-2 (6GK5204-2BC00-2AF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XF206-1 (6GK5206-1BC00-2AF2)",
"product_id": "169",
"product_identification_helper": {
"model_numbers": [
"6GK5206-1BC00-2AF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF206-1 (6GK5206-1BC00-2AF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XF208 (6GK5208-0BA00-2AF2)",
"product_id": "170",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0BA00-2AF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF208 (6GK5208-0BA00-2AF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM408-4C (6GK5408-4GP00-2AM2)",
"product_id": "171",
"product_identification_helper": {
"model_numbers": [
"6GK5408-4GP00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM408-4C (6GK5408-4GP00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2)",
"product_id": "172",
"product_identification_helper": {
"model_numbers": [
"6GK5408-4GQ00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM408-8C (6GK5408-8GS00-2AM2)",
"product_id": "173",
"product_identification_helper": {
"model_numbers": [
"6GK5408-8GS00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM408-8C (6GK5408-8GS00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2)",
"product_id": "174",
"product_identification_helper": {
"model_numbers": [
"6GK5408-8GR00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM416-4C (6GK5416-4GS00-2AM2)",
"product_id": "175",
"product_identification_helper": {
"model_numbers": [
"6GK5416-4GS00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM416-4C (6GK5416-4GS00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2)",
"product_id": "176",
"product_identification_helper": {
"model_numbers": [
"6GK5416-4GR00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M (230V, ports on front) (6GK5324-0GG00-3AR2)",
"product_id": "177",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (230V, ports on front) (6GK5324-0GG00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M (230V, ports on front) (6GK5324-0GG10-3AR2)",
"product_id": "178",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (230V, ports on front) (6GK5324-0GG10-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M (230V, ports on rear) (6GK5324-0GG00-3HR2)",
"product_id": "179",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-3HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (230V, ports on rear) (6GK5324-0GG00-3HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M (230V, ports on rear) (6GK5324-0GG10-3HR2)",
"product_id": "180",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-3HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (230V, ports on rear) (6GK5324-0GG10-3HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M (24V, ports on front) (6GK5324-0GG00-1AR2)",
"product_id": "181",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-1AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (24V, ports on front) (6GK5324-0GG00-1AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M (24V, ports on front) (6GK5324-0GG10-1AR2)",
"product_id": "182",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-1AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (24V, ports on front) (6GK5324-0GG10-1AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M (24V, ports on rear) (6GK5324-0GG00-1HR2)",
"product_id": "183",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-1HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (24V, ports on rear) (6GK5324-0GG00-1HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M (24V, ports on rear) (6GK5324-0GG10-1HR2)",
"product_id": "184",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-1HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (24V, ports on rear) (6GK5324-0GG10-1HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M TS (24V) (6GK5324-0GG00-1CR2)",
"product_id": "185",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-1CR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M TS (24V) (6GK5324-0GG00-1CR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-12M TS (24V) (6GK5324-0GG10-1CR2)",
"product_id": "186",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-1CR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M TS (24V) (6GK5324-0GG10-1CR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front) (6GK5324-4GG00-3ER2)",
"product_id": "187",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-3ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front) (6GK5324-4GG00-3ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front) (6GK5324-4GG10-3ER2)",
"product_id": "188",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-3ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front) (6GK5324-4GG10-3ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG00-3JR2)",
"product_id": "189",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-3JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG00-3JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG10-3JR2)",
"product_id": "190",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-3JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG10-3JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (24V, ports on front) (6GK5324-4GG00-1ER2)",
"product_id": "191",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-1ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (24V, ports on front) (6GK5324-4GG00-1ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (24V, ports on front) (6GK5324-4GG10-1ER2)",
"product_id": "192",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-1ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (24V, ports on front) (6GK5324-4GG10-1ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (24V, ports on rear) (6GK5324-4GG00-1JR2)",
"product_id": "193",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-1JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (24V, ports on rear) (6GK5324-4GG00-1JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (24V, ports on rear) (6GK5324-4GG10-1JR2)",
"product_id": "194",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-1JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (24V, ports on rear) (6GK5324-4GG10-1JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front) (6GK5324-4GG00-4ER2)",
"product_id": "195",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-4ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front) (6GK5324-4GG00-4ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front) (6GK5324-4GG10-4ER2)",
"product_id": "196",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-4ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front) (6GK5324-4GG10-4ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG00-4JR2)",
"product_id": "197",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-4JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG00-4JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG10-4JR2)",
"product_id": "198",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-4JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG10-4JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on front) (6GK5324-4GG00-2ER2)",
"product_id": "199",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-2ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on front) (6GK5324-4GG00-2ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on front) (6GK5324-4GG10-2ER2)",
"product_id": "200",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-2ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on front) (6GK5324-4GG10-2ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on rear) (6GK5324-4GG00-2JR2)",
"product_id": "201",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-2JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on rear) (6GK5324-4GG00-2JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on rear) (6GK5324-4GG10-2JR2)",
"product_id": "202",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-2JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on rear) (6GK5324-4GG10-2JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE (230V, ports on front) (6GK5324-4QG00-3AR2)",
"product_id": "203",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (230V, ports on front) (6GK5324-4QG00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE (230V, ports on front) (6GK5324-4QG10-3AR2)",
"product_id": "204",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (230V, ports on front) (6GK5324-4QG10-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE (230V, ports on rear) (6GK5324-4QG00-3HR2)",
"product_id": "205",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-3HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (230V, ports on rear) (6GK5324-4QG00-3HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE (230V, ports on rear) (6GK5324-4QG10-3HR2)",
"product_id": "206",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-3HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (230V, ports on rear) (6GK5324-4QG10-3HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE (24V, ports on front) (6GK5324-4QG00-1AR2)",
"product_id": "207",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-1AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (24V, ports on front) (6GK5324-4QG00-1AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE (24V, ports on front) (6GK5324-4QG10-1AR2)",
"product_id": "208",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-1AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (24V, ports on front) (6GK5324-4QG10-1AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE (24V, ports on rear) (6GK5324-4QG00-1HR2)",
"product_id": "209",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-1HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (24V, ports on rear) (6GK5324-4QG00-1HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE (24V, ports on rear) (6GK5324-4QG10-1HR2)",
"product_id": "210",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-1HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (24V, ports on rear) (6GK5324-4QG10-1HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE TS (24V, ports on front) (6GK5324-4QG00-1CR2)",
"product_id": "211",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-1CR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE TS (24V, ports on front) (6GK5324-4QG00-1CR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR324-4M PoE TS (24V, ports on front) (6GK5324-4QG10-1CR2)",
"product_id": "212",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-1CR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE TS (24V, ports on front) (6GK5324-4QG10-1CR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2)",
"product_id": "213",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GS00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2)",
"product_id": "214",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GR00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2)",
"product_id": "215",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GS00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2)",
"product_id": "216",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GR00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2)",
"product_id": "217",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GS00-4AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2)",
"product_id": "218",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GR00-4AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2)",
"product_id": "219",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GS00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2)",
"product_id": "220",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GR00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2)",
"product_id": "221",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GS00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2)",
"product_id": "222",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GR00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2)",
"product_id": "223",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GS00-4AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2)",
"product_id": "224",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GR00-4AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR528-6M (6GK5528-0AA00-2AR2)",
"product_id": "225",
"product_identification_helper": {
"model_numbers": [
"6GK5528-0AA00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR528-6M (6GK5528-0AA00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2)",
"product_id": "226",
"product_identification_helper": {
"model_numbers": [
"6GK5528-0AR00-2HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2)",
"product_id": "227",
"product_identification_helper": {
"model_numbers": [
"6GK5528-0AA00-2HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2)",
"product_id": "228",
"product_identification_helper": {
"model_numbers": [
"6GK5528-0AR00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR552-12M (6GK5552-0AA00-2AR2)",
"product_id": "229",
"product_identification_helper": {
"model_numbers": [
"6GK5552-0AA00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR552-12M (6GK5552-0AA00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2)",
"product_id": "230",
"product_identification_helper": {
"model_numbers": [
"6GK5552-0AR00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2)",
"product_id": "231",
"product_identification_helper": {
"model_numbers": [
"6GK5552-0AA00-2HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2)",
"product_id": "232",
"product_identification_helper": {
"model_numbers": [
"6GK5552-0AR00-2HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.0.0",
"product": {
"name": "SIMATIC CFU DIQ (6ES7655-5PX31-1XX0) < V2.0.0",
"product_id": "233",
"product_identification_helper": {
"model_numbers": [
"6ES7655-5PX31-1XX0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC CFU DIQ (6ES7655-5PX31-1XX0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.0.0",
"product": {
"name": "SIMATIC CFU PA (6ES7655-5PX11-0XX0) < V2.0.0",
"product_id": "234",
"product_identification_helper": {
"model_numbers": [
"6ES7655-5PX11-0XX0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC CFU PA (6ES7655-5PX11-0XX0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.0.0",
"product": {
"name": "SIMATIC CFU PA (6ES7655-5PX11-1XX0) < V2.0.0",
"product_id": "235",
"product_identification_helper": {
"model_numbers": [
"6ES7655-5PX11-1XX0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC CFU PA (6ES7655-5PX11-1XX0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0)",
"product_id": "236",
"product_identification_helper": {
"model_numbers": [
"6ES7154-8AB01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0)",
"product_id": "237",
"product_identification_helper": {
"model_numbers": [
"6ES7154-8FB01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0)",
"product_id": "238",
"product_identification_helper": {
"model_numbers": [
"6ES7154-8FX00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0)",
"product_id": "239",
"product_identification_helper": {
"model_numbers": [
"6ES7151-8AB01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0)",
"product_id": "240",
"product_identification_helper": {
"model_numbers": [
"6ES7151-8FB01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)",
"product_id": "241",
"product_identification_helper": {
"model_numbers": [
"6ES7510-1SJ00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)",
"product_id": "242",
"product_identification_helper": {
"model_numbers": [
"6ES7510-1DJ00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0)",
"product_id": "243",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1SK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK00-0AB0)",
"product_id": "244",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1DK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SIMATIC ET 200SP HA IM155-6 PN < V1.3",
"product_id": "245"
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP HA IM155-6 PN"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)",
"product_id": "246",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1AK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)",
"product_id": "247",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1FK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0)",
"product_id": "248",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1AL00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0)",
"product_id": "249",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2AM00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0)",
"product_id": "250",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2FM00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0)",
"product_id": "251",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3AN00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0)",
"product_id": "252",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3FN00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0)",
"product_id": "253",
"product_identification_helper": {
"model_numbers": [
"6ES7314-6EH04-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0)",
"product_id": "254",
"product_identification_helper": {
"model_numbers": [
"6ES7315-2EH14-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0)",
"product_id": "255",
"product_identification_helper": {
"model_numbers": [
"6ES7315-2FJ14-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0)",
"product_id": "256",
"product_identification_helper": {
"model_numbers": [
"6ES7315-7TJ10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0)",
"product_id": "257",
"product_identification_helper": {
"model_numbers": [
"6ES7317-2EK14-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0)",
"product_id": "258",
"product_identification_helper": {
"model_numbers": [
"6ES7317-2FK14-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0)",
"product_id": "259",
"product_identification_helper": {
"model_numbers": [
"6ES7317-7TK10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0)",
"product_id": "260",
"product_identification_helper": {
"model_numbers": [
"6ES7317-7UL10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0)",
"product_id": "261",
"product_identification_helper": {
"model_numbers": [
"6ES7318-3EL01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0)",
"product_id": "262",
"product_identification_helper": {
"model_numbers": [
"6ES7318-3FL01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-400 CPU 412-2 PN V7 (6ES7412-2EK07-0AB0)",
"product_id": "263",
"product_identification_helper": {
"model_numbers": [
"6ES7412-2EK07-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-400 CPU 412-2 PN V7 (6ES7412-2EK07-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-400 CPU 414-3 PN/DP V7 (6ES7414-3EM07-0AB0)",
"product_id": "264",
"product_identification_helper": {
"model_numbers": [
"6ES7414-3EM07-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-400 CPU 414-3 PN/DP V7 (6ES7414-3EM07-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-400 CPU 414F-3 PN/DP V7 (6ES7414-3FM07-0AB0)",
"product_id": "265",
"product_identification_helper": {
"model_numbers": [
"6ES7414-3FM07-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-400 CPU 414F-3 PN/DP V7 (6ES7414-3FM07-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-400 CPU 416-3 PN/DP V7 (6ES7416-3ES07-0AB0)",
"product_id": "266",
"product_identification_helper": {
"model_numbers": [
"6ES7416-3ES07-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-400 CPU 416-3 PN/DP V7 (6ES7416-3ES07-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-400 CPU 416F-3 PN/DP V7 (6ES7416-3FS07-0AB0)",
"product_id": "267",
"product_identification_helper": {
"model_numbers": [
"6ES7416-3FS07-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-400 CPU 416F-3 PN/DP V7 (6ES7416-3FS07-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)",
"product_id": "268"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.2",
"product": {
"name": "SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) < V10.2",
"product_id": "269"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.3",
"product": {
"name": "SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) < V8.3",
"product_id": "270"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMIT UNIT V10",
"product_id": "271"
}
}
],
"category": "product_name",
"name": "SIMIT UNIT V10"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMIT UNIT V11",
"product_id": "272"
}
}
],
"category": "product_name",
"name": "SIMIT UNIT V11"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS CBE20",
"product_id": "273"
}
}
],
"category": "product_name",
"name": "SINAMICS CBE20"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS G115D",
"product_id": "274"
}
}
],
"category": "product_name",
"name": "SINAMICS G115D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS G120 (incl. SIPLUS variants)",
"product_id": "275"
}
}
],
"category": "product_name",
"name": "SINAMICS G120 (incl. SIPLUS variants)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS G120C",
"product_id": "276"
}
}
],
"category": "product_name",
"name": "SINAMICS G120C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS G120D",
"product_id": "277"
}
}
],
"category": "product_name",
"name": "SINAMICS G120D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS G120X",
"product_id": "278"
}
}
],
"category": "product_name",
"name": "SINAMICS G120X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS G120XA",
"product_id": "279"
}
}
],
"category": "product_name",
"name": "SINAMICS G120XA"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS G130",
"product_id": "280"
}
}
],
"category": "product_name",
"name": "SINAMICS G130"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS G150",
"product_id": "281"
}
}
],
"category": "product_name",
"name": "SINAMICS G150"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS S110",
"product_id": "282"
}
}
],
"category": "product_name",
"name": "SINAMICS S110"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS S120 (incl. SIPLUS variants)",
"product_id": "283"
}
}
],
"category": "product_name",
"name": "SINAMICS S120 (incl. SIPLUS variants)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS S150",
"product_id": "284"
}
}
],
"category": "product_name",
"name": "SINAMICS S150"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINUMERIK 840D sl",
"product_id": "285"
}
}
],
"category": "product_name",
"name": "SINUMERIK 840D sl"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS ET 200S IM 151-8 PN/DP CPU (6AG1151-8AB01-7AB0)",
"product_id": "286",
"product_identification_helper": {
"model_numbers": [
"6AG1151-8AB01-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200S IM 151-8 PN/DP CPU (6AG1151-8AB01-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS ET 200S IM 151-8F PN/DP CPU (6AG1151-8FB01-2AB0)",
"product_id": "287",
"product_identification_helper": {
"model_numbers": [
"6AG1151-8FB01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200S IM 151-8F PN/DP CPU (6AG1151-8FB01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS NET IE/PB link PN IO (6AG1411-5AB10-2AA0)",
"product_id": "288",
"product_identification_helper": {
"model_numbers": [
"6AG1411-5AB10-2AA0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS NET IE/PB link PN IO (6AG1411-5AB10-2AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-300 CPU 314C-2 PN/DP (6AG1314-6EH04-7AB0)",
"product_id": "289",
"product_identification_helper": {
"model_numbers": [
"6AG1314-6EH04-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-300 CPU 314C-2 PN/DP (6AG1314-6EH04-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-300 CPU 315-2 PN/DP (6AG1315-2EH14-7AB0)",
"product_id": "290",
"product_identification_helper": {
"model_numbers": [
"6AG1315-2EH14-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-300 CPU 315-2 PN/DP (6AG1315-2EH14-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-300 CPU 315F-2 PN/DP (6AG1315-2FJ14-2AB0)",
"product_id": "291",
"product_identification_helper": {
"model_numbers": [
"6AG1315-2FJ14-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-300 CPU 315F-2 PN/DP (6AG1315-2FJ14-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-300 CPU 317-2 PN/DP (6AG1317-2EK14-7AB0)",
"product_id": "292",
"product_identification_helper": {
"model_numbers": [
"6AG1317-2EK14-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-300 CPU 317-2 PN/DP (6AG1317-2EK14-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-300 CPU 317F-2 PN/DP (6AG1317-2FK14-2AB0)",
"product_id": "293",
"product_identification_helper": {
"model_numbers": [
"6AG1317-2FK14-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-300 CPU 317F-2 PN/DP (6AG1317-2FK14-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-400 CPU 414-3 PN/DP V7 (6AG1414-3EM07-7AB0)",
"product_id": "294",
"product_identification_helper": {
"model_numbers": [
"6AG1414-3EM07-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-400 CPU 414-3 PN/DP V7 (6AG1414-3EM07-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-400 CPU 416-3 PN/DP V7 (6AG1416-3ES07-7AB0)",
"product_id": "295",
"product_identification_helper": {
"model_numbers": [
"6AG1416-3ES07-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-400 CPU 416-3 PN/DP V7 (6AG1416-3ES07-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP PSU8600 1AC 20 A/4x5 A PN (6EP3336-8MB00-2CY0)",
"product_id": "296",
"product_identification_helper": {
"model_numbers": [
"6EP3336-8MB00-2CY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP PSU8600 1AC 20 A/4x5 A PN (6EP3336-8MB00-2CY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP PSU8600 3AC 20 A PN (6EP3436-8SB00-2AY0)",
"product_id": "297",
"product_identification_helper": {
"model_numbers": [
"6EP3436-8SB00-2AY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP PSU8600 3AC 20 A PN (6EP3436-8SB00-2AY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP PSU8600 3AC 20 A/4x5 A PN (6EP3436-8MB00-2CY0)",
"product_id": "298",
"product_identification_helper": {
"model_numbers": [
"6EP3436-8MB00-2CY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP PSU8600 3AC 20 A/4x5 A PN (6EP3436-8MB00-2CY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP PSU8600 3AC 40 A PN (6EP3437-8SB00-2AY0)",
"product_id": "299",
"product_identification_helper": {
"model_numbers": [
"6EP3437-8SB00-2AY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP PSU8600 3AC 40 A PN (6EP3437-8SB00-2AY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP PSU8600 3AC 40 A/4x10 A PN (6EP3437-8MB00-2CY0)",
"product_id": "300",
"product_identification_helper": {
"model_numbers": [
"6EP3437-8MB00-2CY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP PSU8600 3AC 40 A/4x10 A PN (6EP3437-8MB00-2CY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP PSU8600 3AC 40 A/4x10A EIP (6EP3437-8MB10-2CY0)",
"product_id": "301",
"product_identification_helper": {
"model_numbers": [
"6EP3437-8MB10-2CY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP PSU8600 3AC 40 A/4x10A EIP (6EP3437-8MB10-2CY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP UPS1600 10 A Ethernet/ PROFINET (6EP4134-3AB00-2AY0)",
"product_id": "302",
"product_identification_helper": {
"model_numbers": [
"6EP4134-3AB00-2AY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP UPS1600 10 A Ethernet/ PROFINET (6EP4134-3AB00-2AY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP UPS1600 20 A Ethernet/ PROFINET (6EP4136-3AB00-2AY0)",
"product_id": "303",
"product_identification_helper": {
"model_numbers": [
"6EP4136-3AB00-2AY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP UPS1600 20 A Ethernet/ PROFINET (6EP4136-3AB00-2AY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP UPS1600 40 A Ethernet/ PROFINET (6EP4137-3AB00-2AY0)",
"product_id": "304",
"product_identification_helper": {
"model_numbers": [
"6EP4137-3AB00-2AY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP UPS1600 40 A Ethernet/ PROFINET (6EP4137-3AB00-2AY0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SITOP UPS1600 EX 20 A Ethernet PROFINET (6EP4136-3AC00-2AY0)",
"product_id": "305",
"product_identification_helper": {
"model_numbers": [
"6EP4136-3AC00-2AY0"
]
}
}
}
],
"category": "product_name",
"name": "SITOP UPS1600 EX 20 A Ethernet PROFINET (6EP4136-3AC00-2AY0)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-40833",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual restart is required to recover the system.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175",
"176",
"177",
"178",
"179",
"180",
"181",
"182",
"183",
"184",
"185",
"186",
"187",
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"233",
"234",
"235",
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"245",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"271",
"272",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"282",
"283",
"284",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295",
"296",
"297",
"298",
"299",
"300",
"301",
"302",
"303",
"304",
"305"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a mitigation, disable the ethernet ports on the CPU and use a communication module (like CP) for communication instead",
"product_ids": [
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"286",
"287",
"289",
"290",
"291",
"292",
"293",
"294",
"295"
]
},
{
"category": "mitigation",
"details": "Restrict access to the affected systems to trusted IP addresses only",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175",
"176",
"177",
"178",
"179",
"180",
"181",
"182",
"183",
"184",
"185",
"186",
"187",
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"233",
"234",
"235",
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"245",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"271",
"272",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"282",
"283",
"284",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295",
"296",
"297",
"298",
"299",
"300",
"301",
"302",
"303",
"304",
"305"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"2",
"37",
"38",
"39",
"40",
"41",
"42",
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"271",
"272",
"282",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175",
"176",
"177",
"178",
"179",
"180",
"181",
"182",
"183",
"184",
"185",
"186",
"187",
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"283",
"284",
"296",
"297",
"298",
"299",
"300",
"301",
"302",
"303",
"304",
"305"
]
},
{
"category": "vendor_fix",
"details": "Update to V10.2 or later version",
"product_ids": [
"269"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109773044/"
},
{
"category": "vendor_fix",
"details": "Update to V2.0.0 or later version",
"product_ids": [
"233",
"234",
"235"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109781049/"
},
{
"category": "vendor_fix",
"details": "Update to V3.2 or later version",
"product_ids": [
"31",
"32",
"33",
"34",
"35",
"36"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110001886/"
},
{
"category": "vendor_fix",
"details": "Update to V3.2.0 or later version",
"product_ids": [
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109992747/"
},
{
"category": "vendor_fix",
"details": "Update to V4.1.2 or later version",
"product_ids": [
"1"
]
},
{
"category": "vendor_fix",
"details": "Update to V6.6.0 or later version",
"product_ids": [
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109996102/"
},
{
"category": "vendor_fix",
"details": "Update to V8.3 or later version",
"product_ids": [
"270"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109476571/"
},
{
"category": "vendor_fix",
"details": "Update to V8.3 or later version",
"product_ids": [
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109989310/"
},
{
"category": "vendor_fix",
"details": "Update to V1.3 or later version",
"product_ids": [
"245"
]
},
{
"category": "vendor_fix",
"details": "https://support.industry.siemens.com/cs/ww/en/view/1029552/",
"product_ids": [
"245"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175",
"176",
"177",
"178",
"179",
"180",
"181",
"182",
"183",
"184",
"185",
"186",
"187",
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"233",
"234",
"235",
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"245",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"271",
"272",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"282",
"283",
"284",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295",
"296",
"297",
"298",
"299",
"300",
"301",
"302",
"303",
"304",
"305"
]
}
],
"title": "CVE-2025-40833"
}
]
}
```
## [ssa-306654](https://vulnerability.circl.lu/vuln/ssa-306654)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-306654.html"
},
{
"category": "self",
"summary": "SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-306654.json"
}
],
"title": "SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products",
"tracking": {
"current_release_date": "2026-08-11T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-306654",
"initial_release_date": "2022-02-22T00:00:00.000Z",
"revision_history": [
{
"date": "2022-02-22T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2022-03-08T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Corrected AV:L for all CVEs, added RUGGEDCOM APE1808 and SIMATIC IPC477E PRO"
},
{
"date": "2022-07-12T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added CVE-2021-43613, CVE-2021-43614 and CVE-2021-38489, add fix for SIMATIC Field PG M6, SIMATIC ITP1000 for all CVEs except CVE-2021-43613"
},
{
"date": "2022-08-09T00:00:00.000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added fix for SIMATIC IPC227G, SIMATIC IPC277G, SIMATIC IPC327G, SIMATIC IPC377G, clarified affected versions for RUGGEDCOM APE1808"
},
{
"date": "2022-10-11T00:00:00.000Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Added partial fix for SIMATIC IPC427E, SIMATIC IPC477E, SIMATIC IPC477E Pro"
},
{
"date": "2023-02-14T00:00:00.000Z",
"legacy_version": "1.5",
"number": "6",
"summary": "Added partial fix for SIMATIC IPC627E, SIMATIC IPC677E, SIMATIC IPC677E, and SIMATIC IPC847E"
},
{
"date": "2023-07-11T00:00:00.000Z",
"legacy_version": "1.6",
"number": "7",
"summary": "Added fix SIMATIC Field PG M5"
},
{
"date": "2023-08-08T00:00:00.000Z",
"legacy_version": "1.7",
"number": "8",
"summary": "Removed fix for SIMATIC Field PG M6 as fix version was withdrawn"
},
{
"date": "2023-11-14T00:00:00.000Z",
"legacy_version": "1.8",
"number": "9",
"summary": "Added fix for SIMATIC IPC127E"
},
{
"date": "2025-04-08T00:00:00.000Z",
"legacy_version": "1.9",
"number": "10",
"summary": "Added fix for all CVE IDs for SIMATIC Field PG M6; Added fix for CVE-2021-43613 for SIMATIC IPC627E / IPC647E / IPC677E / IPC847E; Removed fix for CVE-2021-43613 for SIMATIC Field PG M5 as this CVE was not fixed in version V22.01.11; RUGGEDCOM APE1808 - BIOS: Removed CVE-2020-5953, CVE-2021-41840 and CVE-2021-43614 as not affected; added the link to the APE software upgrade tool to apply a BIOS version that fixes the other CVE IDs"
},
{
"date": "2026-08-11T00:00:00.000Z",
"legacy_version": "2.0",
"number": "11",
"summary": "Updated the remediation for CVE-2021-43613 for SIMATIC ITP1000 and M5 to 'No fix planned'"
}
],
"status": "interim",
"version": "11"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.0.202N",
"product": {
"name": "RUGGEDCOM APE1808 - BIOS < V1.0.202N",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM APE1808 - BIOS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<22.01.10",
"product": {
"name": "SIMATIC Field PG M5 < V22.01.10",
"product_id": "2"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC Field PG M5",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "SIMATIC Field PG M5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<26.01.13",
"product": {
"name": "SIMATIC Field PG M6 < V26.01.13",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "SIMATIC Field PG M6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<27.01.09",
"product": {
"name": "SIMATIC IPC127E < V27.01.09",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC127E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<28.01.04",
"product": {
"name": "SIMATIC IPC227G < V28.01.04",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC227G"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<28.01.04",
"product": {
"name": "SIMATIC IPC277G < V28.01.04",
"product_id": "7"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC277G"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<28.01.04",
"product": {
"name": "SIMATIC IPC277G PRO < V28.01.04",
"product_id": "8"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC277G PRO"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<28.01.04",
"product": {
"name": "SIMATIC IPC327G < V28.01.04",
"product_id": "9"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC327G"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<28.01.04",
"product": {
"name": "SIMATIC IPC377G < V28.01.04",
"product_id": "10"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC377G"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<21.01.17",
"product": {
"name": "SIMATIC IPC427E < V21.01.17",
"product_id": "11"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC IPC427E",
"product_id": "12"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC427E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<21.01.17",
"product": {
"name": "SIMATIC IPC477E < V21.01.17",
"product_id": "13"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC IPC477E",
"product_id": "14"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC477E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<21.01.17",
"product": {
"name": "SIMATIC IPC477E PRO < V21.01.17",
"product_id": "15"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC IPC477E PRO",
"product_id": "16"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC477E PRO"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<25.02.12",
"product": {
"name": "SIMATIC IPC627E < V25.02.12",
"product_id": "17"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC IPC627E",
"product_id": "18"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC627E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<25.02.12",
"product": {
"name": "SIMATIC IPC647E < V25.02.12",
"product_id": "19"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC IPC647E",
"product_id": "20"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC647E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<25.02.12",
"product": {
"name": "SIMATIC IPC677E < V25.02.12",
"product_id": "21"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC IPC677E",
"product_id": "22"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC677E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<25.02.12",
"product": {
"name": "SIMATIC IPC847E < V25.02.12",
"product_id": "23"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC IPC847E",
"product_id": "24"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC847E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<23.01.10",
"product": {
"name": "SIMATIC ITP1000 < V23.01.10",
"product_id": "25"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ITP1000",
"product_id": "26"
}
}
],
"category": "product_name",
"name": "SIMATIC ITP1000"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<21.01.17",
"product": {
"name": "SIPLUS IPC427E < V21.01.17",
"product_id": "27"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS IPC427E",
"product_id": "28"
}
}
],
"category": "product_name",
"name": "SIPLUS IPC427E"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-5953",
"cwe": {
"id": "CWE-822",
"name": "Untrusted Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2020-5953"
},
{
"cve": "CVE-2020-27339",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"notes": [
{
"category": "description",
"text": "In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. The fixed versions for this issue in the AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe drivers are 05.16.25, 05.26.25, 05.35.25, 05.43.25, and 05.51.25 (for Kernel 5.1 through 5.5).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2020-27339"
},
{
"cve": "CVE-2021-33625",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-33625"
},
{
"cve": "CVE-2021-33626",
"cwe": {
"id": "CWE-829",
"name": "Inclusion of Functionality from Untrusted Control Sphere"
},
"notes": [
{
"category": "description",
"text": "In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. The fixed versions for this issue in the PnpSmm, SmmResourceCheckDxe, and BeepStatusCode drivers are 05.08.23, 05.16.23, 05.26.23, 05.35.23, 05.43.23, and 05.51.23 (for Kernel 5.0 through 5.5).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-33626"
},
{
"cve": "CVE-2021-33627",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in Insyde InsydeH2O 5.x, affecting FwBlockServiceSmm. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-33627"
},
{
"cve": "CVE-2021-38489",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in the the HddPasswordPei driver of the Insyde InsydeH2O 5.x. HDD password is stored in plaintext.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-38489"
},
{
"cve": "CVE-2021-41837",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-41837"
},
{
"cve": "CVE-2021-41838",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in SdHostDriver in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of a Numeric Range Comparison Without a Minimum Check.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-41838"
},
{
"cve": "CVE-2021-41839",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-41839"
},
{
"cve": "CVE-2021-41840",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-41840"
},
{
"cve": "CVE-2021-41841",
"cwe": {
"id": "CWE-829",
"name": "Inclusion of Functionality from Untrusted Control Sphere"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-41841"
},
{
"cve": "CVE-2021-42059",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 before 05.35.41, and Kernel 5.4 before 05.42.20. A stack-based buffer overflow leads toarbitrary code execution in UEFI DisplayTypeDxe DXE driver.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-42059"
},
{
"cve": "CVE-2021-42060",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before 05.23.22, and Kernel 5.3 before 05.32.22. An Int15ServiceSmm SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-42060"
},
{
"cve": "CVE-2021-42113",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-42113"
},
{
"cve": "CVE-2021-42554",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 before 05.26.42, Kernel 5.3 before 05.35.42, Kernel 5.4 before 05.42.51, and Kernel 5.5 before 05.50.51. An SMM memory corruption vulnerability in FvbServicesRuntimeDxe allows a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-42554"
},
{
"cve": "CVE-2021-43323",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 before 05.35.45, 5.2 before 05.26.45, 5.1 before 05.16.45, and 5.0 before 05.08.45. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-43323"
},
{
"cve": "CVE-2021-43522",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-43522"
},
{
"cve": "CVE-2021-43613",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in Insyde InsydeH2O 5.x, affecting SysPasswordDxe that exposes user and administrator password hashes in runtime UEFI variables, leading to escalation of privilege.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"12",
"14",
"16",
"18",
"20",
"22",
"24",
"26",
"28"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"12",
"14",
"16",
"18",
"20",
"22",
"24",
"26",
"28"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"3",
"26"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"12",
"14",
"16",
"18",
"20",
"22",
"24",
"28"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"12",
"14",
"16",
"18",
"20",
"22",
"24",
"26",
"28"
]
}
],
"title": "CVE-2021-43613"
},
{
"cve": "CVE-2021-43614",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "description",
"text": "Error in handling the PlatformLangCodes UEFI variable in the VariableEditSmm driver could cause a buffer overflow, leading to resource exhaustion and failure.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-43614"
},
{
"cve": "CVE-2021-43615",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 before 05.43.22, and 5.5 before 05.51.22. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-43615"
},
{
"cve": "CVE-2021-45969",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the CommBuffer+8 location).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-45969"
},
{
"cve": "CVE-2021-45970",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the status code saved at the CommBuffer+4 location).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-45970"
},
{
"cve": "CVE-2021-45971",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (CommBufferData).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2021-45971"
},
{
"cve": "CVE-2022-24030",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2022-24030"
},
{
"cve": "CVE-2022-24031",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2022-24031"
},
{
"cve": "CVE-2022-24069",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 before 05.26.29, 5.3 before 05.35.29, 5.4 before 05.43.29, and 5.5 before 05.51.29. An SMM callout vulnerability allows an attacker to hijack the execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
"remediations": [
{
"category": "mitigation",
"details": "As a prerequisite for an attack, an attacker must be able to run\nuntrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code",
"product_ids": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0.202N or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814796/"
},
{
"category": "vendor_fix",
"details": "Update to V21.01.17 or later version",
"product_ids": [
"11",
"13",
"15",
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V22.01.10 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V23.01.10 or later version",
"product_ids": [
"25"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V25.02.12 or later version",
"product_ids": [
"17",
"19",
"21",
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V26.01.13 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V27.01.09 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
},
{
"category": "vendor_fix",
"details": "Update to V28.01.04 or later version",
"product_ids": [
"6",
"7",
"8",
"9",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763408/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27"
]
}
],
"title": "CVE-2022-24069"
}
]
}
```
## [ssa-138516](https://vulnerability.circl.lu/vuln/ssa-138516)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Parasolid is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This could allow an attacker to crash the application or execute arbitrary code.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-138516: Out of Bounds Read Vulnerability in Parasolid X_T File Parsing - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-138516.html"
},
{
"category": "self",
"summary": "SSA-138516: Out of Bounds Read Vulnerability in Parasolid X_T File Parsing - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-138516.json"
}
],
"title": "SSA-138516: Out of Bounds Read Vulnerability in Parasolid X_T File Parsing",
"tracking": {
"current_release_date": "2026-08-11T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-138516",
"initial_release_date": "2026-08-11T00:00:00.000Z",
"revision_history": [
{
"date": "2026-08-11T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<38.0.235",
"product": {
"name": "Parasolid V38.0 < V38.0.235",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "Parasolid V38.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<38.1.230",
"product": {
"name": "Parasolid V38.1 < V38.1.230",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "Parasolid V38.1"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-64629",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "The affected applications contains an out of bounds read vulnerability while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V38.0.235 or later version",
"product_ids": [
"1"
],
"url": "https://support.sw.siemens.com/product/258316782/"
},
{
"category": "vendor_fix",
"details": "Update to V38.1.230 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/product/258316782/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"title": "CVE-2026-64629"
}
]
}
```
## [ssa-127084](https://vulnerability.circl.lu/vuln/ssa-127084)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigation measures.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-127084: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-127084.html"
},
{
"category": "self",
"summary": "SSA-127084: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-127084.json"
}
],
"title": "SSA-127084: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices",
"tracking": {
"current_release_date": "2026-08-11T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-127084",
"initial_release_date": "2026-08-11T00:00:00.000Z",
"revision_history": [
{
"date": "2026-08-11T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808 with Fortinet NGFW",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM APE1808"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23573",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "description",
"text": "An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive detailed information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-23573"
},
{
"cve": "CVE-2026-59839",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
},
"notes": [
{
"category": "description",
"text": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiOS, FortiPAM, FortiProxy and FortiSwitch Manager may allow a privileged authenticated attacker with physical access to the device to delete the file system via crafted CLI commands",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive detailed information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-59839"
}
]
}
```
## [ssa-104023](https://vulnerability.circl.lu/vuln/ssa-104023)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nCustomers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications.\n\n[1] https://security.paloaltonetworks.com/",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-104023.html"
},
{
"category": "self",
"summary": "SSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-104023.json"
}
],
"title": "SSA-104023: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices",
"tracking": {
"current_release_date": "2026-08-11T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-104023",
"initial_release_date": "2026-07-14T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2026-08-11T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added CVE-2026-0279, CVE-2026-0280, CVE-2026-0281, CVE-2026-0282, CVE-2026-0283, CVE-2026-0284, CVE-2026-0285, CVE-2026-0286, CVE-2026-0287 and CVE-2026-0288"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM APE1808"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-0266",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "description",
"text": "A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. \r\n\r\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\r\n\r\nCloud NGFW and Prisma® Access are not affected by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0266"
},
{
"cve": "CVE-2026-0272",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "description",
"text": "A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges.\r\n\r\n\r\n\r\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\r\n\r\n\r\n\r\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\r\n\r\nCloud NGFW, and Prisma® Access are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0272"
},
{
"cve": "CVE-2026-0273",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
},
"notes": [
{
"category": "description",
"text": "A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI.\r\n\r\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\r\n\r\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\r\n\r\nCloud NGFW and Prisma® Access are not affected by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0273"
},
{
"cve": "CVE-2026-0279",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "description",
"text": "Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload.\r\n\r\n\r\nThe security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\r\n\r\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\r\n\r\nCloud NGFW is not affected by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0279"
},
{
"cve": "CVE-2026-0280",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "description",
"text": "An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services.\r\n\r\nCloud NGFW and Panorama are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0280"
},
{
"cve": "CVE-2026-0281",
"cwe": {
"id": "CWE-524",
"name": "Use of Cache Containing Sensitive Information"
},
"notes": [
{
"category": "description",
"text": "An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker.\r\n\r\nThe security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\r\n\r\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\r\n\r\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0281"
},
{
"cve": "CVE-2026-0282",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.\r\n\r\nThe security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\r\n\r\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\r\n\r\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0282"
},
{
"cve": "CVE-2026-0283",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "description",
"text": "An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection.\r\n\r\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0283"
},
{
"cve": "CVE-2026-0284",
"cwe": {
"id": "CWE-74",
"name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
},
"notes": [
{
"category": "description",
"text": "An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data.\r\n\r\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0284"
},
{
"cve": "CVE-2026-0285",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "description",
"text": "A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services.\r\n\r\n\r\n\r\nThe security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . \r\n\r\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0285"
},
{
"cve": "CVE-2026-0286",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
},
"notes": [
{
"category": "description",
"text": "A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root.\r\n\r\n\r\n\r\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.\r\n\r\n\r\n\r\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\r\n\r\n\r\n\r\nCloud NGFW and Prisma Access® are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0286"
},
{
"cve": "CVE-2026-0287",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"category": "description",
"text": "Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.\r\n\r\nPanorama is not impacted by these vulnerabilities.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0287"
},
{
"cve": "CVE-2026-0288",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0288"
}
]
}
```
## [ssa-077553](https://vulnerability.circl.lu/vuln/ssa-077553)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system.\n\nSiemens has released a new version for Siemens License Server (SLS) and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-077553: Multiple Vulnerabilities in Siemens License Server (SLS) - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-077553.html"
},
{
"category": "self",
"summary": "SSA-077553: Multiple Vulnerabilities in Siemens License Server (SLS) - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-077553.json"
}
],
"title": "SSA-077553: Multiple Vulnerabilities in Siemens License Server (SLS)",
"tracking": {
"current_release_date": "2026-08-11T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-077553",
"initial_release_date": "2026-08-11T00:00:00.000Z",
"revision_history": [
{
"date": "2026-08-11T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.1",
"product": {
"name": "Siemens License Server (SLS) < V5.1",
"product_id": "1"
}
},
{
"category": "product_version_range",
"name": "vers:intdot/<5.3",
"product": {
"name": "Siemens License Server (SLS) < V5.3",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "Siemens License Server (SLS)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-69108",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "description",
"text": "The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V5.1 or later version",
"product_ids": [
"1"
],
"url": "https://support.sw.siemens.com/product/1586485382/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-69108"
},
{
"cve": "CVE-2026-69109",
"cwe": {
"id": "CWE-35",
"name": "Path Traversal: '.../...//'"
},
"notes": [
{
"category": "description",
"text": "The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V5.3 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/product/1586485382/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2026-69109"
}
]
}
```
## [ssa-967325](https://vulnerability.circl.lu/vuln/ssa-967325)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.\n\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications.\n\n[1] https://security.paloaltonetworks.com/",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html"
},
{
"category": "self",
"summary": "SSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-967325.json"
}
],
"title": "SSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-967325",
"initial_release_date": "2026-05-12T00:00:00.000Z",
"revision_history": [
{
"date": "2026-05-12T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added CVE-2026-0256, CVE-2026-0257, CVE-2026-0258, CVE-2026-0261, CVE-2026-0262, CVE-2026-0264 and CVE-2026-0265"
},
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added CVE-2026-0269. Added remediation for CVE-2026-0300, CVE-2026-0256, CVE-2026-0257, CVE-2026-0261, CVE-2026-0262, CVE-2026-0258, CVE-2026-0264 and CVE-2026-0265"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW with User-ID™ Authentication Portal configured and interface management profile with response pages enabled",
"product_id": "1"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW",
"product_id": "2"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists",
"product_id": "3"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW with a PAN-OS Site-to-Site VPN Gateway with IKEv2 configured",
"product_id": "4"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW with DNS Proxy enabled and a network proxy attached",
"product_id": "5"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW with Authentication Profile with CAS enabled and Authentication profile is attached to a login interface",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM APE1808"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-0256",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "description",
"text": "A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2026-0256"
},
{
"cve": "CVE-2026-0257",
"cwe": {
"id": "CWE-565",
"name": "Reliance on Cookies without Validation and Integrity Checking"
},
"notes": [
{
"category": "description",
"text": "Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"3"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Disable Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration",
"product_ids": [
"3"
]
},
{
"category": "mitigation",
"details": "Use a dedicated certificate for Authentication Override cookies",
"product_ids": [
"3"
]
},
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h7. Contact customer support to receive patch and update information",
"product_ids": [
"3"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"3"
]
}
],
"title": "CVE-2026-0257"
},
{
"cve": "CVE-2026-0258",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "description",
"text": "A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"4"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information",
"product_ids": [
"4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"4"
]
}
],
"title": "CVE-2026-0258"
},
{
"cve": "CVE-2026-0261",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
},
"notes": [
{
"category": "description",
"text": "Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2026-0261"
},
{
"cve": "CVE-2026-0262",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"category": "description",
"text": "Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to a dataplane interface",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2026-0262"
},
{
"cve": "CVE-2026-0264",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only)",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"5"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Disable the DNS Proxy feature (Network > DNS Proxy) if it is not being used and configure DNS server with a RFC1918 or a public trusted IP address",
"product_ids": [
"5"
]
},
{
"category": "mitigation",
"details": "Disassociate DNS Proxy from externally accessible interfaces and configure DNS server with a RFC1918 or a public trusted IP address",
"product_ids": [
"5"
]
},
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information",
"product_ids": [
"5"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"5"
]
}
],
"title": "CVE-2026-0264"
},
{
"cve": "CVE-2026-0265",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"notes": [
{
"category": "description",
"text": "An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"6"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information",
"product_ids": [
"6"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"6"
]
}
],
"title": "CVE-2026-0265"
},
{
"cve": "CVE-2026-0269",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"category": "description",
"text": "A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.\n\n\n\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h7. Contact customer support to receive patch and update information",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 0.0,
"baseSeverity": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2026-0269"
},
{
"cve": "CVE-2026-0300",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Disable Response Pages in the Interface Management Profile attached to every L3 interface in any zone where untrusted/internet traffic can ingress. Keep Response Pages enabled only on interfaces in trust/internal zones where legitimate users' browsers ingress",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Disable User-ID™ Authentication Portal if not required",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Restrict access to the User-ID Authentication Portal to trusted internal IP addresses only",
"product_ids": [
"1"
]
},
{
"category": "vendor_fix",
"details": "Upgrade Palo Alto Networks Virtual NGFW V11.2.10-h6. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-0300"
}
]
}
```
## [ssa-828211](https://vulnerability.circl.lu/vuln/ssa-828211)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition.\n\nSiemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-828211: Denial of Service Vulnerability in SIMATIC S7-PLCSIM Advanced - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-828211.html"
},
{
"category": "self",
"summary": "SSA-828211: Denial of Service Vulnerability in SIMATIC S7-PLCSIM Advanced - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-828211.json"
}
],
"title": "SSA-828211: Denial of Service Vulnerability in SIMATIC S7-PLCSIM Advanced",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-828211",
"initial_release_date": "2026-07-14T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-PLCSIM Advanced",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-PLCSIM Advanced"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-54429",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "description",
"text": "Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This could allow an unauthenticated attacker on the local network segment to cause a denial-of-service condition of the affected application. The affected application becomes inaccessible and requires a manual restart; no project data is lost. Successful exploitation requires a specific project configuration to be already active on the targeted instance.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Disable the S7-PLCSIM Virtual Switch binding on the network adapter used by the affected instance. This prevents the adapter from entering an external communication mode and removes the attack vector entirely. (see SIMATIC S7-PLCSIM Advanced Function Manual V8.0, 11/2025 Section 5.3 and Section 6.1.2.3; and SIMATIC S7-PLCSIM Advanced Function Manual API V8.0, 11/2025 Section 7.2)",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Restrict multicast traffic on the network segment hosting the SIMATIC S7-PLCSIM Advanced host.",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Use 'Softbus' / 'PLCSIM' network mode. This mode does not accept any packets from the network. This mode is a default network mode. (see SIMATIC S7-PLCSIM Advanced Function Manual V8.0, 11/2025 Section 5.0 and Section 5.1; and SIMATIC S7-PLCSIM Advanced Function Manual API V8.0, 11/2025 Section 7.2)",
"product_ids": [
"1"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-54429"
}
]
}
```
## [ssa-734552](https://vulnerability.circl.lu/vuln/ssa-734552)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\nhttps://www.siemens.com/gridsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-734552: Buffer Overflow Vulnerability in OpenSSL Affecting Desigo CC - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-734552.html"
},
{
"category": "self",
"summary": "SSA-734552: Buffer Overflow Vulnerability in OpenSSL Affecting Desigo CC - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-734552.json"
}
],
"title": "SSA-734552: Buffer Overflow Vulnerability in OpenSSL Affecting Desigo CC",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-734552",
"initial_release_date": "2026-07-14T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Desigo CC family V7",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "Desigo CC family V7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.0.2.0021",
"product": {
"name": "Desigo CC family V8 < V8.0.2.0021",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "Desigo CC family V8"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<9.0.1",
"product": {
"name": "Desigo CC family V9 < V9.0.1",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "Desigo CC family V9"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-15467",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "Issue summary: Parsing CMS AuthEnvelopedData message with maliciously\r\ncrafted AEAD parameters can trigger a stack buffer overflow.\r\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\r\nof Service, or potentially remote code execution.\r\n\r\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\r\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\r\ncopied into a fixed-size stack buffer without verifying that its length fits\r\nthe destination. An attacker can supply a crafted CMS message with an\r\noversized IV, causing a stack-based out-of-bounds write before any\r\nauthentication or tag verification occurs.\r\n\r\nApplications and services that parse untrusted CMS or PKCS#7 content using\r\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\r\nBecause the overflow occurs prior to authentication, no valid key material\r\nis required to trigger it. While exploitability to remote code execution\r\ndepends on platform and toolchain mitigations, the stack-based write\r\nprimitive represents a severe risk.\r\n\r\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\r\nissue, as the CMS implementation is outside the OpenSSL FIPS module\r\nboundary.\r\n\r\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\r\n\r\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3"
]
},
"remediations": [
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1"
]
},
{
"category": "vendor_fix",
"details": "Update to V8.0 QU2.0021 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109989041/"
},
{
"category": "vendor_fix",
"details": "Update to V9.0 QU1 or later version",
"product_ids": [
"3"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002555/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3"
]
}
],
"title": "CVE-2025-15467"
}
]
}
```
## [ssa-688146](https://vulnerability.circl.lu/vuln/ssa-688146)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SIMATIC S7 PLCs contain multiple vulnerabilities in the web server that could allow an attacker to perform cross-site scripting attacks.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-688146: Multiple Cross-Site Scripting Vulnerabilities in SIMATIC S7 PLCs Web Server - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-688146.html"
},
{
"category": "self",
"summary": "SSA-688146: Multiple Cross-Site Scripting Vulnerabilities in SIMATIC S7 PLCs Web Server - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-688146.json"
}
],
"title": "SSA-688146: Multiple Cross-Site Scripting Vulnerabilities in SIMATIC S7 PLCs Web Server",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-688146",
"initial_release_date": "2026-05-12T00:00:00.000Z",
"revision_history": [
{
"date": "2026-05-12T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added fix for S7-1500 V4.x"
}
],
"status": "interim",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) < V3.1.6",
"product_id": "1",
"product_identification_helper": {
"model_numbers": [
"6ES7615-4DF10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) < V3.1.6",
"product_id": "2",
"product_identification_helper": {
"model_numbers": [
"6ES7615-7DF10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)",
"product_id": "3",
"product_identification_helper": {
"model_numbers": [
"6ES7510-1SJ00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) < V2.9.9",
"product_id": "4",
"product_identification_helper": {
"model_numbers": [
"6ES7510-1SJ01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) < V4.1.6",
"product_id": "5",
"product_identification_helper": {
"model_numbers": [
"6ES7510-1SK03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)",
"product_id": "6",
"product_identification_helper": {
"model_numbers": [
"6ES7510-1DJ00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0) < V2.9.9",
"product_id": "7",
"product_identification_helper": {
"model_numbers": [
"6ES7510-1DJ01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0) < V4.1.6",
"product_id": "8",
"product_identification_helper": {
"model_numbers": [
"6ES7510-1DK03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0)",
"product_id": "9",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1SK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0) < V2.9.9",
"product_id": "10",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1SK01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0) < V4.1.6",
"product_id": "11",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1SM03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK00-0AB0)",
"product_id": "12",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1DK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0) < V2.9.9",
"product_id": "13",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1DK01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0) < V4.1.6",
"product_id": "14",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1DM03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0) < V4.1.6",
"product_id": "15",
"product_identification_helper": {
"model_numbers": [
"6ES7514-2SN03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0) < V4.1.6",
"product_id": "16",
"product_identification_helper": {
"model_numbers": [
"6ES7514-2DN03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0) < V4.1.6",
"product_id": "17",
"product_identification_helper": {
"model_numbers": [
"6ES7514-2WN03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0) < V4.1.6",
"product_id": "18",
"product_identification_helper": {
"model_numbers": [
"6ES7514-2VN03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)",
"product_id": "19"
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs",
"product_id": "20"
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs",
"product_id": "21"
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs",
"product_id": "22"
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)",
"product_id": "23",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1AK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0) < V2.9.9",
"product_id": "24",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1AK01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0) < V2.9.9",
"product_id": "25",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1AK02-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0) < V4.1.6",
"product_id": "26",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1AL03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0) < V2.9.9",
"product_id": "27",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1CK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0) < V2.9.9",
"product_id": "28",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1CK01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0) < V4.1.6",
"product_id": "29",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1CL03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CL03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)",
"product_id": "30",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1FK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0) < V2.9.9",
"product_id": "31",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1FK01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0) < V2.9.9",
"product_id": "32",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1FK02-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0) < V4.1.6",
"product_id": "33",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1FL03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0) < V2.9.9",
"product_id": "34",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1TK01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0) < V4.1.6",
"product_id": "35",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1TL03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0) < V2.9.9",
"product_id": "36",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1UK01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0) < V4.1.6",
"product_id": "37",
"product_identification_helper": {
"model_numbers": [
"6ES7511-1UL03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0) < V2.9.9",
"product_id": "38",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1CK00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0) < V2.9.9",
"product_id": "39",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1CK01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0) < V4.1.6",
"product_id": "40",
"product_identification_helper": {
"model_numbers": [
"6ES7512-1CM03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CM03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0)",
"product_id": "41",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1AL00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0) < V2.9.9",
"product_id": "42",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1AL01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0) < V2.9.9",
"product_id": "43",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1AL02-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0) < V4.1.6",
"product_id": "44",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1AM03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0)",
"product_id": "45",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1FL00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0) < V2.9.9",
"product_id": "46",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1FL01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0) < V2.9.9",
"product_id": "47",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1FL02-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0) < V4.1.6",
"product_id": "48",
"product_identification_helper": {
"model_numbers": [
"6ES7513-1FM03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0) < V4.1.6",
"product_id": "49",
"product_identification_helper": {
"model_numbers": [
"6ES7513-2GM03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513pro F-2 PN (6ES7513-2GM03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0) < V4.1.6",
"product_id": "50",
"product_identification_helper": {
"model_numbers": [
"6ES7513-2PM03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1513pro-2 PN (6ES7513-2PM03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0)",
"product_id": "51",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2AM00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0) < V2.9.9",
"product_id": "52",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2AM01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0) < V2.9.9",
"product_id": "53",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2AM02-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0) < V4.1.6",
"product_id": "54",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2AN03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0)",
"product_id": "55",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2FM00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0) < V2.9.9",
"product_id": "56",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2FM01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0) < V2.9.9",
"product_id": "57",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2FM02-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0) < V4.1.6",
"product_id": "58",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2FN03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0) < V2.9.9",
"product_id": "59",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2TM01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0) < V4.1.6",
"product_id": "60",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2TN03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0) < V2.9.9",
"product_id": "61",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2UM01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0) < V4.1.6",
"product_id": "62",
"product_identification_helper": {
"model_numbers": [
"6ES7515-2UN03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0)",
"product_id": "63",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3AN00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0) < V2.9.9",
"product_id": "64",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3AN01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0) < V2.9.9",
"product_id": "65",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3AN02-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0) < V4.1.6",
"product_id": "66",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3AP03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0)",
"product_id": "67",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3FN00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0) < V2.9.9",
"product_id": "68",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3FN01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0) < V2.9.9",
"product_id": "69",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3FN02-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0) < V4.1.6",
"product_id": "70",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3FP03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1516pro F-2 PN (6ES7516-2GP03-0AB0) < V4.1.6",
"product_id": "71",
"product_identification_helper": {
"model_numbers": [
"6ES7516-2GP03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516pro F-2 PN (6ES7516-2GP03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1516pro-2 PN (6ES7516-2PP03-0AB0) < V4.1.6",
"product_id": "72",
"product_identification_helper": {
"model_numbers": [
"6ES7516-2PP03-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516pro-2 PN (6ES7516-2PP03-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1516T-3 PN (6ES7516-3TP10-0AB0) < V4.1.6",
"product_id": "73",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3TP10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516T-3 PN (6ES7516-3TP10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0) < V3.1.6",
"product_id": "74",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3TN00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1516TF-3 PN (6ES7516-3UP10-0AB0) < V4.1.6",
"product_id": "75",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3UP10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516TF-3 PN (6ES7516-3UP10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0) < V3.1.6",
"product_id": "76",
"product_identification_helper": {
"model_numbers": [
"6ES7516-3UN00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517-3 PN (6ES7517-3AQ10-0AB0) < V4.1.6",
"product_id": "77",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3AQ10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517-3 PN (6ES7517-3AQ10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0) < V3.1.6",
"product_id": "78",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3AP00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517F-3 PN (6ES7517-3FQ10-0AB0) < V4.1.6",
"product_id": "79",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3FQ10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517F-3 PN (6ES7517-3FQ10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0) < V3.1.6",
"product_id": "80",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3FP00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP01-0AB0) < V3.1.6",
"product_id": "81",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3FP01-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP01-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517T-3 PN (6ES7517-3TQ10-0AB0) < V4.1.6",
"product_id": "82",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3TQ10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517T-3 PN (6ES7517-3TQ10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0) < V3.1.6",
"product_id": "83",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3TP00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517TF-3 PN (6ES7517-3UQ10-0AB0) < V4.1.6",
"product_id": "84",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3UQ10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517TF-3 PN (6ES7517-3UQ10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0) < V3.1.6",
"product_id": "85",
"product_identification_helper": {
"model_numbers": [
"6ES7517-3UP00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518-3 PN (6ES7518-3AT10-0AB0) < V4.1.6",
"product_id": "86",
"product_identification_helper": {
"model_numbers": [
"6ES7518-3AT10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518-3 PN (6ES7518-3AT10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP (6ES7518-4AP00-0AB0) < V3.1.6",
"product_id": "87",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4AP00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP (6ES7518-4AP00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) < V3.1.6",
"product_id": "88",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4AX00-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) < V3.1.6",
"product_id": "89",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4AX00-1AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518F-3 PN (6ES7518-3FT10-0AB0) < V4.1.6",
"product_id": "90",
"product_identification_helper": {
"model_numbers": [
"6ES7518-3FT10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518F-3 PN (6ES7518-3FT10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP (6ES7518-4FP00-0AB0) < V3.1.6",
"product_id": "91",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4FP00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP (6ES7518-4FP00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) < V3.1.6",
"product_id": "92",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4FX00-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) < V3.1.6",
"product_id": "93",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4FX00-1AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518T-3 PN (6ES7518-3TT10-0AB0) < V4.1.6",
"product_id": "94",
"product_identification_helper": {
"model_numbers": [
"6ES7518-3TT10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518T-3 PN (6ES7518-3TT10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518T-4 PN/DP (6ES7518-4TP00-0AB0) < V3.1.6",
"product_id": "95",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4TP00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518T-4 PN/DP (6ES7518-4TP00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518TF-3 PN (6ES7518-3UT10-0AB0) < V4.1.6",
"product_id": "96",
"product_identification_helper": {
"model_numbers": [
"6ES7518-3UT10-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518TF-3 PN (6ES7518-3UT10-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518TF-4 PN/DP (6ES7518-4UP00-0AB0) < V3.1.6",
"product_id": "97",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4UP00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518TF-4 PN/DP (6ES7518-4UP00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK (6ES7518-4AP00-3AB0)",
"product_id": "98",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4AP00-3AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK (6ES7518-4AP00-3AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK (6ES7518-4FP00-3AB0)",
"product_id": "99",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4FP00-3AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK (6ES7518-4FP00-3AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN (6ES7513-2GL00-0AB0) < V2.9.9",
"product_id": "100",
"product_identification_helper": {
"model_numbers": [
"6ES7513-2GL00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN (6ES7513-2GL00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN (6ES7513-2PL00-0AB0) < V2.9.9",
"product_id": "101",
"product_identification_helper": {
"model_numbers": [
"6ES7513-2PL00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN (6ES7513-2PL00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN (6ES7516-2GN00-0AB0) < V2.9.9",
"product_id": "102",
"product_identification_helper": {
"model_numbers": [
"6ES7516-2GN00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN (6ES7516-2GN00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN (6ES7516-2PN00-0AB0) < V2.9.9",
"product_id": "103",
"product_identification_helper": {
"model_numbers": [
"6ES7516-2PN00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN (6ES7516-2PN00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1507S F V2",
"product_id": "104"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1507S F V2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1507S F V3",
"product_id": "105"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1507S F V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1507S F V4",
"product_id": "106"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1507S F V4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1507S V2",
"product_id": "107"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1507S V2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1507S V3",
"product_id": "108"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1507S V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1507S V4",
"product_id": "109"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1507S V4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1508S F V2",
"product_id": "110"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1508S F V2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1508S F V3",
"product_id": "111"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1508S F V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1508S F V4",
"product_id": "112"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1508S F V4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1508S T V3",
"product_id": "113"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1508S T V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1508S TF V3",
"product_id": "114"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1508S TF V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1508S V2",
"product_id": "115"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1508S V2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1508S V3",
"product_id": "116"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1508S V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller CPU 1508S V4",
"product_id": "117"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller CPU 1508S V4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller Linux V2",
"product_id": "118"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller Linux V2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-1500 Software Controller Linux V3",
"product_id": "119"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 Software Controller Linux V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-PLCSIM Advanced",
"product_id": "120"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-PLCSIM Advanced"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1510SP F-1 PN (6AG1510-1SJ01-2AB0) < V2.9.9",
"product_id": "121",
"product_identification_helper": {
"model_numbers": [
"6AG1510-1SJ01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1510SP F-1 PN (6AG1510-1SJ01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL (6AG2510-1SJ01-1AB0) < V2.9.9",
"product_id": "122",
"product_identification_helper": {
"model_numbers": [
"6AG2510-1SJ01-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL (6AG2510-1SJ01-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-2AB0) < V2.9.9",
"product_id": "123",
"product_identification_helper": {
"model_numbers": [
"6AG1510-1DJ01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-7AB0) < V2.9.9",
"product_id": "124",
"product_identification_helper": {
"model_numbers": [
"6AG1510-1DJ01-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-1AB0) < V2.9.9",
"product_id": "125",
"product_identification_helper": {
"model_numbers": [
"6AG2510-1DJ01-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-4AB0) < V2.9.9",
"product_id": "126",
"product_identification_helper": {
"model_numbers": [
"6AG2510-1DJ01-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK00-2AB0)",
"product_id": "127",
"product_identification_helper": {
"model_numbers": [
"6AG1512-1SK00-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK00-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-2AB0) < V2.9.9",
"product_id": "128",
"product_identification_helper": {
"model_numbers": [
"6AG1512-1SK01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-7AB0) < V2.9.9",
"product_id": "129",
"product_identification_helper": {
"model_numbers": [
"6AG1512-1SK01-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-1AB0) < V2.9.9",
"product_id": "130",
"product_identification_helper": {
"model_numbers": [
"6AG2512-1SK01-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-4AB0) < V2.9.9",
"product_id": "131",
"product_identification_helper": {
"model_numbers": [
"6AG2512-1SK01-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-2AB0) < V2.9.9",
"product_id": "132",
"product_identification_helper": {
"model_numbers": [
"6AG1512-1DK01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-7AB0) < V2.9.9",
"product_id": "133",
"product_identification_helper": {
"model_numbers": [
"6AG1512-1DK01-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-1AB0) < V2.9.9",
"product_id": "134",
"product_identification_helper": {
"model_numbers": [
"6AG2512-1DK01-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-4AB0) < V2.9.9",
"product_id": "135",
"product_identification_helper": {
"model_numbers": [
"6AG2512-1DK01-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK00-2AB0)",
"product_id": "136",
"product_identification_helper": {
"model_numbers": [
"6AG1511-1AK00-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK00-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-2AB0) < V2.9.9",
"product_id": "137",
"product_identification_helper": {
"model_numbers": [
"6AG1511-1AK01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-7AB0) < V2.9.9",
"product_id": "138",
"product_identification_helper": {
"model_numbers": [
"6AG1511-1AK01-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-2AB0) < V2.9.9",
"product_id": "139",
"product_identification_helper": {
"model_numbers": [
"6AG1511-1AK02-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-7AB0) < V2.9.9",
"product_id": "140",
"product_identification_helper": {
"model_numbers": [
"6AG1511-1AK02-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK01-1AB0) < V2.9.9",
"product_id": "141",
"product_identification_helper": {
"model_numbers": [
"6AG2511-1AK01-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK01-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK02-1AB0) < V2.9.9",
"product_id": "142",
"product_identification_helper": {
"model_numbers": [
"6AG2511-1AK02-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK02-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK01-4AB0) < V2.9.9",
"product_id": "143",
"product_identification_helper": {
"model_numbers": [
"6AG2511-1AK01-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK01-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK02-4AB0) < V2.9.9",
"product_id": "144",
"product_identification_helper": {
"model_numbers": [
"6AG2511-1AK02-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK02-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK00-2AB0)",
"product_id": "145",
"product_identification_helper": {
"model_numbers": [
"6AG1511-1FK00-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK00-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK01-2AB0) < V2.9.9",
"product_id": "146",
"product_identification_helper": {
"model_numbers": [
"6AG1511-1FK01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK02-2AB0) < V2.9.9",
"product_id": "147",
"product_identification_helper": {
"model_numbers": [
"6AG1511-1FK02-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK02-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL00-2AB0)",
"product_id": "148",
"product_identification_helper": {
"model_numbers": [
"6AG1513-1AL00-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL00-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-2AB0) < V2.9.9",
"product_id": "149",
"product_identification_helper": {
"model_numbers": [
"6AG1513-1AL01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-7AB0) < V2.9.9",
"product_id": "150",
"product_identification_helper": {
"model_numbers": [
"6AG1513-1AL01-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-2AB0) < V2.9.9",
"product_id": "151",
"product_identification_helper": {
"model_numbers": [
"6AG1513-1AL02-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-7AB0) < V2.9.9",
"product_id": "152",
"product_identification_helper": {
"model_numbers": [
"6AG1513-1AL02-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL00-2AB0)",
"product_id": "153",
"product_identification_helper": {
"model_numbers": [
"6AG1513-1FL00-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL00-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL01-2AB0) < V2.9.9",
"product_id": "154",
"product_identification_helper": {
"model_numbers": [
"6AG1513-1FL01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL02-2AB0) < V2.9.9",
"product_id": "155",
"product_identification_helper": {
"model_numbers": [
"6AG1513-1FL02-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL02-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM01-2AB0) < V2.9.9",
"product_id": "156",
"product_identification_helper": {
"model_numbers": [
"6AG1515-2FM01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM02-2AB0) < V2.9.9",
"product_id": "157",
"product_identification_helper": {
"model_numbers": [
"6AG1515-2FM02-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM02-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1515F-2 PN RAIL (6AG2515-2FM02-4AB0) < V2.9.9",
"product_id": "158",
"product_identification_helper": {
"model_numbers": [
"6AG2515-2FM02-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1515F-2 PN RAIL (6AG2515-2FM02-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL (6AG2515-2FM01-2AB0) < V2.9.9",
"product_id": "159",
"product_identification_helper": {
"model_numbers": [
"6AG2515-2FM01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL (6AG2515-2FM01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-2AB0)",
"product_id": "160",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3AN00-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-7AB0)",
"product_id": "161",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3AN00-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-2AB0) < V2.9.9",
"product_id": "162",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3AN01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-7AB0) < V2.9.9",
"product_id": "163",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3AN01-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-2AB0) < V2.9.9",
"product_id": "164",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3AN02-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-7AB0) < V2.9.9",
"product_id": "165",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3AN02-7AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-7AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL (6AG2516-3AN02-4AB0) < V2.9.9",
"product_id": "166",
"product_identification_helper": {
"model_numbers": [
"6AG2516-3AN02-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL (6AG2516-3AN02-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL (6AG2516-3AN01-4AB0) < V2.9.9",
"product_id": "167",
"product_identification_helper": {
"model_numbers": [
"6AG2516-3AN01-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL (6AG2516-3AN01-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN00-2AB0)",
"product_id": "168",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3FN00-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN00-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN01-2AB0) < V2.9.9",
"product_id": "169",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3FN01-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN01-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN02-2AB0) < V2.9.9",
"product_id": "170",
"product_identification_helper": {
"model_numbers": [
"6AG1516-3FN02-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN02-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-2AB0) < V2.9.9",
"product_id": "171",
"product_identification_helper": {
"model_numbers": [
"6AG2516-3FN02-2AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-2AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.9.9",
"product": {
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-4AB0) < V2.9.9",
"product_id": "172",
"product_identification_helper": {
"model_numbers": [
"6AG2516-3FN02-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIPLUS S7-1500 CPU 1518-4 PN/DP (6AG1518-4AP00-4AB0) < V3.1.6",
"product_id": "173",
"product_identification_helper": {
"model_numbers": [
"6AG1518-4AP00-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1518-4 PN/DP (6AG1518-4AP00-4AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) < V3.1.6",
"product_id": "174",
"product_identification_helper": {
"model_numbers": [
"6AG1518-4AX00-4AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.1.6",
"product": {
"name": "SIPLUS S7-1500 CPU 1518F-4 PN/DP (6AG1518-4FP00-4AB0) < V3.1.6",
"product_id": "175",
"product_identification_helper": {
"model_numbers": [
"6AG1518-4FP00-4AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1518F-4 PN/DP (6AG1518-4FP00-4AB0)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25786",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "description",
"text": "Affected devices do not properly validate and sanitize PLC/station name rendered on the \"communication\" parameters page of the web interface.\r\nThis could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page.\r\nIf a benign user with appropriate rights accesses the \"communication\" parameters page, the malicious code would be executed in the scope of their web session.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Restrict TIA project download to trusted personnel only.",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"3",
"6",
"9",
"12",
"23",
"30",
"41",
"45",
"51",
"55",
"63",
"67",
"98",
"99",
"104",
"107",
"110",
"115",
"118",
"127",
"136",
"145",
"148",
"153",
"160",
"161",
"168"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"19",
"20",
"21",
"22",
"105",
"106",
"108",
"109",
"111",
"112",
"113",
"114",
"116",
"117",
"119",
"120"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.9.9 or later version",
"product_ids": [
"4",
"7",
"10",
"13",
"24",
"25",
"27",
"28",
"31",
"32",
"34",
"36",
"38",
"39",
"42",
"43",
"46",
"47",
"52",
"53",
"56",
"57",
"59",
"61",
"64",
"65",
"68",
"69",
"100",
"101",
"102",
"103",
"121",
"122",
"123",
"124",
"125",
"126",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"146",
"147",
"149",
"150",
"151",
"152",
"154",
"155",
"156",
"157",
"158",
"159",
"162",
"163",
"164",
"165",
"166",
"167",
"169",
"170",
"171",
"172"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"1",
"2",
"74",
"76",
"78",
"80",
"81",
"83",
"85",
"87",
"88",
"89",
"91",
"92",
"93",
"95",
"97",
"173",
"174",
"175"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109773914/"
},
{
"category": "vendor_fix",
"details": "Update to V4.1.6 or later version",
"product_ids": [
"5",
"8",
"11",
"14",
"15",
"16",
"17",
"18",
"26",
"29",
"33",
"35",
"37",
"40",
"44",
"48",
"49",
"50",
"54",
"58",
"60",
"62",
"66",
"70",
"71",
"72",
"73",
"75",
"77",
"79",
"82",
"84",
"86",
"90",
"94",
"96"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
}
],
"title": "CVE-2026-25786"
},
{
"cve": "CVE-2026-25787",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "description",
"text": "Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the \"Motion Control Diagnostics\" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page.\r\nIf a benign user with appropriate rights accesses the \"Motion Control Diagnostics\" parameters page, the malicious code would be executed in the scope of their web session.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Restrict TIA project download to trusted personnel only.",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"3",
"6",
"9",
"12",
"23",
"30",
"41",
"45",
"51",
"55",
"63",
"67",
"98",
"99",
"104",
"107",
"110",
"115",
"118",
"127",
"136",
"145",
"148",
"153",
"160",
"161",
"168"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"19",
"20",
"21",
"22",
"105",
"106",
"108",
"109",
"111",
"112",
"113",
"114",
"116",
"117",
"119",
"120"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.9.9 or later version",
"product_ids": [
"4",
"7",
"10",
"13",
"24",
"25",
"27",
"28",
"31",
"32",
"34",
"36",
"38",
"39",
"42",
"43",
"46",
"47",
"52",
"53",
"56",
"57",
"59",
"61",
"64",
"65",
"68",
"69",
"100",
"101",
"102",
"103",
"121",
"122",
"123",
"124",
"125",
"126",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"146",
"147",
"149",
"150",
"151",
"152",
"154",
"155",
"156",
"157",
"158",
"159",
"162",
"163",
"164",
"165",
"166",
"167",
"169",
"170",
"171",
"172"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"1",
"2",
"74",
"76",
"78",
"80",
"81",
"83",
"85",
"87",
"88",
"89",
"91",
"92",
"93",
"95",
"97",
"173",
"174",
"175"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109773914/"
},
{
"category": "vendor_fix",
"details": "Update to V4.1.6 or later version",
"product_ids": [
"5",
"8",
"11",
"14",
"15",
"16",
"17",
"18",
"26",
"29",
"33",
"35",
"37",
"40",
"44",
"48",
"49",
"50",
"54",
"58",
"60",
"62",
"66",
"70",
"71",
"72",
"73",
"75",
"77",
"79",
"82",
"84",
"86",
"90",
"94",
"96"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
}
],
"title": "CVE-2026-25787"
},
{
"cve": "CVE-2026-25789",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "description",
"text": "Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Restrict access to the function right \"firmware update\" to instructed personnel.",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"3",
"6",
"9",
"12",
"23",
"30",
"41",
"45",
"51",
"55",
"63",
"67",
"98",
"99",
"104",
"107",
"110",
"115",
"118",
"127",
"136",
"145",
"148",
"153",
"160",
"161",
"168"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"19",
"20",
"21",
"22",
"105",
"106",
"108",
"109",
"111",
"112",
"113",
"114",
"116",
"117",
"119",
"120"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.9.9 or later version",
"product_ids": [
"4",
"7",
"10",
"13",
"24",
"25",
"27",
"28",
"31",
"32",
"34",
"36",
"38",
"39",
"42",
"43",
"46",
"47",
"52",
"53",
"56",
"57",
"59",
"61",
"64",
"65",
"68",
"69",
"100",
"101",
"102",
"103",
"121",
"122",
"123",
"124",
"125",
"126",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"146",
"147",
"149",
"150",
"151",
"152",
"154",
"155",
"156",
"157",
"158",
"159",
"162",
"163",
"164",
"165",
"166",
"167",
"169",
"170",
"171",
"172"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"1",
"2",
"74",
"76",
"78",
"80",
"81",
"83",
"85",
"87",
"88",
"89",
"91",
"92",
"93",
"95",
"97",
"173",
"174",
"175"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109773914/"
},
{
"category": "vendor_fix",
"details": "Update to V4.1.6 or later version",
"product_ids": [
"5",
"8",
"11",
"14",
"15",
"16",
"17",
"18",
"26",
"29",
"33",
"35",
"37",
"40",
"44",
"48",
"49",
"50",
"54",
"58",
"60",
"62",
"66",
"70",
"71",
"72",
"73",
"75",
"77",
"79",
"82",
"84",
"86",
"90",
"94",
"96"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
]
}
],
"title": "CVE-2026-25789"
}
]
}
```
## [ssa-585531](https://vulnerability.circl.lu/vuln/ssa-585531)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below.\n\nSiemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-585531: Multiple Vulnerabilities in SIDIS Secured SmartPlug before V7.26.0310 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html"
},
{
"category": "self",
"summary": "SSA-585531: Multiple Vulnerabilities in SIDIS Secured SmartPlug before V7.26.0310 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-585531.json"
}
],
"title": "SSA-585531: Multiple Vulnerabilities in SIDIS Secured SmartPlug before V7.26.0310",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-585531",
"initial_release_date": "2026-07-14T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<7.26.0310",
"product": {
"name": "SIDIS Secured SmartPlug < V7.26.0310",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SIDIS Secured SmartPlug"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-23303",
"cwe": {
"id": "CWE-924",
"name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel"
},
"notes": [
{
"category": "description",
"text": "The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-23303"
},
{
"cve": "CVE-2022-23304",
"cwe": {
"id": "CWE-924",
"name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel"
},
"notes": [
{
"category": "description",
"text": "The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-23304"
},
{
"cve": "CVE-2022-37660",
"cwe": {
"id": "CWE-323",
"name": "Reusing a Nonce, Key Pair in Encryption"
},
"notes": [
{
"category": "description",
"text": "In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-37660"
},
{
"cve": "CVE-2022-48174",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-48174"
},
{
"cve": "CVE-2025-5222",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
},
"notes": [
{
"category": "description",
"text": "A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-5222"
},
{
"cve": "CVE-2025-5914",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-5914"
},
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-9230"
},
{
"cve": "CVE-2025-9231",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"notes": [
{
"category": "description",
"text": "Issue summary: A timing side-channel which could potentially allow remote\nrecovery of the private key exists in the SM2 algorithm implementation on 64 bit\nARM platforms.\n\nImpact summary: A timing side-channel in SM2 signature computations on 64 bit\nARM platforms could allow recovering the private key by an attacker..\n\nWhile remote key recovery over a network was not attempted by the reporter,\ntiming measurements revealed a timing signal which may allow such an attack.\n\nOpenSSL does not directly support certificates with SM2 keys in TLS, and so\nthis CVE is not relevant in most TLS contexts. However, given that it is\npossible to add support for such certificates via a custom provider, coupled\nwith the fact that in such a custom provider context the private key may be\nrecoverable via remote timing measurements, we consider this to be a Moderate\nseverity issue.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as SM2 is not an approved algorithm.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-9231"
},
{
"cve": "CVE-2025-9232",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-9232"
},
{
"cve": "CVE-2025-26465",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"notes": [
{
"category": "description",
"text": "A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-26465"
},
{
"cve": "CVE-2025-32462",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "description",
"text": "Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-32462"
},
{
"cve": "CVE-2026-5121",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.26.0310 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-5121"
}
]
}
```
## [ssa-555707](https://vulnerability.circl.lu/vuln/ssa-555707)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Simcenter STAR-CCM+ contains an information disclosure vulnerability when using the Power-on-Demand public license server. An attacker could access a system's host, user, and display name.\n\nSiemens has updated the public Power-on-Demand public license server.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-555707: Information Disclosure Vulnerability in Simcenter STAR-CCM+ - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-555707.html"
},
{
"category": "self",
"summary": "SSA-555707: Information Disclosure Vulnerability in Simcenter STAR-CCM+ - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-555707.json"
}
],
"title": "SSA-555707: Information Disclosure Vulnerability in Simcenter STAR-CCM+",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-555707",
"initial_release_date": "2022-08-09T00:00:00.000Z",
"revision_history": [
{
"date": "2022-08-09T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added fix for Simcenter STAR-CCM+"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Simcenter STAR-CCM+ only if the Power-on-Demand public license server is used",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "Simcenter STAR-CCM+"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-34659",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "description",
"text": "Affected applications expose user, host and display name of users, when the public license server is used. This could allow an attacker to retrieve this information.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Avoid using sensitive or personal data in user, host and display names",
"product_ids": [
"1"
]
},
{
"category": "mitigation",
"details": "Set the environmental variable STARLICENSEHIDE to 1. This will send the string \"unknown\" for the user, host and display name instead of the real values. The setting is supported since version V8.04 (June 2013) of Simcenter STAR-CCM+",
"product_ids": [
"1"
]
},
{
"category": "vendor_fix",
"details": "Vulnerability fixed with update of Power-on-Demand public license server on 2026-06-24; no user actions necessary",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-34659"
}
]
}
```
## [ssa-470355](https://vulnerability.circl.lu/vuln/ssa-470355)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "CADRA is affected by multiple zlib and Foxit vulnerabilities.\n\nSiemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-470355: Zlib and Foxit Vulnerabilities in CADRA - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html"
},
{
"category": "self",
"summary": "SSA-470355: Zlib and Foxit Vulnerabilities in CADRA - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-470355.json"
}
],
"title": "SSA-470355: Zlib and Foxit Vulnerabilities in CADRA",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-470355",
"initial_release_date": "2026-07-14T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2511",
"product": {
"name": "CADRA < V2511",
"product_id": "1"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "CADRA",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "CADRA"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2005-2096",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2511 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2005-2096"
},
{
"cve": "CVE-2016-9840",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2511 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2016-9840"
},
{
"cve": "CVE-2016-9841",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2511 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2016-9841"
},
{
"cve": "CVE-2016-9842",
"cwe": {
"id": "CWE-1335",
"name": "Incorrect Bitwise Shift of Integer"
},
"notes": [
{
"category": "description",
"text": "The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2511 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2016-9842"
},
{
"cve": "CVE-2017-14919",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2511 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"1"
]
}
],
"title": "CVE-2017-14919"
},
{
"cve": "CVE-2018-25032",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2511 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2018-25032"
},
{
"cve": "CVE-2022-37434",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
},
"notes": [
{
"category": "description",
"text": "zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2511 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-37434"
},
{
"cve": "CVE-2023-45853",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2511 or later version",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-45853"
},
{
"cve": "CVE-2025-10585",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type ('Type Confusion')"
},
"notes": [
{
"category": "description",
"text": "Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Block access to untrusted or external web content from sensitive systems",
"product_ids": [
"2"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2025-10585"
},
{
"cve": "CVE-2025-13223",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type ('Type Confusion')"
},
"notes": [
{
"category": "description",
"text": "Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Block access to untrusted or external web content from sensitive systems",
"product_ids": [
"2"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2025-13223"
},
{
"cve": "CVE-2026-22184",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 0.0,
"baseSeverity": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2026-22184"
}
]
}
```
## [ssa-288252](https://vulnerability.circl.lu/vuln/ssa-288252)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-288252: Unquoted Search Path Vulnerability in IAM Client - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-288252.html"
},
{
"category": "self",
"summary": "SSA-288252: Unquoted Search Path Vulnerability in IAM Client - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-288252.json"
}
],
"title": "SSA-288252: Unquoted Search Path Vulnerability in IAM Client",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-288252",
"initial_release_date": "2026-07-14T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.4.5.0.2",
"product": {
"name": "COMOS V10.4.5 < V10.4.5.0.2",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "COMOS V10.4.5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.6.1",
"product": {
"name": "COMOS V10.6 < V10.6.1",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "COMOS V10.6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2512.7000",
"product": {
"name": "Designcenter NX < V2512.7000",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "Designcenter NX"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2512.7000",
"product": {
"name": "Simcenter 3D < V2512.7000",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "Simcenter 3D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2506.0003",
"product": {
"name": "Simcenter Femap V2506 < V2506.0003",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "Simcenter Femap V2506"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2512.0002",
"product": {
"name": "Simcenter Femap V2512 < V2512.0002",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "Simcenter Femap V2512"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2606",
"product": {
"name": "Simcenter Nastran < V2606",
"product_id": "7"
}
}
],
"category": "product_name",
"name": "Simcenter Nastran"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2606",
"product": {
"name": "Simcenter STAR-CCM+ < V2606",
"product_id": "8"
}
}
],
"category": "product_name",
"name": "Simcenter STAR-CCM+"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<225.0.13.3",
"product": {
"name": "Solid Edge SE2025 < V225.0.13.3",
"product_id": "9"
}
}
],
"category": "product_name",
"name": "Solid Edge SE2025"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<226.0.04.003",
"product": {
"name": "Solid Edge SE2026 < V226.0.04.003",
"product_id": "10"
}
}
],
"category": "product_name",
"name": "Solid Edge SE2026"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2412.0012",
"product": {
"name": "Teamcenter Visualization V2412 < V2412.0012",
"product_id": "11"
}
}
],
"category": "product_name",
"name": "Teamcenter Visualization V2412"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2506.0009",
"product": {
"name": "Teamcenter Visualization V2506 < V2506.0009",
"product_id": "12"
}
}
],
"category": "product_name",
"name": "Teamcenter Visualization V2506"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2512.2605",
"product": {
"name": "Teamcenter Visualization V2512 < V2512.2605",
"product_id": "13"
}
}
],
"category": "product_name",
"name": "Teamcenter Visualization V2512"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2404.0022",
"product": {
"name": "Tecnomatix Plant Simulation V2404 < V2404.0022",
"product_id": "14"
}
}
],
"category": "product_name",
"name": "Tecnomatix Plant Simulation V2404"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2504.0010",
"product": {
"name": "Tecnomatix Plant Simulation V2504 < V2504.0010",
"product_id": "15"
}
}
],
"category": "product_name",
"name": "Tecnomatix Plant Simulation V2504"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2606",
"product": {
"name": "Tecnomatix Process Simulate < V2606",
"product_id": "16"
}
}
],
"category": "product_name",
"name": "Tecnomatix Process Simulate"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-40945",
"cwe": {
"id": "CWE-426",
"name": "Untrusted Search Path"
},
"notes": [
{
"category": "description",
"text": "Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V10.6.1 or later version",
"product_ids": [
"2"
],
"url": "https://support.sw.siemens.com/product/222981661/"
},
{
"category": "vendor_fix",
"details": "Update to V225.0 Update 13 or later version",
"product_ids": [
"9"
],
"url": "https://support.sw.siemens.com/product/246738425/"
},
{
"category": "vendor_fix",
"details": "Update to V226.0 Update 04 or later version",
"product_ids": [
"10"
],
"url": "https://support.sw.siemens.com/product/246738425/"
},
{
"category": "vendor_fix",
"details": "Update to V2404.0022 or later version",
"product_ids": [
"14"
],
"url": "https://support.sw.siemens.com/product/297028302/"
},
{
"category": "vendor_fix",
"details": "Update to V2412.0012 or later version",
"product_ids": [
"11"
],
"url": "https://support.sw.siemens.com/product/229029598/"
},
{
"category": "vendor_fix",
"details": "Update to V2504.0010 or later version",
"product_ids": [
"15"
],
"url": "https://support.sw.siemens.com/product/297028302/"
},
{
"category": "vendor_fix",
"details": "Update to V2506.0003 or later version",
"product_ids": [
"5"
],
"url": "https://support.sw.siemens.com/product/275652363/"
},
{
"category": "vendor_fix",
"details": "Update to V2506.0009 or later version",
"product_ids": [
"12"
],
"url": "https://support.sw.siemens.com/product/229029598/"
},
{
"category": "vendor_fix",
"details": "Update to V2512.0002 or later version",
"product_ids": [
"6"
],
"url": "https://support.sw.siemens.com/product/275652363/"
},
{
"category": "vendor_fix",
"details": "Update to V2512.2605 or later version",
"product_ids": [
"13"
],
"url": "https://support.sw.siemens.com/product/229029598/"
},
{
"category": "vendor_fix",
"details": "Update to V2512.7000 or later version",
"product_ids": [
"3"
],
"url": "https://support.sw.siemens.com/product/209349590/"
},
{
"category": "vendor_fix",
"details": "Update to V2512.7000 or later version",
"product_ids": [
"4"
],
"url": "https://support.sw.siemens.com/product/289054037/"
},
{
"category": "vendor_fix",
"details": "Update to V2606 or later version",
"product_ids": [
"7",
"8",
"16"
],
"url": "https://support.sw.siemens.com/product/289054037/"
},
{
"category": "vendor_fix",
"details": "Update to V10.4.5.0.2 or later version. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16"
]
}
],
"title": "CVE-2025-40945"
}
]
}
```
## [ssa-096828](https://vulnerability.circl.lu/vuln/ssa-096828)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application.\n\nSiemens has released a new version for Opcenter X and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-096828: Token Invalidation Vulnerability in Opcenter X Before V2604 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-096828.html"
},
{
"category": "self",
"summary": "SSA-096828: Token Invalidation Vulnerability in Opcenter X Before V2604 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-096828.json"
}
],
"title": "SSA-096828: Token Invalidation Vulnerability in Opcenter X Before V2604",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-096828",
"initial_release_date": "2026-07-14T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2604",
"product": {
"name": "Opcenter X < V2604",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "Opcenter X"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56451",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"notes": [
{
"category": "description",
"text": "Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header.\r\nThis could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2604 or later version",
"product_ids": [
"1"
],
"url": "https://support.sw.siemens.com/product/206159703/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-56451"
}
]
}
```
## [ssa-082556](https://vulnerability.circl.lu/vuln/ssa-082556)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"category": "self",
"summary": "SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-082556.json"
}
],
"title": "SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5",
"tracking": {
"current_release_date": "2026-07-14T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-082556",
"initial_release_date": "2025-06-10T00:00:00.000Z",
"revision_history": [
{
"date": "2025-06-10T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2025-08-12T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added CVE-2025-6395, CVE-2025-32988, CVE-2025-32989, CVE-2025-32990"
},
{
"date": "2026-01-13T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added CVE-2025-66382, CVE-2025-39929, CVE-2025-39931, CVE-2025-39977, CVE-2025-40022, CVE-2025-11082, CVE-2025-11083, CVE-2025-11412, CVE-2025-11413, CVE-2025-11414, CVE-2025-11494, CVE-2025-11495, CVE-2025-11839, CVE-2025-11840, CVE-2025-9230, CVE-2025-9232, CVE-2025-3198, CVE-2025-5244, CVE-2025-5245, CVE-2025-7545, CVE-2025-7546, CVE-2025-8224, CVE-2025-7425, CVE-2025-59375"
},
{
"date": "2026-02-10T00:00:00.000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added 22 CVEs"
},
{
"date": "2026-03-10T00:00:00.000Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Added 36 CVEs"
},
{
"date": "2026-05-12T00:00:00.000Z",
"legacy_version": "1.5",
"number": "6",
"summary": "Added CVE-2026-31431"
},
{
"date": "2026-07-14T00:00:00.000Z",
"legacy_version": "1.6",
"number": "7",
"summary": "Added 167 CVEs; Added fix for CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-3904, CVE-2026-4046, CVE-2026-41080, CVE-2026-4437, CVE-2026-4438, CVE-2026-45186, CVE-2026-5435, CVE-2026-5450, CVE-2026-5928, CVE-2026-6238"
}
],
"status": "interim",
"version": "7"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5",
"product": {
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= V3.1.5",
"product_id": "1",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4AX00-1AB0"
]
}
}
},
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5|<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= V3.1.5 < V3.1.6",
"product_id": "2",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4AX00-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5",
"product": {
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= V3.1.5",
"product_id": "3",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4AX00-1AC0"
]
}
}
},
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5|<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= V3.1.5 < V3.1.6",
"product_id": "4",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4AX00-1AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5",
"product": {
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= V3.1.5",
"product_id": "5",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4FX00-1AB0"
]
}
}
},
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5|<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= V3.1.5 < V3.1.6",
"product_id": "6",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4FX00-1AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5",
"product": {
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= V3.1.5",
"product_id": "7",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4FX00-1AC0"
]
}
}
},
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5|<3.1.6",
"product": {
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= V3.1.5 < V3.1.6",
"product_id": "8",
"product_identification_helper": {
"model_numbers": [
"6ES7518-4FX00-1AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5",
"product": {
"name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= V3.1.5",
"product_id": "9",
"product_identification_helper": {
"model_numbers": [
"6AG1518-4AX00-4AC0"
]
}
}
},
{
"category": "product_version_range",
"name": "vers:intdot/>=3.1.5|<3.1.6",
"product": {
"name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= V3.1.5 < V3.1.6",
"product_id": "10",
"product_identification_helper": {
"model_numbers": [
"6AG1518-4AX00-4AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-41617",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "description",
"text": "sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2021-41617"
},
{
"cve": "CVE-2023-4527",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-4527"
},
{
"cve": "CVE-2023-4806",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-4806"
},
{
"cve": "CVE-2023-4911",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-4911"
},
{
"cve": "CVE-2023-5363",
"cwe": {
"id": "CWE-684",
"name": "Incorrect Provision of Specified Functionality"
},
"notes": [
{
"category": "description",
"text": "Issue summary: A bug has been identified in the processing of key and\ninitialisation vector (IV) lengths. This can lead to potential truncation\nor overruns during the initialisation of some symmetric ciphers.\n\nImpact summary: A truncation in the IV can result in non-uniqueness,\nwhich could result in loss of confidentiality for some cipher modes.\n\nWhen calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or\nEVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after\nthe key and IV have been established. Any alterations to the key length,\nvia the \"keylen\" parameter or the IV length, via the \"ivlen\" parameter,\nwithin the OSSL_PARAM array will not take effect as intended, potentially\ncausing truncation or overreading of these values. The following ciphers\nand cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.\n\nFor the CCM, GCM and OCB cipher modes, truncation of the IV can result in\nloss of confidentiality. For example, when following NIST's SP 800-38D\nsection 8.2.1 guidance for constructing a deterministic IV for AES in\nGCM mode, truncation of the counter portion could lead to IV reuse.\n\nBoth truncations and overruns of the key and overruns of the IV will\nproduce incorrect results and could, in some cases, trigger a memory\nexception. However, these issues are not currently assessed as security\ncritical.\n\nChanging the key and/or IV lengths is not considered to be a common operation\nand the vulnerable API was recently introduced. Furthermore it is likely that\napplication developers will have spotted this problem during testing since\ndecryption would fail unless both peers in the communication were similarly\nvulnerable. For these reasons we expect the probability of an application being\nvulnerable to this to be quite low. However if an application is vulnerable then\nthis issue is considered very serious. For these reasons we have assessed this\nissue as Moderate severity overall.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because\nthe issue lies outside of the FIPS provider boundary.\n\nOpenSSL 3.1 and 3.0 are vulnerable to this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-5363"
},
{
"cve": "CVE-2023-6246",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-6246"
},
{
"cve": "CVE-2023-6779",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc 2.37 and newer.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-6779"
},
{
"cve": "CVE-2023-6780",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "description",
"text": "An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-6780"
},
{
"cve": "CVE-2023-28531",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "description",
"text": "ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-28531"
},
{
"cve": "CVE-2023-38545",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-38545"
},
{
"cve": "CVE-2023-38546",
"cwe": {
"id": "CWE-73",
"name": "External Control of File Name or Path"
},
"notes": [
{
"category": "description",
"text": "This flaw allows an attacker to insert cookies at will into a running program\nusing libcurl, if the specific series of conditions are met.\n\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\nthat are the individual handles for single transfers.\n\nlibcurl provides a function call that duplicates en easy handle called\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\n\nIf a transfer has cookies enabled when the handle is duplicated, the\ncookie-enable state is also cloned - but without cloning the actual\ncookies. If the source handle did not read any cookies from a specific file on\ndisk, the cloned version of the handle would instead store the file name as\n`none` (using the four ASCII letters, no quotes).\n\nSubsequent use of the cloned handle that does not explicitly set a source to\nload cookies from would then inadvertently load cookies from a file named\n`none` - if such a file exists and is readable in the current directory of the\nprogram using libcurl. And if using the correct file format of course.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-38546"
},
{
"cve": "CVE-2023-44487",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "description",
"text": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-44487"
},
{
"cve": "CVE-2023-46218",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"notes": [
{
"category": "description",
"text": "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-46218"
},
{
"cve": "CVE-2023-46219",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "description",
"text": "When saving HSTS data to an excessively long file name, curl could end up\nremoving all contents, making subsequent requests using that file unaware of\nthe HSTS status they should otherwise use.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-46219"
},
{
"cve": "CVE-2023-48795",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"notes": [
{
"category": "description",
"text": "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-48795"
},
{
"cve": "CVE-2023-51384",
"cwe": {
"id": "CWE-304",
"name": "Missing Critical Step in Authentication"
},
"notes": [
{
"category": "description",
"text": "In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-51384"
},
{
"cve": "CVE-2023-51385",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
},
"notes": [
{
"category": "description",
"text": "In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-51385"
},
{
"cve": "CVE-2023-52927",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: allow exp not to be removed in nf_ct_find_expectation\n\nCurrently nf_conntrack_in() calling nf_ct_find_expectation() will\nremove the exp from the hash table. However, in some scenario, we\nexpect the exp not to be removed when the created ct will not be\nconfirmed, like in OVS and TC conntrack in the following patches.\n\nThis patch allows exp not to be removed by setting IPS_CONFIRMED\nin the status of the tmpl.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2023-52927"
},
{
"cve": "CVE-2024-2961",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-2961"
},
{
"cve": "CVE-2024-6119",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type ('Type Confusion')"
},
"notes": [
{
"category": "description",
"text": "Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain. So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-6119"
},
{
"cve": "CVE-2024-6387",
"cwe": {
"id": "CWE-364",
"name": "Signal Handler Race Condition"
},
"notes": [
{
"category": "description",
"text": "A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-6387"
},
{
"cve": "CVE-2024-12133",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "description",
"text": "A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-12133"
},
{
"cve": "CVE-2024-12243",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-12243"
},
{
"cve": "CVE-2024-24855",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "description",
"text": "A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-24855"
},
{
"cve": "CVE-2024-26596",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events\n\nAfter the blamed commit, we started doing this dereference for every\nNETDEV_CHANGEUPPER and NETDEV_PRECHANGEUPPER event in the system.\n\nstatic inline struct dsa_port *dsa_user_to_port(const struct net_device *dev)\n{\n\tstruct dsa_user_priv *p = netdev_priv(dev);\n\n\treturn p->dp;\n}\n\nWhich is obviously bogus, because not all net_devices have a netdev_priv()\nof type struct dsa_user_priv. But struct dsa_user_priv is fairly small,\nand p->dp means dereferencing 8 bytes starting with offset 16. Most\ndrivers allocate that much private memory anyway, making our access not\nfault, and we discard the bogus data quickly afterwards, so this wasn't\ncaught.\n\nBut the dummy interface is somewhat special in that it calls\nalloc_netdev() with a priv size of 0. So every netdev_priv() dereference\nis invalid, and we get this when we emit a NETDEV_PRECHANGEUPPER event\nwith a VLAN as its new upper:\n\n$ ip link add dummy1 type dummy\n$ ip link add link dummy1 name dummy1.100 type vlan id 100\n[ 43.309174] ==================================================================\n[ 43.316456] BUG: KASAN: slab-out-of-bounds in dsa_user_prechangeupper+0x30/0xe8\n[ 43.323835] Read of size 8 at addr ffff3f86481d2990 by task ip/374\n[ 43.330058]\n[ 43.342436] Call trace:\n[ 43.366542] dsa_user_prechangeupper+0x30/0xe8\n[ 43.371024] dsa_user_netdevice_event+0xb38/0xee8\n[ 43.375768] notifier_call_chain+0xa4/0x210\n[ 43.379985] raw_notifier_call_chain+0x24/0x38\n[ 43.384464] __netdev_upper_dev_link+0x3ec/0x5d8\n[ 43.389120] netdev_upper_dev_link+0x70/0xa8\n[ 43.393424] register_vlan_dev+0x1bc/0x310\n[ 43.397554] vlan_newlink+0x210/0x248\n[ 43.401247] rtnl_newlink+0x9fc/0xe30\n[ 43.404942] rtnetlink_rcv_msg+0x378/0x580\n\nAvoid the kernel oops by dereferencing after the type check, as customary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-26596"
},
{
"cve": "CVE-2024-28085",
"cwe": {
"id": "CWE-150",
"name": "Improper Neutralization of Escape, Meta, or Control Sequences"
},
"notes": [
{
"category": "description",
"text": "wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-28085"
},
{
"cve": "CVE-2024-33599",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow. This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-33599"
},
{
"cve": "CVE-2024-33600",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference. This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-33600"
},
{
"cve": "CVE-2024-33601",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "description",
"text": "nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients. The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-33601"
},
{
"cve": "CVE-2024-33602",
"cwe": {
"id": "CWE-466",
"name": "Return of Pointer Value Outside of Expected Range"
},
"notes": [
{
"category": "description",
"text": "nscd: netgroup cache assumes NSS callback uses in-buffer strings\n\nThe Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory\nwhen the NSS callback does not store all strings in the provided buffer.\nThe flaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-33602"
},
{
"cve": "CVE-2024-34397",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-34397"
},
{
"cve": "CVE-2024-37370",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "description",
"text": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-37370"
},
{
"cve": "CVE-2024-37371",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-37371"
},
{
"cve": "CVE-2024-45490",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-45490"
},
{
"cve": "CVE-2024-45491",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-45491"
},
{
"cve": "CVE-2024-45492",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-45492"
},
{
"cve": "CVE-2024-47736",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: handle overlapped pclusters out of crafted images properly\n\nsyzbot reported a task hang issue due to a deadlock case where it is\nwaiting for the folio lock of a cached folio that will be used for\ncache I/Os.\n\nAfter looking into the crafted fuzzed image, I found it's formed with\nseveral overlapped big pclusters as below:\n\n Ext: logical offset | length : physical offset | length\n 0: 0.. 16384 | 16384 : 151552.. 167936 | 16384\n 1: 16384.. 32768 | 16384 : 155648.. 172032 | 16384\n 2: 32768.. 49152 | 16384 : 537223168.. 537239552 | 16384\n...\n\nHere, extent 0/1 are physically overlapped although it's entirely\n_impossible_ for normal filesystem images generated by mkfs.\n\nFirst, managed folios containing compressed data will be marked as\nup-to-date and then unlocked immediately (unlike in-place folios) when\ncompressed I/Os are complete. If physical blocks are not submitted in\nthe incremental order, there should be separate BIOs to avoid dependency\nissues. However, the current code mis-arranges z_erofs_fill_bio_vec()\nand BIO submission which causes unexpected BIO waits.\n\nSecond, managed folios will be connected to their own pclusters for\nefficient inter-queries. However, this is somewhat hard to implement\neasily if overlapped big pclusters exist. Again, these only appear in\nfuzzed images so let's simply fall back to temporary short-lived pages\nfor correctness.\n\nAdditionally, it justifies that referenced managed folios cannot be\ntruncated for now and reverts part of commit 2080ca1ed3e4 (\"erofs: tidy\nup `struct z_erofs_bvec`\") for simplicity although it shouldn't be any\ndifference.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-47736"
},
{
"cve": "CVE-2024-47809",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb->lkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-47809"
},
{
"cve": "CVE-2024-49998",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: improve shutdown sequence\n\nAlexander Sverdlin presents 2 problems during shutdown with the\nlan9303 driver. One is specific to lan9303 and the other just happens\nto reproduce there.\n\nThe first problem is that lan9303 is unique among DSA drivers in that it\ncalls dev_get_drvdata() at \"arbitrary runtime\" (not probe, not shutdown,\nnot remove):\n\nphy_state_machine()\n-> ...\n -> dsa_user_phy_read()\n -> ds->ops->phy_read()\n -> lan9303_phy_read()\n -> chip->ops->phy_read()\n -> lan9303_mdio_phy_read()\n -> dev_get_drvdata()\n\nBut we never stop the phy_state_machine(), so it may continue to run\nafter dsa_switch_shutdown(). Our common pattern in all DSA drivers is\nto set drvdata to NULL to suppress the remove() method that may come\nafterwards. But in this case it will result in an NPD.\n\nThe second problem is that the way in which we set\ndp->conduit->dsa_ptr = NULL; is concurrent with receive packet\nprocessing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL,\nbut afterwards, rather than continuing to use that non-NULL value,\ndev->dsa_ptr is dereferenced again and again without NULL checks:\ndsa_conduit_find_user() and many other places. In between dereferences,\nthere is no locking to ensure that what was valid once continues to be\nvalid.\n\nBoth problems have the common aspect that closing the conduit interface\nsolves them.\n\nIn the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN\nevent in dsa_user_netdevice_event() which closes user ports as well.\ndsa_port_disable_rt() calls phylink_stop(), which synchronously stops\nthe phylink state machine, and ds->ops->phy_read() will thus no longer\ncall into the driver after this point.\n\nIn the second case, dev_close(conduit) should do this, as per\nDocumentation/networking/driver.rst:\n\n| Quiescence\n| ----------\n|\n| After the ndo_stop routine has been called, the hardware must\n| not receive or transmit any data. All in flight packets must\n| be aborted. If necessary, poll or wait for completion of\n| any reset commands.\n\nSo it should be sufficient to ensure that later, when we zeroize\nconduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call\non this conduit.\n\nThe addition of the netif_device_detach() function is to ensure that\nioctls, rtnetlinks and ethtool requests on the user ports no longer\npropagate down to the driver - we're no longer prepared to handle them.\n\nThe race condition actually did not exist when commit 0650bf52b31f\n(\"net: dsa: be compatible with masters which unregister on shutdown\")\nfirst introduced dsa_switch_shutdown(). It was created later, when we\nstopped unregistering the user interfaces from a bad spot, and we just\nreplaced that sequence with a racy zeroization of conduit->dsa_ptr\n(one which doesn't ensure that the interfaces aren't up).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-49998"
},
{
"cve": "CVE-2024-50246",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add rough attr alloc_size check",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-50246"
},
{
"cve": "CVE-2024-50298",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: allocate vf_state during PF probes\n\nIn the previous implementation, vf_state is allocated memory only when VF\nis enabled. However, net_device_ops::ndo_set_vf_mac() may be called before\nVF is enabled to configure the MAC address of VF. If this is the case,\nenetc_pf_set_vf_mac() will access vf_state, resulting in access to a null\npointer. The simplified error log is as follows.\n\nroot@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89\n[ 173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004\n[ 173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy\n[ 173.641973] lr : do_setlink+0x4a8/0xec8\n[ 173.732292] Call trace:\n[ 173.734740] enetc_pf_set_vf_mac+0x3c/0x80\n[ 173.738847] __rtnl_newlink+0x530/0x89c\n[ 173.742692] rtnl_newlink+0x50/0x7c\n[ 173.746189] rtnetlink_rcv_msg+0x128/0x390\n[ 173.750298] netlink_rcv_skb+0x60/0x130\n[ 173.754145] rtnetlink_rcv+0x18/0x24\n[ 173.757731] netlink_unicast+0x318/0x380\n[ 173.761665] netlink_sendmsg+0x17c/0x3c8",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-50298"
},
{
"cve": "CVE-2024-53166",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix bfqq uaf in bfq_limit_depth()\n\nSet new allocated bfqq to bic or remove freed bfqq from bic are both\nprotected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq\nfrom bic without the lock, this can lead to UAF if the io_context is\nshared by multiple tasks.\n\nFor example, test bfq with io_uring can trigger following UAF in v6.6:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50\n\nCall Trace:\n \n dump_stack_lvl+0x47/0x80\n print_address_description.constprop.0+0x66/0x300\n print_report+0x3e/0x70\n kasan_report+0xb4/0xf0\n bfqq_group+0x15/0x50\n bfqq_request_over_limit+0x130/0x9a0\n bfq_limit_depth+0x1b5/0x480\n __blk_mq_alloc_requests+0x2b5/0xa00\n blk_mq_get_new_requests+0x11d/0x1d0\n blk_mq_submit_bio+0x286/0xb00\n submit_bio_noacct_nocheck+0x331/0x400\n __block_write_full_folio+0x3d0/0x640\n writepage_cb+0x3b/0xc0\n write_cache_pages+0x254/0x6c0\n write_cache_pages+0x254/0x6c0\n do_writepages+0x192/0x310\n filemap_fdatawrite_wbc+0x95/0xc0\n __filemap_fdatawrite_range+0x99/0xd0\n filemap_write_and_wait_range.part.0+0x4d/0xa0\n blkdev_read_iter+0xef/0x1e0\n io_read+0x1b6/0x8a0\n io_issue_sqe+0x87/0x300\n io_wq_submit_work+0xeb/0x390\n io_worker_handle_work+0x24d/0x550\n io_wq_worker+0x27f/0x6c0\n ret_from_fork_asm+0x1b/0x30\n \n\nAllocated by task 808602:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n __kasan_slab_alloc+0x83/0x90\n kmem_cache_alloc_node+0x1b1/0x6d0\n bfq_get_queue+0x138/0xfa0\n bfq_get_bfqq_handle_split+0xe3/0x2c0\n bfq_init_rq+0x196/0xbb0\n bfq_insert_request.isra.0+0xb5/0x480\n bfq_insert_requests+0x156/0x180\n blk_mq_insert_request+0x15d/0x440\n blk_mq_submit_bio+0x8a4/0xb00\n submit_bio_noacct_nocheck+0x331/0x400\n __blkdev_direct_IO_async+0x2dd/0x330\n blkdev_write_iter+0x39a/0x450\n io_write+0x22a/0x840\n io_issue_sqe+0x87/0x300\n io_wq_submit_work+0xeb/0x390\n io_worker_handle_work+0x24d/0x550\n io_wq_worker+0x27f/0x6c0\n ret_from_fork+0x2d/0x50\n ret_from_fork_asm+0x1b/0x30\n\nFreed by task 808589:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n kasan_save_free_info+0x27/0x40\n __kasan_slab_free+0x126/0x1b0\n kmem_cache_free+0x10c/0x750\n bfq_put_queue+0x2dd/0x770\n __bfq_insert_request.isra.0+0x155/0x7a0\n bfq_insert_request.isra.0+0x122/0x480\n bfq_insert_requests+0x156/0x180\n blk_mq_dispatch_plug_list+0x528/0x7e0\n blk_mq_flush_plug_list.part.0+0xe5/0x590\n __blk_flush_plug+0x3b/0x90\n blk_finish_plug+0x40/0x60\n do_writepages+0x19d/0x310\n filemap_fdatawrite_wbc+0x95/0xc0\n __filemap_fdatawrite_range+0x99/0xd0\n filemap_write_and_wait_range.part.0+0x4d/0xa0\n blkdev_read_iter+0xef/0x1e0\n io_read+0x1b6/0x8a0\n io_issue_sqe+0x87/0x300\n io_wq_submit_work+0xeb/0x390\n io_worker_handle_work+0x24d/0x550\n io_wq_worker+0x27f/0x6c0\n ret_from_fork+0x2d/0x50\n ret_from_fork_asm+0x1b/0x30\n\nFix the problem by protecting bic_to_bfqq() with bfqd->lock.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-53166"
},
{
"cve": "CVE-2024-56719",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TSO DMA API usage causing oops\n\nCommit 66600fac7a98 (\"net: stmmac: TSO: Fix unbalanced DMA map/unmap\nfor non-paged SKB data\") moved the assignment of tx_skbuff_dma[]'s\nmembers to be later in stmmac_tso_xmit().\n\nThe buf (dma cookie) and len stored in this structure are passed to\ndma_unmap_single() by stmmac_tx_clean(). The DMA API requires that\nthe dma cookie passed to dma_unmap_single() is the same as the value\nreturned from dma_map_single(). However, by moving the assignment\nlater, this is not the case when priv->dma_cap.addr64 > 32 as \"des\"\nis offset by proto_hdr_len.\n\nThis causes problems such as:\n\n dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed\n\nand with DMA_API_DEBUG enabled:\n\n DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes]\n\nFix this by maintaining \"des\" as the original DMA cookie, and use\ntso_des to pass the offset DMA cookie to stmmac_tso_allocator().\n\nFull details of the crashes can be found at:\nhttps://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/\nhttps://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-56719"
},
{
"cve": "CVE-2024-57924",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: relax assertions on failure to encode file handles\n\nEncoding file handles is usually performed by a filesystem >encode_fh()\nmethod that may fail for various reasons.\n\nThe legacy users of exportfs_encode_fh(), namely, nfsd and\nname_to_handle_at(2) syscall are ready to cope with the possibility\nof failure to encode a file handle.\n\nThere are a few other users of exportfs_encode_{fh,fid}() that\ncurrently have a WARN_ON() assertion when ->encode_fh() fails.\nRelax those assertions because they are wrong.\n\nThe second linked bug report states commit 16aac5ad1fa9 (\"ovl: support\nencoding non-decodable file handles\") in v6.6 as the regressing commit,\nbut this is not accurate.\n\nThe aforementioned commit only increases the chances of the assertion\nand allows triggering the assertion with the reproducer using overlayfs,\ninotify and drop_caches.\n\nTriggering this assertion was always possible with other filesystems and\nother reasons of ->encode_fh() failures and more particularly, it was\nalso possible with the exact same reproducer using overlayfs that is\nmounted with options index=on,nfs_export=on also on kernels < v6.6.\nTherefore, I am not listing the aforementioned commit as a Fixes commit.\n\nBackport hint: this patch will have a trivial conflict applying to\nv6.6.y, and other trivial conflicts applying to stable kernels < v6.6.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-57924"
},
{
"cve": "CVE-2024-57977",
"cwe": {
"id": "CWE-667",
"name": "Improper Locking"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: fix soft lockup in the OOM process\n\nA soft lockup issue was found in the product with about 56,000 tasks were\nin the OOM cgroup, it was traversing them when the soft lockup was\ntriggered.\n\nwatchdog: BUG: soft lockup - CPU#2 stuck for 23s! [VM Thread:1503066]\nCPU: 2 PID: 1503066 Comm: VM Thread Kdump: loaded Tainted: G\nHardware name: Huawei Cloud OpenStack Nova, BIOS\nRIP: 0010:console_unlock+0x343/0x540\nRSP: 0000:ffffb751447db9a0 EFLAGS: 00000247 ORIG_RAX: ffffffffffffff13\nRAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000ffffffff\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000247\nRBP: ffffffffafc71f90 R08: 0000000000000000 R09: 0000000000000040\nR10: 0000000000000080 R11: 0000000000000000 R12: ffffffffafc74bd0\nR13: ffffffffaf60a220 R14: 0000000000000247 R15: 0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f2fe6ad91f0 CR3: 00000004b2076003 CR4: 0000000000360ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n vprintk_emit+0x193/0x280\n printk+0x52/0x6e\n dump_task+0x114/0x130\n mem_cgroup_scan_tasks+0x76/0x100\n dump_header+0x1fe/0x210\n oom_kill_process+0xd1/0x100\n out_of_memory+0x125/0x570\n mem_cgroup_out_of_memory+0xb5/0xd0\n try_charge+0x720/0x770\n mem_cgroup_try_charge+0x86/0x180\n mem_cgroup_try_charge_delay+0x1c/0x40\n do_anonymous_page+0xb5/0x390\n handle_mm_fault+0xc4/0x1f0\n\nThis is because thousands of processes are in the OOM cgroup, it takes a\nlong time to traverse all of them. As a result, this lead to soft lockup\nin the OOM process.\n\nTo fix this issue, call 'cond_resched' in the 'mem_cgroup_scan_tasks'\nfunction per 1000 iterations. For global OOM, call\n'touch_softlockup_watchdog' per 1000 iterations to avoid this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-57977"
},
{
"cve": "CVE-2024-57996",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: don't allow 1 packet limit\n\nThe current implementation does not work correctly with a limit of\n1. iproute2 actually checks for this and this patch adds the check in\nkernel as well.\n\nThis fixes the following syzkaller reported crash:\n\nUBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6\nindex 65535 is out of range for type 'struct sfq_head[128]'\nCPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n __dump_stack lib/dump_stack.c:79 [inline]\n dump_stack+0x125/0x19f lib/dump_stack.c:120\n ubsan_epilogue lib/ubsan.c:148 [inline]\n __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347\n sfq_link net/sched/sch_sfq.c:210 [inline]\n sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238\n sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500\n sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525\n qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026\n tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319\n qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026\n dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296\n netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline]\n dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362\n __dev_close_many+0x214/0x350 net/core/dev.c:1468\n dev_close_many+0x207/0x510 net/core/dev.c:1506\n unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738\n unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695\n unregister_netdevice include/linux/netdevice.h:2893 [inline]\n __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689\n tun_detach drivers/net/tun.c:705 [inline]\n tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640\n __fput+0x203/0x840 fs/file_table.c:280\n task_work_run+0x129/0x1b0 kernel/task_work.c:185\n exit_task_work include/linux/task_work.h:33 [inline]\n do_exit+0x5ce/0x2200 kernel/exit.c:931\n do_group_exit+0x144/0x310 kernel/exit.c:1046\n __do_sys_exit_group kernel/exit.c:1057 [inline]\n __se_sys_exit_group kernel/exit.c:1055 [inline]\n __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055\n do_syscall_64+0x6c/0xd0\n entry_SYSCALL_64_after_hwframe+0x61/0xcb\nRIP: 0033:0x7fe5e7b52479\nCode: Unable to access opcode bytes at RIP 0x7fe5e7b5244f.\nRSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479\nRDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000\nRBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0\nR13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270\n\nThe crash can be also be reproduced with the following (with a tc\nrecompiled to allow for sfq limits of 1):\n\ntc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s\n../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1\nifconfig dummy0 up\nping -I dummy0 -f -c2 -W0.1 8.8.8.8\nsleep 1\n\nScenario that triggers the crash:\n\n* the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1\n\n* TBF dequeues: it peeks from SFQ which moves the packet to the\n gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so\n it schedules itself for later.\n\n* the second packet is sent and TBF tries to queues it to SFQ. qdisc\n qlen is now 2 and because the SFQ limit is 1 the packet is dropped\n by SFQ. At this point qlen is 1, and all of the SFQ slots are empty,\n however q->tail is not NULL.\n\nAt this point, assuming no more packets are queued, when sch_dequeue\nruns again it will decrement the qlen for the current empty slot\ncausing an underflow and the subsequent out of bounds access.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-57996"
},
{
"cve": "CVE-2024-58005",
"cwe": {
"id": "CWE-99",
"name": "Improper Control of Resource Identifiers ('Resource Injection')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Change to kvalloc() in eventlog/acpi.c\n\nThe following failure was reported on HPE ProLiant D320:\n\n[ 10.693310][ T1] tpm_tis STM0925:00: 2.0 TPM (device-id 0x3, rev-id 0)\n[ 10.848132][ T1] ------------[ cut here ]------------\n[ 10.853559][ T1] WARNING: CPU: 59 PID: 1 at mm/page_alloc.c:4727 __alloc_pages_noprof+0x2ca/0x330\n[ 10.862827][ T1] Modules linked in:\n[ 10.866671][ T1] CPU: 59 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-lp155.2.g52785e2-default #1 openSUSE Tumbleweed (unreleased) 588cd98293a7c9eba9013378d807364c088c9375\n[ 10.882741][ T1] Hardware name: HPE ProLiant DL320 Gen12/ProLiant DL320 Gen12, BIOS 1.20 10/28/2024\n[ 10.892170][ T1] RIP: 0010:__alloc_pages_noprof+0x2ca/0x330\n[ 10.898103][ T1] Code: 24 08 e9 4a fe ff ff e8 34 36 fa ff e9 88 fe ff ff 83 fe 0a 0f 86 b3 fd ff ff 80 3d 01 e7 ce 01 00 75 09 c6 05 f8 e6 ce 01 01 <0f> 0b 45 31 ff e9 e5 fe ff ff f7 c2 00 00 08 00 75 42 89 d9 80 e1\n[ 10.917750][ T1] RSP: 0000:ffffb7cf40077980 EFLAGS: 00010246\n[ 10.923777][ T1] RAX: 0000000000000000 RBX: 0000000000040cc0 RCX: 0000000000000000\n[ 10.931727][ T1] RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000040cc0\n\nThe above transcript shows that ACPI pointed a 16 MiB buffer for the log\nevents because RSI maps to the 'order' parameter of __alloc_pages_noprof().\nAddress the bug by moving from devm_kmalloc() to devm_add_action() and\nkvmalloc() and devm_add_action().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2024-58005"
},
{
"cve": "CVE-2025-3198",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-3198"
},
{
"cve": "CVE-2025-4373",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite ('Buffer Underflow')"
},
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-4373"
},
{
"cve": "CVE-2025-4598",
"cwe": {
"id": "CWE-364",
"name": "Signal Handler Race Condition"
},
"notes": [
{
"category": "description",
"text": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-4598"
},
{
"cve": "CVE-2025-5244",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-5244"
},
{
"cve": "CVE-2025-5245",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-5245"
},
{
"cve": "CVE-2025-6395",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-6395"
},
{
"cve": "CVE-2025-7425",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-7425"
},
{
"cve": "CVE-2025-7545",
"cwe": {
"id": "CWE-116",
"name": "Improper Encoding or Escaping of Output"
},
"notes": [
{
"category": "description",
"text": "A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-7545"
},
{
"cve": "CVE-2025-7546",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-7546"
},
{
"cve": "CVE-2025-8224",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is db856d41004301b3a56438efd957ef5cabb91530. It is recommended to apply a patch to fix this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-8224"
},
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-9230"
},
{
"cve": "CVE-2025-9232",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-9232"
},
{
"cve": "CVE-2025-11082",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with \"[f]ixed for 2.46\".",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11082"
},
{
"cve": "CVE-2025-11083",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with \"[f]ixed for 2.46\".",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11083"
},
{
"cve": "CVE-2025-11412",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11412"
},
{
"cve": "CVE-2025-11413",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11413"
},
{
"cve": "CVE-2025-11414",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name: aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11414"
},
{
"cve": "CVE-2025-11494",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11494"
},
{
"cve": "CVE-2025-11495",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11495"
},
{
"cve": "CVE-2025-11839",
"cwe": {
"id": "CWE-252",
"name": "Unchecked Return Value"
},
"notes": [
{
"category": "description",
"text": "A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be exploited.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11839"
},
{
"cve": "CVE-2025-11840",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-11840"
},
{
"cve": "CVE-2025-21676",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fec: handle page_pool_dev_alloc_pages error\n\nThe fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did\nnot handle the case when it returned NULL. There was a WARN_ON(!new_page)\nbut it would still proceed to use the NULL pointer and then crash.\n\nThis case does seem somewhat rare but when the system is under memory\npressure it can happen. One case where I can duplicate this with some\nfrequency is when writing over a smbd share to a SATA HDD attached to an\nimx6q.\n\nSetting /proc/sys/vm/min_free_kbytes to higher values also seems to solve\nthe problem for my test case. But it still seems wrong that the fec driver\nignores the memory allocation error and can crash.\n\nThis commit handles the allocation error by dropping the current packet.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21676"
},
{
"cve": "CVE-2025-21682",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\n\nRecalculate features when XDP is detached.\n\nBefore:\n # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n # ip li set dev eth0 xdp off\n # ethtool -k eth0 | grep gro\n rx-gro-hw: off [requested on]\n\nAfter:\n # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n # ip li set dev eth0 xdp off\n # ethtool -k eth0 | grep gro\n rx-gro-hw: on\n\nThe fact that HW-GRO doesn't get re-enabled automatically is just\na minor annoyance. The real issue is that the features will randomly\ncome back during another reconfiguration which just happens to invoke\nnetdev_update_features(). The driver doesn't handle reconfiguring\ntwo things at a time very robustly.\n\nStarting with commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") we only reconfigure the RSS hash table\nif the \"effective\" number of Rx rings has changed. If HW-GRO is\nenabled \"effective\" number of rings is 2x what user sees.\nSo if we are in the bad state, with HW-GRO re-enablement \"pending\"\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\nand the:\n\n if (old_rx_rings != bp->hw_resc.resv_rx_rings &&\n\ncondition in __bnxt_reserve_rings() will be false.\nThe RSS map won't get updated, and we'll crash with:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000168\n RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\n bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\n __bnxt_setup_vnic_p5+0x58/0x110\n bnxt_init_nic+0xb72/0xf50\n __bnxt_open_nic+0x40d/0xab0\n bnxt_open_nic+0x2b/0x60\n ethtool_set_channels+0x18c/0x1d0\n\nAs we try to access a freed ring.\n\nThe issue is present since XDP support was added, really, but\nprior to commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") it wasn't causing major issues.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21682"
},
{
"cve": "CVE-2025-21701",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: avoid race between device unregistration and ethnl ops\n\nThe following trace can be seen if a device is being unregistered while\nits number of channels are being modified.\n\n DEBUG_LOCKS_WARN_ON(lock->magic != lock)\n WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120\n CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771\n RIP: 0010:__mutex_lock+0xc8a/0x1120\n Call Trace:\n \n ethtool_check_max_channel+0x1ea/0x880\n ethnl_set_channels+0x3c3/0xb10\n ethnl_default_set_doit+0x306/0x650\n genl_family_rcv_msg_doit+0x1e3/0x2c0\n genl_rcv_msg+0x432/0x6f0\n netlink_rcv_skb+0x13d/0x3b0\n genl_rcv+0x28/0x40\n netlink_unicast+0x42e/0x720\n netlink_sendmsg+0x765/0xc20\n __sys_sendto+0x3ac/0x420\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0x95/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThis is because unregister_netdevice_many_notify might run before the\nrtnl lock section of ethnl operations, eg. set_channels in the above\nexample. In this example the rss lock would be destroyed by the device\nunregistration path before being used again, but in general running\nethnl operations while dismantle has started is not a good idea.\n\nFix this by denying any operation on devices being unregistered. A check\nwas already there in ethnl_ops_begin, but not wide enough.\n\nNote that the same issue cannot be seen on the ioctl version\n(__dev_ethtool) because the device reference is retrieved from within\nthe rtnl lock section there. Once dismantle started, the net device is\nunlisted and no reference will be found.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21701"
},
{
"cve": "CVE-2025-21702",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\npfifo_tail_enqueue: Drop new packet when sch->limit == 0\n\nExpected behaviour:\nIn case we reach scheduler's limit, pfifo_tail_enqueue() will drop a\npacket in scheduler's queue and decrease scheduler's qlen by one.\nThen, pfifo_tail_enqueue() enqueue new packet and increase\nscheduler's qlen by one. Finally, pfifo_tail_enqueue() return\n`NET_XMIT_CN` status code.\n\nWeird behaviour:\nIn case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a\nscheduler that has no packet, the 'drop a packet' step will do nothing.\nThis means the scheduler's qlen still has value equal 0.\nThen, we continue to enqueue new packet and increase scheduler's qlen by\none. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by\none and return `NET_XMIT_CN` status code.\n\nThe problem is:\nLet's say we have two qdiscs: Qdisc_A and Qdisc_B.\n - Qdisc_A's type must have '->graft()' function to create parent/child relationship.\n Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`.\n - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`.\n - Qdisc_B is configured to have `sch->limit == 0`.\n - Qdisc_A is configured to route the enqueued's packet to Qdisc_B.\n\nEnqueue packet through Qdisc_A will lead to:\n - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B)\n - Qdisc_B->q.qlen += 1\n - pfifo_tail_enqueue() return `NET_XMIT_CN`\n - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A.\n\nThe whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1.\nReplace 'hfsc' with other type (for example: 'drr') still lead to the same problem.\nThis violate the design where parent's qlen should equal to the sum of its childrens'qlen.\n\nBug impact: This issue can be used for user->kernel privilege escalation when it is reachable.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21702"
},
{
"cve": "CVE-2025-21712",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime\n\nAfter commit ec6bb299c7c3 (\"md/md-bitmap: add 'sync_size' into struct\nmd_bitmap_stats\"), following panic is reported:\n\nOops: general protection fault, probably for non-canonical address\nRIP: 0010:bitmap_get_stats+0x2b/0xa0\nCall Trace:\n \n md_seq_show+0x2d2/0x5b0\n seq_read_iter+0x2b9/0x470\n seq_read+0x12f/0x180\n proc_reg_read+0x57/0xb0\n vfs_read+0xf6/0x380\n ksys_read+0x6c/0xf0\n do_syscall_64+0x82/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRoot cause is that bitmap_get_stats() can be called at anytime if mddev\nis still there, even if bitmap is destroyed, or not fully initialized.\nDeferenceing bitmap in this case can crash the kernel. Meanwhile, the\nabove commit start to deferencing bitmap->storage, make the problem\neasier to trigger.\n\nFix the problem by protecting bitmap_get_stats() with bitmap_info.mutex.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21712"
},
{
"cve": "CVE-2025-21724",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()\n\nResolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index()\nwhere shifting the constant \"1\" (of type int) by bitmap->mapped.pgshift\n(an unsigned long value) could result in undefined behavior.\n\nThe constant \"1\" defaults to a 32-bit \"int\", and when \"pgshift\" exceeds\n31 (e.g., pgshift = 63) the shift operation overflows, as the result\ncannot be represented in a 32-bit type.\n\nTo resolve this, the constant is updated to \"1UL\", promoting it to an\nunsigned long type to match the operand's type.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21724"
},
{
"cve": "CVE-2025-21728",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Send signals asynchronously if !preemptible\n\nBPF programs can execute in all kinds of contexts and when a program\nrunning in a non-preemptible context uses the bpf_send_signal() kfunc,\nit will cause issues because this kfunc can sleep.\nChange `irqs_disabled()` to `!preemptible()`.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21728"
},
{
"cve": "CVE-2025-21745",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix class @block_class's subsystem refcount leakage\n\nblkcg_fill_root_iostats() iterates over @block_class's devices by\nclass_dev_iter_(init|next)(), but does not end iterating with\nclass_dev_iter_exit(), so causes the class's subsystem refcount leakage.\n\nFix by ending the iterating with class_dev_iter_exit().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21745"
},
{
"cve": "CVE-2025-21756",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Keep the binding until socket destruction\n\nPreserve sockets bindings; this includes both resulting from an explicit\nbind() and those implicitly bound through autobind during connect().\n\nPrevents socket unbinding during a transport reassignment, which fixes a\nuse-after-free:\n\n 1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)\n 2. transport->release() calls vsock_remove_bound() without checking if\n sk was bound and moved to bound list (refcnt=1)\n 3. vsock_bind() assumes sk is in unbound list and before\n __vsock_insert_bound(vsock_bound_sockets()) calls\n __vsock_remove_bound() which does:\n list_del_init(&vsk->bound_table); // nop\n sock_put(&vsk->sk); // refcnt=0\n\nBUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730\nRead of size 4 at addr ffff88816b46a74c by task a.out/2057\n dump_stack_lvl+0x68/0x90\n print_report+0x174/0x4f6\n kasan_report+0xb9/0x190\n __vsock_bind+0x62e/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nAllocated by task 2057:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n __kasan_slab_alloc+0x85/0x90\n kmem_cache_alloc_noprof+0x131/0x450\n sk_prot_alloc+0x5b/0x220\n sk_alloc+0x2c/0x870\n __vsock_create.constprop.0+0x2e/0xb60\n vsock_create+0xe4/0x420\n __sock_create+0x241/0x650\n __sys_socket+0xf2/0x1a0\n __x64_sys_socket+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 2057:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x60\n __kasan_slab_free+0x4b/0x70\n kmem_cache_free+0x1a1/0x590\n __sk_destruct+0x388/0x5a0\n __vsock_bind+0x5e1/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150\nRIP: 0010:refcount_warn_saturate+0xce/0x150\n __vsock_bind+0x66d/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150\nRIP: 0010:refcount_warn_saturate+0xee/0x150\n vsock_remove_bound+0x187/0x1e0\n __vsock_release+0x383/0x4a0\n vsock_release+0x90/0x120\n __sock_release+0xa3/0x250\n sock_close+0x14/0x20\n __fput+0x359/0xa80\n task_work_run+0x107/0x1d0\n do_exit+0x847/0x2560\n do_group_exit+0xb8/0x250\n __x64_sys_exit_group+0x3a/0x50\n x64_sys_call+0xfec/0x14f0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21756"
},
{
"cve": "CVE-2025-21758",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: add RCU protection to mld_newpack()\n\nmld_newpack() can be called without RTNL or RCU being held.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21758"
},
{
"cve": "CVE-2025-21765",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU protection in ip6_default_advmss()\n\nip6_default_advmss() needs rcu protection to make\nsure the net structure it reads does not disappear.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21765"
},
{
"cve": "CVE-2025-21766",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: use RCU protection in __ip_rt_update_pmtu()\n\n__ip_rt_update_pmtu() must use RCU protection to make\nsure the net structure it reads does not disappear.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21766"
},
{
"cve": "CVE-2025-21767",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context\n\nThe following bug report happened with a PREEMPT_RT kernel:\n\n BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog\n preempt_count: 1, expected: 0\n RCU nest depth: 0, expected: 0\n get_random_u32+0x4f/0x110\n clocksource_verify_choose_cpus+0xab/0x1a0\n clocksource_verify_percpu.part.0+0x6b/0x330\n clocksource_watchdog_kthread+0x193/0x1a0\n\nIt is due to the fact that clocksource_verify_choose_cpus() is invoked with\npreemption disabled. This function invokes get_random_u32() to obtain\nrandom numbers for choosing CPUs. The batched_entropy_32 local lock and/or\nthe base_crng.lock spinlock in driver/char/random.c will be acquired during\nthe call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot\nbe acquired in atomic context.\n\nFix this problem by using migrate_disable() to allow smp_processor_id() to\nbe reliably used without introducing atomic context. preempt_disable() is\nthen called after clocksource_verify_choose_cpus() but before the\nclocksource measurement is being run to avoid introducing unexpected\nlatency.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21767"
},
{
"cve": "CVE-2025-21795",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix hang in nfsd4_shutdown_callback\n\nIf nfs4_client is in courtesy state then there is no point to send\nthe callback. This causes nfsd4_shutdown_callback to hang since\ncl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP\nnotifies NFSD that the connection was dropped.\n\nThis patch modifies nfsd4_run_cb_work to skip the RPC call if\nnfs4_client is in courtesy state.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21795"
},
{
"cve": "CVE-2025-21796",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: clear acl_access/acl_default after releasing them\n\nIf getting acl_default fails, acl_access and acl_default will be released\nsimultaneously. However, acl_access will still retain a pointer pointing\nto the released posix_acl, which will trigger a WARNING in\nnfs3svc_release_getacl like this:\n\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 26 PID: 3199 at lib/refcount.c:28\nrefcount_warn_saturate+0xb5/0x170\nModules linked in:\nCPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted\n6.12.0-rc6-00079-g04ae226af01f-dirty #8\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xb5/0x170\nCode: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75\ne4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb\ncd 0f b6 1d 8a3\nRSP: 0018:ffffc90008637cd8 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380\nRBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56\nR10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001\nR13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0\nFS: 0000000000000000(0000) GS:ffff88871ed00000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n ? refcount_warn_saturate+0xb5/0x170\n ? __warn+0xa5/0x140\n ? refcount_warn_saturate+0xb5/0x170\n ? report_bug+0x1b1/0x1e0\n ? handle_bug+0x53/0xa0\n ? exc_invalid_op+0x17/0x40\n ? asm_exc_invalid_op+0x1a/0x20\n ? tick_nohz_tick_stopped+0x1e/0x40\n ? refcount_warn_saturate+0xb5/0x170\n ? refcount_warn_saturate+0xb5/0x170\n nfs3svc_release_getacl+0xc9/0xe0\n svc_process_common+0x5db/0xb60\n ? __pfx_svc_process_common+0x10/0x10\n ? __rcu_read_unlock+0x69/0xa0\n ? __pfx_nfsd_dispatch+0x10/0x10\n ? svc_xprt_received+0xa1/0x120\n ? xdr_init_decode+0x11d/0x190\n svc_process+0x2a7/0x330\n svc_handle_xprt+0x69d/0x940\n svc_recv+0x180/0x2d0\n nfsd+0x168/0x200\n ? __pfx_nfsd+0x10/0x10\n kthread+0x1a2/0x1e0\n ? kthread+0xf4/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x60\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \nKernel panic - not syncing: kernel: panic_on_warn set ...\n\nClear acl_access/acl_default after posix_acl_release is called to prevent\nUAF from being triggered.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21796"
},
{
"cve": "CVE-2025-21848",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfp: bpf: Add check for nfp_app_ctrl_msg_alloc()\n\nAdd check for the return value of nfp_app_ctrl_msg_alloc() in\nnfp_bpf_cmsg_alloc() to prevent null pointer dereference.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21848"
},
{
"cve": "CVE-2025-21862",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix incorrect initialization order\n\nSyzkaller reports the following bug:\n\nBUG: spinlock bad magic on CPU#1, syz-executor.0/7995\n lock: 0xffff88805303f3e0, .magic: 00000000, .owner: /-1, .owner_cpu: 0\nCPU: 1 PID: 7995 Comm: syz-executor.0 Tainted: G E 5.10.209+ #1\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x119/0x179 lib/dump_stack.c:118\n debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]\n do_raw_spin_lock+0x1f6/0x270 kernel/locking/spinlock_debug.c:112\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]\n _raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159\n reset_per_cpu_data+0xe6/0x240 [drop_monitor]\n net_dm_cmd_trace+0x43d/0x17a0 [drop_monitor]\n genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739\n genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800\n netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2497\n genl_rcv+0x29/0x40 net/netlink/genetlink.c:811\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec net/socket.c:651 [inline]\n __sock_sendmsg+0x157/0x190 net/socket.c:663\n ____sys_sendmsg+0x712/0x870 net/socket.c:2378\n ___sys_sendmsg+0xf8/0x170 net/socket.c:2432\n __sys_sendmsg+0xea/0x1b0 net/socket.c:2461\n do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x62/0xc7\nRIP: 0033:0x7f3f9815aee9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f3f972bf0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f3f9826d050 RCX: 00007f3f9815aee9\nRDX: 0000000020000000 RSI: 0000000020001300 RDI: 0000000000000007\nRBP: 00007f3f981b63bd R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f3f9826d050 R15: 00007ffe01ee6768\n\nIf drop_monitor is built as a kernel module, syzkaller may have time\nto send a netlink NET_DM_CMD_START message during the module loading.\nThis will call the net_dm_monitor_start() function that uses\na spinlock that has not yet been initialized.\n\nTo fix this, let's place resource initialization above the registration\nof a generic netlink family.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21862"
},
{
"cve": "CVE-2025-21864",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: drop secpath at the same time as we currently drop dst\n\nXiumei reported hitting the WARN in xfrm6_tunnel_net_exit while\nrunning tests that boil down to:\n - create a pair of netns\n - run a basic TCP test over ipcomp6\n - delete the pair of netns\n\nThe xfrm_state found on spi_byaddr was not deleted at the time we\ndelete the netns, because we still have a reference on it. This\nlingering reference comes from a secpath (which holds a ref on the\nxfrm_state), which is still attached to an skb. This skb is not\nleaked, it ends up on sk_receive_queue and then gets defer-free'd by\nskb_attempt_defer_free.\n\nThe problem happens when we defer freeing an skb (push it on one CPU's\ndefer_list), and don't flush that list before the netns is deleted. In\nthat case, we still have a reference on the xfrm_state that we don't\nexpect at this point.\n\nWe already drop the skb's dst in the TCP receive path when it's no\nlonger needed, so let's also drop the secpath. At this point,\ntcp_filter has already called into the LSM hooks that may require the\nsecpath, so it should not be needed anymore. However, in some of those\nplaces, the MPTCP extension has just been attached to the skb, so we\ncannot simply drop all extensions.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21864"
},
{
"cve": "CVE-2025-21865",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().\n\nBrad Spengler reported the list_del() corruption splat in\ngtp_net_exit_batch_rtnl(). [0]\n\nCommit eb28fd76c0a0 (\"gtp: Destroy device along with udp socket's netns\ndismantle.\") added the for_each_netdev() loop in gtp_net_exit_batch_rtnl()\nto destroy devices in each netns as done in geneve and ip tunnels.\n\nHowever, this could trigger ->dellink() twice for the same device during\n->exit_batch_rtnl().\n\nSay we have two netns A & B and gtp device B that resides in netns B but\nwhose UDP socket is in netns A.\n\n 1. cleanup_net() processes netns A and then B.\n\n 2. gtp_net_exit_batch_rtnl() finds the device B while iterating\n netns A's gn->gtp_dev_list and calls ->dellink().\n\n [ device B is not yet unlinked from netns B\n as unregister_netdevice_many() has not been called. ]\n\n 3. gtp_net_exit_batch_rtnl() finds the device B while iterating\n netns B's for_each_netdev() and calls ->dellink().\n\ngtp_dellink() cleans up the device's hash table, unlinks the dev from\ngn->gtp_dev_list, and calls unregister_netdevice_queue().\n\nBasically, calling gtp_dellink() multiple times is fine unless\nCONFIG_DEBUG_LIST is enabled.\n\nLet's remove for_each_netdev() in gtp_net_exit_batch_rtnl() and\ndelegate the destruction to default_device_exit_batch() as done\nin bareudp.\n\n[0]:\nlist_del corruption, ffff8880aaa62c00->next (autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]) is LIST_POISON1 (ffffffffffffff02) (prev is 0xffffffffffffff04)\nkernel BUG at lib/list_debug.c:58!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN\nCPU: 1 UID: 0 PID: 1804 Comm: kworker/u8:7 Tainted: G T 6.12.13-grsec-full-20250211091339 #1\nTainted: [T]=RANDSTRUCT\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nWorkqueue: netns cleanup_net\nRIP: 0010:[] __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58\nCode: c2 76 91 31 c0 e8 9f b1 f7 fc 0f 0b 4d 89 f0 48 c7 c1 02 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 e0 c2 76 91 31 c0 e8 7f b1 f7 fc <0f> 0b 4d 89 e8 48 c7 c1 04 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 60\nRSP: 0018:fffffe8040b4fbd0 EFLAGS: 00010283\nRAX: 00000000000000cc RBX: dffffc0000000000 RCX: ffffffff818c4054\nRDX: ffffffff84947381 RSI: ffffffff818d1512 RDI: 0000000000000000\nRBP: ffff8880aaa62c00 R08: 0000000000000001 R09: fffffbd008169f32\nR10: fffffe8040b4f997 R11: 0000000000000001 R12: a1988d84f24943e4\nR13: ffffffffffffff02 R14: ffffffffffffff04 R15: ffff8880aaa62c08\nRBX: kasan shadow of 0x0\nRCX: __wake_up_klogd.part.0+0x74/0xe0 kernel/printk/printk.c:4554\nRDX: __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58\nRSI: vprintk+0x72/0x100 kernel/printk/printk_safe.c:71\nRBP: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]\nRSP: process kstack fffffe8040b4fbd0+0x7bd0/0x8000 [kworker/u8:7+netns 1804 ]\nR09: kasan shadow of process kstack fffffe8040b4f990+0x7990/0x8000 [kworker/u8:7+netns 1804 ]\nR10: process kstack fffffe8040b4f997+0x7997/0x8000 [kworker/u8:7+netns 1804 ]\nR15: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc08/0x1000 [slab object]\nFS: 0000000000000000(0000) GS:ffff888116000000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000748f5372c000 CR3: 0000000015408000 CR4: 00000000003406f0 shadow CR4: 00000000003406f0\nStack:\n 0000000000000000 ffffffff8a0c35e7 ffffffff8a0c3603 ffff8880aaa62c00\n ffff8880aaa62c00 0000000000000004 ffff88811145311c 0000000000000005\n 0000000000000001 ffff8880aaa62000 fffffe8040b4fd40 ffffffff8a0c360d\nCall Trace:\n \n [] __list_del_entry_valid include/linux/list.h:131 [inline] fffffe8040b4fc28\n [] __list_del_entry include/linux/list.h:248 [inline] fffffe8040b4fc28\n [] list_del include/linux/list.h:262 [inl\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-21865"
},
{
"cve": "CVE-2025-26465",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"notes": [
{
"category": "description",
"text": "A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-26465"
},
{
"cve": "CVE-2025-31115",
"cwe": {
"id": "CWE-366",
"name": "Race Condition within a Thread"
},
"notes": [
{
"category": "description",
"text": "XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-31115"
},
{
"cve": "CVE-2025-32988",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.\n\nThis vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-32988"
},
{
"cve": "CVE-2025-32989",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "description",
"text": "A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-32989"
},
{
"cve": "CVE-2025-37945",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY\n\nDSA has 2 kinds of drivers:\n\n1. Those who call dsa_switch_suspend() and dsa_switch_resume() from\n their device PM ops: qca8k-8xxx, bcm_sf2, microchip ksz\n2. Those who don't: all others. The above methods should be optional.\n\nFor type 1, dsa_switch_suspend() calls dsa_user_suspend() -> phylink_stop(),\nand dsa_switch_resume() calls dsa_user_resume() -> phylink_start().\nThese seem good candidates for setting mac_managed_pm = true because\nthat is essentially its definition [1], but that does not seem to be the\nbiggest problem for now, and is not what this change focuses on.\n\nTalking strictly about the 2nd category of DSA drivers here (which\ndo not have MAC managed PM, meaning that for their attached PHYs,\nmdio_bus_phy_suspend() and mdio_bus_phy_resume() should run in full),\nI have noticed that the following warning from mdio_bus_phy_resume() is\ntriggered:\n\n\tWARN_ON(phydev->state != PHY_HALTED && phydev->state != PHY_READY &&\n\t\tphydev->state != PHY_UP);\n\nbecause the PHY state machine is running.\n\nIt's running as a result of a previous dsa_user_open() -> ... ->\nphylink_start() -> phy_start() having been initiated by the user.\n\nThe previous mdio_bus_phy_suspend() was supposed to have called\nphy_stop_machine(), but it didn't. So this is why the PHY is in state\nPHY_NOLINK by the time mdio_bus_phy_resume() runs.\n\nmdio_bus_phy_suspend() did not call phy_stop_machine() because for\nphylink, the phydev->adjust_link function pointer is NULL. This seems a\ntechnicality introduced by commit fddd91016d16 (\"phylib: fix PAL state\nmachine restart on resume\"). That commit was written before phylink\nexisted, and was intended to avoid crashing with consumer drivers which\ndon't use the PHY state machine - phylink always does, when using a PHY.\nBut phylink itself has historically not been developed with\nsuspend/resume in mind, and apparently not tested too much in that\nscenario, allowing this bug to exist unnoticed for so long. Plus, prior\nto the WARN_ON(), it would have likely been invisible.\n\nThis issue is not in fact restricted to type 2 DSA drivers (according to\nthe above ad-hoc classification), but can be extrapolated to any MAC\ndriver with phylink and MDIO-bus-managed PHY PM ops. DSA is just where\nthe issue was reported. Assuming mac_managed_pm is set correctly, a\nquick search indicates the following other drivers might be affected:\n\n$ grep -Zlr PHYLINK_NETDEV drivers/ | xargs -0 grep -L mac_managed_pm\ndrivers/net/ethernet/atheros/ag71xx.c\ndrivers/net/ethernet/microchip/sparx5/sparx5_main.c\ndrivers/net/ethernet/microchip/lan966x/lan966x_main.c\ndrivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c\ndrivers/net/ethernet/freescale/fs_enet/fs_enet-main.c\ndrivers/net/ethernet/freescale/dpaa/dpaa_eth.c\ndrivers/net/ethernet/freescale/ucc_geth.c\ndrivers/net/ethernet/freescale/enetc/enetc_pf_common.c\ndrivers/net/ethernet/marvell/mvpp2/mvpp2_main.c\ndrivers/net/ethernet/marvell/mvneta.c\ndrivers/net/ethernet/marvell/prestera/prestera_main.c\ndrivers/net/ethernet/mediatek/mtk_eth_soc.c\ndrivers/net/ethernet/altera/altera_tse_main.c\ndrivers/net/ethernet/wangxun/txgbe/txgbe_phy.c\ndrivers/net/ethernet/meta/fbnic/fbnic_phylink.c\ndrivers/net/ethernet/tehuti/tn40_phy.c\ndrivers/net/ethernet/mscc/ocelot_net.c\n\nMake the existing conditions dependent on the PHY device having a\nphydev->phy_link_change() implementation equal to the default\nphy_link_change() provided by phylib. Otherwise, we implicitly know that\nthe phydev has the phylink-provided phylink_phy_change() callback, and\nwhen phylink is used, the PHY state machine always needs to be stopped/\nstarted on the suspend/resume path. The code is structured as such that\nif phydev->phy_link_change() is absent, it is a matter of time until the\nkernel will crash - no need to further complicate the test.\n\nThus, for the situation where the PM is not managed b\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-37945"
},
{
"cve": "CVE-2025-37980",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix resource leak in blk_register_queue() error path\n\nWhen registering a queue fails after blk_mq_sysfs_register() is\nsuccessful but the function later encounters an error, we need\nto clean up the blk_mq_sysfs resources.\n\nAdd the missing blk_mq_sysfs_unregister() call in the error path\nto properly clean up these resources and prevent a memory leak.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-37980"
},
{
"cve": "CVE-2025-38058",
"cwe": {
"id": "CWE-667",
"name": "Improper Locking"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput(). Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38058"
},
{
"cve": "CVE-2025-38063",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQ_PREFLUSH When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC, which causes the flush_bio to be throttled by wbt_wait()",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38063"
},
{
"cve": "CVE-2025-38067",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: rseq: Fix segfault on registration when rseq_cs is non-zero The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field doesn't point to a valid struct rseq_cs. The correct solution to this would be to fail the rseq registration when the rseq_cs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseq_cs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseq_cs does point to a valid struct rseq_cs. What we can do is clear the rseq_cs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38067"
},
{
"cve": "CVE-2025-38071",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phys_free() to throw the first 4 MiB of physical memory to the wolves. At a minimum it should fail gracefully with a meaningful diagnostic, but in fact everything seems to work fine without the weird reserve allocation",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38071"
},
{
"cve": "CVE-2025-38079",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_hash - fix double free in hash_accept\n\nIf accept(2) is called on socket type algif_hash with\nMSG_MORE flag set and crypto_ahash_import fails,\nsk2 is freed. However, it is also freed in af_alg_release,\nleading to slab-use-after-free error.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38079"
},
{
"cve": "CVE-2025-38083",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38083"
},
{
"cve": "CVE-2025-38100",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: x86/iopl: Cure TIF_IO_BITMAP inconsistencies io_bitmap_exit() is invoked from exit_thread() when a task exists or when a fork fails. In the latter case the exit_thread() cleans up resources which were allocated during fork(). io_bitmap_exit() invokes task_update_io_bitmap(), which in turn ends up in tss_update_io_bitmap(). tss_update_io_bitmap() operates on the current task. If current has TIF_IO_BITMAP set, but no bitmap installed, tss_update_io_bitmap() crashes with a NULL pointer dereference. There are two issues, which lead to that problem: 1) io_bitmap_exit() should not invoke task_update_io_bitmap() when the task, which is cleaned up, is not the current task. That's a clear indicator for a cleanup after a failed fork(). 2) A task should not have TIF_IO_BITMAP set and neither a bitmap installed nor IOPL emulation level 3 activated. This happens when a kernel thread is created in the context of a user space thread, which has TIF_IO_BITMAP set as the thread flags are copied and the IO bitmap pointer is cleared. Other than in the failed fork() case this has no impact because kernel threads including IO workers never return to user space and therefore never invoke tss_update_io_bitmap(). Cure this by adding the missing cleanups and checks: 1) Prevent io_bitmap_exit() to invoke task_update_io_bitmap() if the to be cleaned up task is not the current task. 2) Clear TIF_IO_BITMAP in copy_thread() unconditionally. For user space forks it is set later, when the IO bitmap is inherited in io_bitmap_share(). For paranoia sake, add a warning into tss_update_io_bitmap() to catch the case, when that code is invoked with inconsistent state",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38100"
},
{
"cve": "CVE-2025-38111",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38111"
},
{
"cve": "CVE-2025-38124",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 (\"net: gso: fix udp gso fraglist segmentation after pull from frag_list\") detected invalid geometry in frag_list skbs and redirects them from skb_segment_list to more robust skb_segment. But some packets with modified geometry can also hit bugs in that code",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38124"
},
{
"cve": "CVE-2025-38162",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: prevent overflow in lookup table allocation\n\nWhen calculating the lookup table size, ensure the following\nmultiplication does not overflow:\n\n- desc->field_len[] maximum value is U8_MAX multiplied by\n NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.\n- NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case.\n- sizeof(unsigned long), from sizeof(*f->lt), lt in\n struct nft_pipapo_field.\n\nThen, use check_mul_overflow() to multiply by bucket size and then use\ncheck_add_overflow() to the alignment for avx2 (if needed). Finally, add\nlt_size_check_overflow() helper and use it to consolidate this.\n\nWhile at it, replace leftover allocation using the GFP_KERNEL to\nGFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38162"
},
{
"cve": "CVE-2025-38167",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdr_first_de() return value The hdr_first_de() function returns a pointer to a struct NTFS_DE. This pointer may be NULL. To handle the NULL error effectively, it is important to implement an error handler. This will help manage potential errors consistently. Additionally, error handling for the return value already exists at other points where this function is called. Found by Linux Verification Center (linuxtesting.org) with SVACE",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38167"
},
{
"cve": "CVE-2025-38192",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: clear the dst when changing skb protocol\n\nA not-so-careful NAT46 BPF program can crash the kernel\nif it indiscriminately flips ingress packets from v4 to v6:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n ip6_rcv_core (net/ipv6/ip6_input.c:190:20)\n ipv6_rcv (net/ipv6/ip6_input.c:306:8)\n process_backlog (net/core/dev.c:6186:4)\n napi_poll (net/core/dev.c:6906:9)\n net_rx_action (net/core/dev.c:7028:13)\n do_softirq (kernel/softirq.c:462:3)\n netif_rx (net/core/dev.c:5326:3)\n dev_loopback_xmit (net/core/dev.c:4015:2)\n ip_mc_finish_output (net/ipv4/ip_output.c:363:8)\n NF_HOOK (./include/linux/netfilter.h:314:9)\n ip_mc_output (net/ipv4/ip_output.c:400:5)\n dst_output (./include/net/dst.h:459:9)\n ip_local_out (net/ipv4/ip_output.c:130:9)\n ip_send_skb (net/ipv4/ip_output.c:1496:8)\n udp_send_skb (net/ipv4/udp.c:1040:8)\n udp_sendmsg (net/ipv4/udp.c:1328:10)\n\nThe output interface has a 4->6 program attached at ingress.\nWe try to loop the multicast skb back to the sending socket.\nIngress BPF runs as part of netif_rx(), pushes a valid v6 hdr\nand changes skb->protocol to v6. We enter ip6_rcv_core which\ntries to use skb_dst(). But the dst is still an IPv4 one left\nafter IPv4 mcast output.\n\nClear the dst in all BPF helpers which change the protocol.\nTry to preserve metadata dsts, those may carry non-routing\nmetadata.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38192"
},
{
"cve": "CVE-2025-38198",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the \"store_modes\" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 index -1 is out of range for type 'fb_info *[32]' ... fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122 fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048 fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673 store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113 dev_attr_store+0x55/0x80 drivers/base/core.c:2439 static struct fb_info *fbcon_registered_fb[FB_MAX]; ... static signed char con2fb_map[MAX_NR_CONSOLES]; ... static struct fb_info *fbcon_info_from_console(int console) ... return fbcon_registered_fb[con2fb_map[console]]; If con2fb_map contains a -1 things go wrong here. Instead, return NULL, as callers of fbcon_info_from_console() are trying to compare against existing \"info\" pointers, so error handling should kick in correctly",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38198"
},
{
"cve": "CVE-2025-38201",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX\n\nOtherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof()\nwhen resizing hashtable because __GFP_NOWARN is unset.\n\nSimilar to:\n\n b541ba7d1f5a (\"netfilter: conntrack: clamp maximum hashtable size to INT_MAX\")",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38201"
},
{
"cve": "CVE-2025-38212",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipc: fix to protect IPCS lookups using RCU\r\n\r\nsyzbot reported that it discovered a use-after-free vulnerability, [0]\r\n\r\n[0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/\r\n\r\nidr_for_each() is protected by rwsem, but this is not enough. If it is\r\nnot protected by RCU read-critical region, when idr_for_each() calls\r\nradix_tree_node_free() through call_rcu() to free the radix_tree_node\r\nstructure, the node will be freed immediately, and when reading the next\r\nnode in radix_tree_for_each_slot(), the already freed memory may be read.\r\n\r\nTherefore, we need to add code to make sure that idr_for_each() is\r\nprotected within the RCU read-critical region when we call it in\r\nshm_destroy_orphaned().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38212"
},
{
"cve": "CVE-2025-38214",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var\r\n\r\nIf fb_add_videomode() in fb_set_var() fails to allocate memory for\r\nfb_videomode, later it may lead to a null-ptr dereference in\r\nfb_videomode_to_var(), as the fb_info is registered while not having the\r\nmode in modelist that is expected to be there, i.e. the one that is\r\ndescribed in fb_info->var.\r\n\r\n================================================================\r\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI\r\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\r\nCPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0\r\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\r\nRIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901\r\nCall Trace:\r\n display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929\r\n fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071\r\n resize_screen drivers/tty/vt/vt.c:1176 [inline]\r\n vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263\r\n fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720\r\n fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776\r\n do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128\r\n fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203\r\n vfs_ioctl fs/ioctl.c:48 [inline]\r\n __do_sys_ioctl fs/ioctl.c:753 [inline]\r\n __se_sys_ioctl fs/ioctl.c:739 [inline]\r\n __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739\r\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\r\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\r\n================================================================\r\n\r\nThe reason is that fb_info->var is being modified in fb_set_var(), and\r\nthen fb_videomode_to_var() is called. If it fails to add the mode to\r\nfb_info->modelist, fb_set_var() returns error, but does not restore the\r\nold value of fb_info->var. Restore fb_info->var on failure the same way\r\nit is done earlier in the function.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38214"
},
{
"cve": "CVE-2025-38215",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var\r\n\r\nIf fb_add_videomode() in do_register_framebuffer() fails to allocate\r\nmemory for fb_videomode, it will later lead to a null-ptr dereference in\r\nfb_videomode_to_var(), as the fb_info is registered while not having the\r\nmode in modelist that is expected to be there, i.e. the one that is\r\ndescribed in fb_info->var.\r\n\r\n================================================================\r\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI\r\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\r\nCPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0\r\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\r\nRIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901\r\nCall Trace:\r\n display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929\r\n fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071\r\n resize_screen drivers/tty/vt/vt.c:1176 [inline]\r\n vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263\r\n fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720\r\n fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776\r\n do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128\r\n fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203\r\n vfs_ioctl fs/ioctl.c:48 [inline]\r\n __do_sys_ioctl fs/ioctl.c:753 [inline]\r\n __se_sys_ioctl fs/ioctl.c:739 [inline]\r\n __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739\r\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\r\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\r\n================================================================\r\n\r\nEven though fbcon_init() checks beforehand if fb_match_mode() in\r\nvar_to_display() fails, it can not prevent the panic because fbcon_init()\r\ndoes not return error code. Considering this and the comment in the code\r\nabout fb_match_mode() returning NULL - \"This should not happen\" - it is\r\nbetter to prevent registering the fb_info if its mode was not set\r\nsuccessfully. Also move fb_add_videomode() closer to the beginning of\r\ndo_register_framebuffer() to avoid having to do the cleanup on fail.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38215"
},
{
"cve": "CVE-2025-38222",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: inline: fix len overflow in ext4_prepare_inline_data\r\n\r\nWhen running the following code on an ext4 filesystem with inline_data\r\nfeature enabled, it will lead to the bug below.\r\n\r\n fd = open(\"file1\", O_RDWR | O_CREAT | O_TRUNC, 0666);\r\n ftruncate(fd, 30);\r\n pwrite(fd, \"a\", 1, (1UL << 40) + 5UL);\r\n\r\nThat happens because write_begin will succeed as when\r\next4_generic_write_inline_data calls ext4_prepare_inline_data, pos + len\r\nwill be truncated, leading to ext4_prepare_inline_data parameter to be 6\r\ninstead of 0x10000000006.\r\n\r\nThen, later when write_end is called, we hit:\r\n\r\n BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);\r\n\r\nat ext4_write_inline_data.\r\n\r\nFix it by using a loff_t type for the len parameter in\r\next4_prepare_inline_data instead of an unsigned int.\r\n\r\n[ 44.545164] ------------[ cut here ]------------\r\n[ 44.545530] kernel BUG at fs/ext4/inline.c:240!\r\n[ 44.545834] Oops: invalid opcode: 0000 [#1] SMP NOPTI\r\n[ 44.546172] CPU: 3 UID: 0 PID: 343 Comm: test Not tainted 6.15.0-rc2-00003-g9080916f4863 #45 PREEMPT(full) 112853fcebfdb93254270a7959841d2c6aa2c8bb\r\n[ 44.546523] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\r\n[ 44.546523] RIP: 0010:ext4_write_inline_data+0xfe/0x100\r\n[ 44.546523] Code: 3c 0e 48 83 c7 48 48 89 de 5b 41 5c 41 5d 41 5e 41 5f 5d e9 e4 fa 43 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 0f 0b <0f> 0b 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 49\r\n[ 44.546523] RSP: 0018:ffffb342008b79a8 EFLAGS: 00010216\r\n[ 44.546523] RAX: 0000000000000001 RBX: ffff9329c579c000 RCX: 0000010000000006\r\n[ 44.546523] RDX: 000000000000003c RSI: ffffb342008b79f0 RDI: ffff9329c158e738\r\n[ 44.546523] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\r\n[ 44.546523] R10: 00007ffffffff000 R11: ffffffff9bd0d910 R12: 0000006210000000\r\n[ 44.546523] R13: fffffc7e4015e700 R14: 0000010000000005 R15: ffff9329c158e738\r\n[ 44.546523] FS: 00007f4299934740(0000) GS:ffff932a60179000(0000) knlGS:0000000000000000\r\n[ 44.546523] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\r\n[ 44.546523] CR2: 00007f4299a1ec90 CR3: 0000000002886002 CR4: 0000000000770eb0\r\n[ 44.546523] PKRU: 55555554\r\n[ 44.546523] Call Trace:\r\n[ 44.546523] \r\n[ 44.546523] ext4_write_inline_data_end+0x126/0x2d0\r\n[ 44.546523] generic_perform_write+0x17e/0x270\r\n[ 44.546523] ext4_buffered_write_iter+0xc8/0x170\r\n[ 44.546523] vfs_write+0x2be/0x3e0\r\n[ 44.546523] __x64_sys_pwrite64+0x6d/0xc0\r\n[ 44.546523] do_syscall_64+0x6a/0xf0\r\n[ 44.546523] ? __wake_up+0x89/0xb0\r\n[ 44.546523] ? xas_find+0x72/0x1c0\r\n[ 44.546523] ? next_uptodate_folio+0x317/0x330\r\n[ 44.546523] ? set_pte_range+0x1a6/0x270\r\n[ 44.546523] ? filemap_map_pages+0x6ee/0x840\r\n[ 44.546523] ? ext4_setattr+0x2fa/0x750\r\n[ 44.546523] ? do_pte_missing+0x128/0xf70\r\n[ 44.546523] ? security_inode_post_setattr+0x3e/0xd0\r\n[ 44.546523] ? ___pte_offset_map+0x19/0x100\r\n[ 44.546523] ? handle_mm_fault+0x721/0xa10\r\n[ 44.546523] ? do_user_addr_fault+0x197/0x730\r\n[ 44.546523] ? do_syscall_64+0x76/0xf0\r\n[ 44.546523] ? arch_exit_to_user_mode_prepare+0x1e/0x60\r\n[ 44.546523] ? irqentry_exit_to_user_mode+0x79/0x90\r\n[ 44.546523] entry_SYSCALL_64_after_hwframe+0x55/0x5d\r\n[ 44.546523] RIP: 0033:0x7f42999c6687\r\n[ 44.546523] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff\r\n[ 44.546523] RSP: 002b:00007ffeae4a7930 EFLAGS: 00000202 ORIG_RAX: 0000000000000012\r\n[ 44.546523] RAX: ffffffffffffffda RBX: 00007f4299934740 RCX: 00007f42999c6687\r\n[ 44.546523] RDX: 0000000000000001 RSI: 000055ea6149200f RDI: 0000000000000003\r\n[ 44.546523] RBP: 00007ffeae4a79a0 R08: 0000000000000000 R09: 0000000000000000\r\n[ 44.546523] R10: 0000010000000005 R11: 0000000000000202 R12: 0000\r\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38222"
},
{
"cve": "CVE-2025-38231",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfsd: Initialize ssc before laundromat_work to prevent NULL dereference\r\n\r\nIn nfs4_state_start_net(), laundromat_work may access nfsd_ssc through\r\nnfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized,\r\nthis can cause NULL pointer dereference.\r\n\r\nNormally the delayed start of laundromat_work allows sufficient time for\r\nnfsd_ssc initialization to complete. However, when the kernel waits too\r\nlong for userspace responses (e.g. in nfs4_state_start_net ->\r\nnfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done ->\r\ncld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the\r\ndelayed work may start before nfsd_ssc initialization finishes.\r\n\r\nFix this by moving nfsd_ssc initialization before starting laundromat_work.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38231"
},
{
"cve": "CVE-2025-38236",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\naf_unix: Don't leave consecutive consumed OOB skbs.\r\n\r\nJann Horn reported a use-after-free in unix_stream_read_generic().\r\n\r\nThe following sequences reproduce the issue:\r\n\r\n $ python3\r\n from socket import *\r\n s1, s2 = socketpair(AF_UNIX, SOCK_STREAM)\r\n s1.send(b'x', MSG_OOB)\r\n s2.recv(1, MSG_OOB) # leave a consumed OOB skb\r\n s1.send(b'y', MSG_OOB)\r\n s2.recv(1, MSG_OOB) # leave a consumed OOB skb\r\n s1.send(b'z', MSG_OOB)\r\n s2.recv(1) # recv 'z' illegally\r\n s2.recv(1, MSG_OOB) # access 'z' skb (use-after-free)\r\n\r\nEven though a user reads OOB data, the skb holding the data stays on\r\nthe recv queue to mark the OOB boundary and break the next recv().\r\n\r\nAfter the last send() in the scenario above, the sk2's recv queue has\r\n2 leading consumed OOB skbs and 1 real OOB skb.\r\n\r\nThen, the following happens during the next recv() without MSG_OOB\r\n\r\n 1. unix_stream_read_generic() peeks the first consumed OOB skb\r\n 2. manage_oob() returns the next consumed OOB skb\r\n 3. unix_stream_read_generic() fetches the next not-yet-consumed OOB skb\r\n 4. unix_stream_read_generic() reads and frees the OOB skb\r\n\r\n, and the last recv(MSG_OOB) triggers KASAN splat.\r\n\r\nThe 3. above occurs because of the SO_PEEK_OFF code, which does not\r\nexpect unix_skb_len(skb) to be 0, but this is true for such consumed\r\nOOB skbs.\r\n\r\n while (skip >= unix_skb_len(skb)) {\r\n skip -= unix_skb_len(skb);\r\n skb = skb_peek_next(skb, &sk->sk_receive_queue);\r\n ...\r\n }\r\n\r\nIn addition to this use-after-free, there is another issue that\r\nioctl(SIOCATMARK) does not function properly with consecutive consumed\r\nOOB skbs.\r\n\r\nSo, nothing good comes out of such a situation.\r\n\r\nInstead of complicating manage_oob(), ioctl() handling, and the next\r\nECONNRESET fix by introducing a loop for consecutive consumed OOB skbs,\r\nlet's not leave such consecutive OOB unnecessarily.\r\n\r\nNow, while receiving an OOB skb in unix_stream_recv_urg(), if its\r\nprevious skb is a consumed OOB skb, it is freed.\r\n\r\n[0]:\r\nBUG: KASAN: slab-use-after-free in unix_stream_read_actor (net/unix/af_unix.c:3027)\r\nRead of size 4 at addr ffff888106ef2904 by task python3/315\r\n\r\nCPU: 2 UID: 0 PID: 315 Comm: python3 Not tainted 6.16.0-rc1-00407-gec315832f6f9 #8 PREEMPT(voluntary)\r\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014\r\nCall Trace:\r\n \r\n dump_stack_lvl (lib/dump_stack.c:122)\r\n print_report (mm/kasan/report.c:409 mm/kasan/report.c:521)\r\n kasan_report (mm/kasan/report.c:636)\r\n unix_stream_read_actor (net/unix/af_unix.c:3027)\r\n unix_stream_read_generic (net/unix/af_unix.c:2708 net/unix/af_unix.c:2847)\r\n unix_stream_recvmsg (net/unix/af_unix.c:3048)\r\n sock_recvmsg (net/socket.c:1063 (discriminator 20) net/socket.c:1085 (discriminator 20))\r\n __sys_recvfrom (net/socket.c:2278)\r\n __x64_sys_recvfrom (net/socket.c:2291 (discriminator 1) net/socket.c:2287 (discriminator 1) net/socket.c:2287 (discriminator 1))\r\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\r\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\r\nRIP: 0033:0x7f8911fcea06\r\nCode: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08\r\nRSP: 002b:00007fffdb0dccb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002d\r\nRAX: ffffffffffffffda RBX: 00007fffdb0dcdc8 RCX: 00007f8911fcea06\r\nRDX: 0000000000000001 RSI: 00007f8911a5e060 RDI: 0000000000000006\r\nRBP: 00007fffdb0dccd0 R08: 0000000000000000 R09: 0000000000000000\r\nR10: 0000000000000001 R11: 0000000000000202 R12: 00007f89119a7d20\r\nR13: ffffffffc4653600 R14: 0000000000000000 R15: 0000000000000000\r\n \r\n\r\nAllocated by task 315:\r\n kasan_save_stack (mm/kasan/common.c:48)\r\n kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1))\r\n __kasan_slab_alloc (mm/kasan/common.c:348)\r\n kmem_cache_alloc_\r\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38236"
},
{
"cve": "CVE-2025-38280",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Avoid __bpf_prog_ret0_warn when jit fails\r\n\r\nsyzkaller reported an issue:\r\n\r\nWARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357\r\nModules linked in:\r\nCPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39\r\nRIP: 0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357\r\nCall Trace:\r\n \r\n bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]\r\n __bpf_prog_run include/linux/filter.h:718 [inline]\r\n bpf_prog_run include/linux/filter.h:725 [inline]\r\n cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105\r\n ...\r\n\r\nWhen creating bpf program, 'fp->jit_requested' depends on bpf_jit_enable.\r\nThis issue is triggered because of CONFIG_BPF_JIT_ALWAYS_ON is not set\r\nand bpf_jit_enable is set to 1, causing the arch to attempt JIT the prog,\r\nbut jit failed due to FAULT_INJECTION. As a result, incorrectly\r\ntreats the program as valid, when the program runs it calls\r\n`__bpf_prog_ret0_warn` and triggers the WARN_ON_ONCE(1).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38280"
},
{
"cve": "CVE-2025-38285",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Fix WARN() in get_bpf_raw_tp_regs\r\n\r\nsyzkaller reported an issue:\r\n\r\nWARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861\r\nModules linked in:\r\nCPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full)\r\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\r\nRIP: 0010:get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861\r\nRSP: 0018:ffffc90003636fa8 EFLAGS: 00010293\r\nRAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff81c6bc4c\r\nRDX: ffff888032efc880 RSI: ffffffff81c6bc83 RDI: 0000000000000005\r\nRBP: ffff88806a730860 R08: 0000000000000005 R09: 0000000000000003\r\nR10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000004\r\nR13: 0000000000000001 R14: ffffc90003637008 R15: 0000000000000900\r\nFS: 0000000000000000(0000) GS:ffff8880d6cdf000(0000) knlGS:0000000000000000\r\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\r\nCR2: 00007f7baee09130 CR3: 0000000029f5a000 CR4: 0000000000352ef0\r\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\r\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\r\nCall Trace:\r\n \r\n ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1934 [inline]\r\n bpf_get_stack_raw_tp+0x24/0x160 kernel/trace/bpf_trace.c:1931\r\n bpf_prog_ec3b2eefa702d8d3+0x43/0x47\r\n bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]\r\n __bpf_prog_run include/linux/filter.h:718 [inline]\r\n bpf_prog_run include/linux/filter.h:725 [inline]\r\n __bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline]\r\n bpf_trace_run3+0x23f/0x5a0 kernel/trace/bpf_trace.c:2405\r\n __bpf_trace_mmap_lock_acquire_returned+0xfc/0x140 include/trace/events/mmap_lock.h:47\r\n __traceiter_mmap_lock_acquire_returned+0x79/0xc0 include/trace/events/mmap_lock.h:47\r\n __do_trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline]\r\n trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline]\r\n __mmap_lock_do_trace_acquire_returned+0x138/0x1f0 mm/mmap_lock.c:35\r\n __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]\r\n mmap_read_trylock include/linux/mmap_lock.h:204 [inline]\r\n stack_map_get_build_id_offset+0x535/0x6f0 kernel/bpf/stackmap.c:157\r\n __bpf_get_stack+0x307/0xa10 kernel/bpf/stackmap.c:483\r\n ____bpf_get_stack kernel/bpf/stackmap.c:499 [inline]\r\n bpf_get_stack+0x32/0x40 kernel/bpf/stackmap.c:496\r\n ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1941 [inline]\r\n bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1931\r\n bpf_prog_ec3b2eefa702d8d3+0x43/0x47\r\n\r\nTracepoint like trace_mmap_lock_acquire_returned may cause nested call\r\nas the corner case show above, which will be resolved with more general\r\nmethod in the future. As a result, WARN_ON_ONCE will be triggered. As\r\nAlexei suggested, remove the WARN_ON_ONCE first.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38285"
},
{
"cve": "CVE-2025-38312",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()\r\n\r\nIn fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000,\r\ncvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's\r\nthen passed to fb_cvt_hperiod(), where it's used as a divider -- division\r\nby 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to\r\navoid such overflow...\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with the Svace static\r\nanalysis tool.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38312"
},
{
"cve": "CVE-2025-38342",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsoftware node: Correct a OOB check in software_node_get_reference_args()\r\n\r\nsoftware_node_get_reference_args() wants to get @index-th element, so\r\nthe property value requires at least '(index + 1) * sizeof(*ref)' bytes\r\nbut that can not be guaranteed by current OOB check, and may cause OOB\r\nfor malformed property.\r\n\r\nFix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38342"
},
{
"cve": "CVE-2025-38350",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Always pass notifications when child class becomes empty\n\nCertain classful qdiscs may invoke their classes' dequeue handler on an\nenqueue operation. This may unexpectedly empty the child qdisc and thus\nmake an in-flight class passive via qlen_notify(). Most qdiscs do not\nexpect such behaviour at this point in time and may re-activate the\nclass eventually anyways which will lead to a use-after-free.\n\nThe referenced fix commit attempted to fix this behavior for the HFSC\ncase by moving the backlog accounting around, though this turned out to\nbe incomplete since the parent's parent may run into the issue too.\nThe following reproducer demonstrates this use-after-free:\n\n tc qdisc add dev lo root handle 1: drr\n tc filter add dev lo parent 1: basic classid 1:1\n tc class add dev lo parent 1: classid 1:1 drr\n tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1\n tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0\n tc qdisc add dev lo parent 2:1 handle 3: netem\n tc qdisc add dev lo parent 3:1 handle 4: blackhole\n\n echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888\n tc class delete dev lo classid 1:1\n echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888\n\nSince backlog accounting issues leading to a use-after-frees on stale\nclass pointers is a recurring pattern at this point, this patch takes\na different approach. Instead of trying to fix the accounting, the patch\nensures that qdisc_tree_reduce_backlog always calls qlen_notify when\nthe child qdisc is empty. This solves the problem because deletion of\nqdiscs always involves a call to qdisc_reset() and / or\nqdisc_purge_queue() which ultimately resets its qlen to 0 thus causing\nthe following qdisc_tree_reduce_backlog() to report to the parent. Note\nthat this may call qlen_notify on passive classes multiple times. This\nis not a problem after the recent patch series that made all the\nclassful qdiscs qlen_notify() handlers idempotent.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38350"
},
{
"cve": "CVE-2025-38364",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmaple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()\r\n\r\nTemporarily clear the preallocation flag when explicitly requesting\r\nallocations. Pre-existing allocations are already counted against the\r\nrequest through mas_node_count_gfp(), but the allocations will not happen\r\nif the MA_STATE_PREALLOC flag is set. This flag is meant to avoid\r\nre-allocating in bulk allocation mode, and to detect issues with\r\npreallocation calculations.\r\n\r\nThe MA_STATE_PREALLOC flag should also always be set on zero allocations\r\nso that detection of underflow allocations will print a WARN_ON() during\r\nconsumption.\r\n\r\nUser visible effect of this flaw is a WARN_ON() followed by a null pointer\r\ndereference when subsequent requests for larger number of nodes is\r\nignored, such as the vma merge retry in mmap_region() caused by drivers\r\naltering the vma flags (which happens in v6.6, at least)",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38364"
},
{
"cve": "CVE-2025-38393",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nNFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN\r\n\r\nWe found a few different systems hung up in writeback waiting on the same\r\npage lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in\r\npnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count\r\nwas zero.\r\n\r\nIt seems most likely that this is another race between the waiter and waker\r\nsimilar to commit ed0172af5d6f (\"SUNRPC: Fix a race to wake a sync task\").\r\nFix it up by applying the advised barrier.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38393"
},
{
"cve": "CVE-2025-38400",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.\r\n\r\nsyzbot reported a warning below [1] following a fault injection in\r\nnfs_fs_proc_net_init(). [0]\r\n\r\nWhen nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed.\r\n\r\nLater, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning\r\nis logged as the directory is not empty.\r\n\r\nLet's handle the error of nfs_fs_proc_net_init() properly.\r\n\r\n[0]:\r\nFAULT_INJECTION: forcing a failure.\r\nname failslab, interval 1, probability 0, space 0, times 0\r\nCPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)\r\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\r\nCall Trace:\r\n \r\n dump_stack_lvl (lib/dump_stack.c:123)\r\n should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174)\r\n should_failslab (mm/failslab.c:46)\r\n kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204)\r\n __proc_create (fs/proc/generic.c:427)\r\n proc_create_reg (fs/proc/generic.c:554)\r\n proc_create_net_data (fs/proc/proc_net.c:120)\r\n nfs_fs_proc_net_init (fs/nfs/client.c:1409)\r\n nfs_net_init (fs/nfs/inode.c:2600)\r\n ops_init (net/core/net_namespace.c:138)\r\n setup_net (net/core/net_namespace.c:443)\r\n copy_net_ns (net/core/net_namespace.c:576)\r\n create_new_namespaces (kernel/nsproxy.c:110)\r\n unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4))\r\n ksys_unshare (kernel/fork.c:3123)\r\n __x64_sys_unshare (kernel/fork.c:3190)\r\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\r\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\r\n \r\n\r\n[1]:\r\nremove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs'\r\n WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727\r\nModules linked in:\r\nCPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)\r\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\r\n RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727\r\nCode: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00\r\nRSP: 0018:ffffc90003637b08 EFLAGS: 00010282\r\nRAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8\r\nRDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001\r\nRBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000\r\nR10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00\r\nR13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000\r\nFS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000\r\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\r\nCR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0\r\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\r\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\r\nCall Trace:\r\n \r\n sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76\r\n ops_exit_list net/core/net_namespace.c:200 [inline]\r\n ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253\r\n setup_net+0x2e1/0x510 net/core/net_namespace.c:457\r\n copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574\r\n create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110\r\n unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218\r\n ksys_unshare+0x45b/0xa40 kernel/fork.c:3121\r\n __do_sys_unshare kernel/fork.c:3192 [inline]\r\n __se_sys_unshare kernel/fork.c:3190 [inline]\r\n __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190\r\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\r\n do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94\r\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\r\nRIP: 0033:0x7fa1a6b8e929\r\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c\r\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38400"
},
{
"cve": "CVE-2025-38430",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfsd: nfsd4_spo_must_allow() must check this is a v4 compound request\r\n\r\nIf the request being processed is not a v4 compound request, then\r\nexamining the cstate can have undefined results.\r\n\r\nThis patch adds a check that the rpc procedure being executed\r\n(rq_procinfo) is the NFSPROC4_COMPOUND procedure.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38430"
},
{
"cve": "CVE-2025-38451",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmd/md-bitmap: fix GPF in bitmap_get_stats()\r\n\r\nThe commit message of commit 6ec1f0239485 (\"md/md-bitmap: fix stats\r\ncollection for external bitmaps\") states:\r\n\r\n Remove the external bitmap check as the statistics should be\r\n available regardless of bitmap storage location.\r\n\r\n Return -EINVAL only for invalid bitmap with no storage (neither in\r\n superblock nor in external file).\r\n\r\nBut, the code does not adhere to the above, as it does only check for\r\na valid super-block for \"internal\" bitmaps. Hence, we observe:\r\n\r\nOops: GPF, probably for non-canonical address 0x1cd66f1f40000028\r\nRIP: 0010:bitmap_get_stats+0x45/0xd0\r\nCall Trace:\r\n\r\n seq_read_iter+0x2b9/0x46a\r\n seq_read+0x12f/0x180\r\n proc_reg_read+0x57/0xb0\r\n vfs_read+0xf6/0x380\r\n ksys_read+0x6d/0xf0\r\n do_syscall_64+0x8c/0x1b0\r\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\r\n\r\nWe fix this by checking the existence of a super-block for both the\r\ninternal and external case.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38451"
},
{
"cve": "CVE-2025-38457",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: Abort __tc_modify_qdisc if parent class does not exist\r\n\r\nLion's patch [1] revealed an ancient bug in the qdisc API.\r\nWhenever a user creates/modifies a qdisc specifying as a parent another\r\nqdisc, the qdisc API will, during grafting, detect that the user is\r\nnot trying to attach to a class and reject. However grafting is\r\nperformed after qdisc_create (and thus the qdiscs' init callback) is\r\nexecuted. In qdiscs that eventually call qdisc_tree_reduce_backlog\r\nduring init or change (such as fq, hhf, choke, etc), an issue\r\narises. For example, executing the following commands:\r\n\r\nsudo tc qdisc add dev lo root handle a: htb default 2\r\nsudo tc qdisc add dev lo parent a: handle beef fq\r\n\r\nQdiscs such as fq, hhf, choke, etc unconditionally invoke\r\nqdisc_tree_reduce_backlog() in their control path init() or change() which\r\nthen causes a failure to find the child class; however, that does not stop\r\nthe unconditional invocation of the assumed child qdisc's qlen_notify with\r\na null class. All these qdiscs make the assumption that class is non-null.\r\n\r\nThe solution is ensure that qdisc_leaf() which looks up the parent\r\nclass, and is invoked prior to qdisc_create(), should return failure on\r\nnot finding the class.\r\nIn this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the\r\nparentid doesn't correspond to a class, so that we can detect it\r\nearlier on and abort before qdisc_create is called.\r\n\r\n[1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38457"
},
{
"cve": "CVE-2025-38465",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetlink: Fix wraparounds of sk->sk_rmem_alloc.\r\n\r\nNetlink has this pattern in some places\r\n\r\n if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)\r\n \tatomic_add(skb->truesize, &sk->sk_rmem_alloc);\r\n\r\n, which has the same problem fixed by commit 5a465a0da13e (\"udp:\r\nFix multiple wraparounds of sk->sk_rmem_alloc.\").\r\n\r\nFor example, if we set INT_MAX to SO_RCVBUFFORCE, the condition\r\nis always false as the two operands are of int.\r\n\r\nThen, a single socket can eat as many skb as possible until OOM\r\nhappens, and we can see multiple wraparounds of sk->sk_rmem_alloc.\r\n\r\nLet's fix it by using atomic_add_return() and comparing the two\r\nvariables as unsigned int.\r\n\r\nBefore:\r\n [root@fedora ~]# ss -f netlink\r\n Recv-Q Send-Q Local Address:Port Peer Address:Port\r\n -1668710080 0 rtnl:nl_wraparound/293 *\r\n\r\nAfter:\r\n [root@fedora ~]# ss -f netlink\r\n Recv-Q Send-Q Local Address:Port Peer Address:Port\r\n 2147483072 0 rtnl:nl_wraparound/290 *\r\n ^\r\n `--- INT_MAX - 576",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38465"
},
{
"cve": "CVE-2025-38466",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nperf: Revert to requiring CAP_SYS_ADMIN for uprobes\r\n\r\nJann reports that uprobes can be used destructively when used in the\r\nmiddle of an instruction. The kernel only verifies there is a valid\r\ninstruction at the requested offset, but due to variable instruction\r\nlength cannot determine if this is an instruction as seen by the\r\nintended execution stream.\r\n\r\nAdditionally, Mark Rutland notes that on architectures that mix data\r\nin the text segment (like arm64), a similar things can be done if the\r\ndata word is 'mistaken' for an instruction.\r\n\r\nAs such, require CAP_SYS_ADMIN for uprobes.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38466"
},
{
"cve": "CVE-2025-38468",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree\r\n\r\nhtb_lookup_leaf has a BUG_ON that can trigger with the following:\r\n\r\ntc qdisc del dev lo root\r\ntc qdisc add dev lo root handle 1: htb default 1\r\ntc class add dev lo parent 1: classid 1:1 htb rate 64bit\r\ntc qdisc add dev lo parent 1:1 handle 2: netem\r\ntc qdisc add dev lo parent 2:1 handle 3: blackhole\r\nping -I lo -c1 -W0.001 127.0.0.1\r\n\r\nThe root cause is the following:\r\n\r\n1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on\r\n the selected leaf qdisc\r\n2. netem_dequeue calls enqueue on the child qdisc\r\n3. blackhole_enqueue drops the packet and returns a value that is not\r\n just NET_XMIT_SUCCESS\r\n4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and\r\n since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate ->\r\n htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase\r\n5. As this is the only class in the selected hprio rbtree,\r\n __rb_change_child in __rb_erase_augmented sets the rb_root pointer to\r\n NULL\r\n6. Because blackhole_dequeue returns NULL, netem_dequeue returns NULL,\r\n which causes htb_dequeue_tree to call htb_lookup_leaf with the same\r\n hprio rbtree, and fail the BUG_ON\r\n\r\nThe function graph for this scenario is shown here:\r\n 0) | htb_enqueue() {\r\n 0) + 13.635 us | netem_enqueue();\r\n 0) 4.719 us | htb_activate_prios();\r\n 0) # 2249.199 us | }\r\n 0) | htb_dequeue() {\r\n 0) 2.355 us | htb_lookup_leaf();\r\n 0) | netem_dequeue() {\r\n 0) + 11.061 us | blackhole_enqueue();\r\n 0) | qdisc_tree_reduce_backlog() {\r\n 0) | qdisc_lookup_rcu() {\r\n 0) 1.873 us | qdisc_match_from_root();\r\n 0) 6.292 us | }\r\n 0) 1.894 us | htb_search();\r\n 0) | htb_qlen_notify() {\r\n 0) 2.655 us | htb_deactivate_prios();\r\n 0) 6.933 us | }\r\n 0) + 25.227 us | }\r\n 0) 1.983 us | blackhole_dequeue();\r\n 0) + 86.553 us | }\r\n 0) # 2932.761 us | qdisc_warn_nonwc();\r\n 0) | htb_lookup_leaf() {\r\n 0) | BUG_ON();\r\n ------------------------------------------\r\n\r\nThe full original bug report can be seen here [1].\r\n\r\nWe can fix this just by returning NULL instead of the BUG_ON,\r\nas htb_dequeue_tree returns NULL when htb_lookup_leaf returns\r\nNULL.\r\n\r\n[1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38468"
},
{
"cve": "CVE-2025-38470",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime\r\n\r\nAssuming the \"rx-vlan-filter\" feature is enabled on a net device, the\r\n8021q module will automatically add or remove VLAN 0 when the net device\r\nis put administratively up or down, respectively. There are a couple of\r\nproblems with the above scheme.\r\n\r\nThe first problem is a memory leak that can happen if the \"rx-vlan-filter\"\r\nfeature is disabled while the device is running:\r\n\r\n # ip link add bond1 up type bond mode 0\r\n # ethtool -K bond1 rx-vlan-filter off\r\n # ip link del dev bond1\r\n\r\nWhen the device is put administratively down the \"rx-vlan-filter\"\r\nfeature is disabled, so the 8021q module will not remove VLAN 0 and the\r\nmemory will be leaked [1].\r\n\r\nAnother problem that can happen is that the kernel can automatically\r\ndelete VLAN 0 when the device is put administratively down despite not\r\nadding it when the device was put administratively up since during that\r\ntime the \"rx-vlan-filter\" feature was disabled. null-ptr-unref or\r\nbug_on[2] will be triggered by unregister_vlan_dev() for refcount\r\nimbalance if toggling filtering during runtime:\r\n\r\n$ ip link add bond0 type bond mode 0\r\n$ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q\r\n$ ethtool -K bond0 rx-vlan-filter off\r\n$ ifconfig bond0 up\r\n$ ethtool -K bond0 rx-vlan-filter on\r\n$ ifconfig bond0 down\r\n$ ip link del vlan0\r\n\r\nRoot cause is as below:\r\nstep1: add vlan0 for real_dev, such as bond, team.\r\nregister_vlan_dev\r\n vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1\r\nstep2: disable vlan filter feature and enable real_dev\r\nstep3: change filter from 0 to 1\r\nvlan_device_event\r\n vlan_filter_push_vids\r\n ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0\r\nstep4: real_dev down\r\nvlan_device_event\r\n vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0\r\n vlan_info_rcu_free //free vlan0\r\nstep5: delete vlan0\r\nunregister_vlan_dev\r\n BUG_ON(!vlan_info); //vlan_info is null\r\n\r\nFix both problems by noting in the VLAN info whether VLAN 0 was\r\nautomatically added upon NETDEV_UP and based on that decide whether it\r\nshould be deleted upon NETDEV_DOWN, regardless of the state of the\r\n\"rx-vlan-filter\" feature.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38470"
},
{
"cve": "CVE-2025-38471",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntls: always refresh the queue when reading sock\r\n\r\nAfter recent changes in net-next TCP compacts skbs much more\r\naggressively. This unearthed a bug in TLS where we may try\r\nto operate on an old skb when checking if all skbs in the\r\nqueue have matching decrypt state and geometry.\r\n\r\n BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls]\r\n (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544)\r\n Read of size 4 at addr ffff888013085750 by task tls/13529\r\n\r\n CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme\r\n Call Trace:\r\n kasan_report+0xca/0x100\r\n tls_strp_check_rcv+0x898/0x9a0 [tls]\r\n tls_rx_rec_wait+0x2c9/0x8d0 [tls]\r\n tls_sw_recvmsg+0x40f/0x1aa0 [tls]\r\n inet_recvmsg+0x1c3/0x1f0\r\n\r\nAlways reload the queue, fast path is to have the record in the queue\r\nwhen we wake, anyway (IOW the path going down \"if !strp->stm.full_len\").",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38471"
},
{
"cve": "CVE-2025-38477",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: sch_qfq: Fix race condition on qfq_aggregate\r\n\r\nA race condition can occur when 'agg' is modified in qfq_change_agg\r\n(called during qfq_enqueue) while other threads access it\r\nconcurrently. For example, qfq_dump_class may trigger a NULL\r\ndereference, and qfq_delete_class may cause a use-after-free.\r\n\r\nThis patch addresses the issue by:\r\n\r\n1. Moved qfq_destroy_class into the critical section.\r\n\r\n2. Added sch_tree_lock protection to qfq_dump_class and\r\nqfq_dump_class_stats.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38477"
},
{
"cve": "CVE-2025-38498",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndo_change_type(): refuse to operate on unmounted/not ours mounts\n\nEnsure that propagation settings can only be changed for mounts located\nin the caller's mount namespace. This change aligns permission checking\nwith the rest of mount(2).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38498"
},
{
"cve": "CVE-2025-38499",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\r\n\r\nWhat we want is to verify there is that clone won't expose something\r\nhidden by a mount we wouldn't be able to undo. \"Wouldn't be able to undo\"\r\nmay be a result of MNT_LOCKED on a child, but it may also come from\r\nlacking admin rights in the userns of the namespace mount belongs to.\r\n\r\nclone_private_mnt() checks the former, but not the latter.\r\n\r\nThere's a number of rather confusing CAP_SYS_ADMIN checks in various\r\nuserns during the mount, especially with the new mount API; they serve\r\ndifferent purposes and in case of clone_private_mnt() they usually,\r\nbut not always end up covering the missing check mentioned above.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38499"
},
{
"cve": "CVE-2025-38614",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: Fix semi-unbounded recursion\n\nEnsure that epoll instances can never form a graph deeper than\nEP_MAX_NESTS+1 links.\n\nCurrently, ep_loop_check_proc() ensures that the graph is loop-free and\ndoes some recursion depth checks, but those recursion depth checks don't\nlimit the depth of the resulting tree for two reasons:\n\n - They don't look upwards in the tree.\n - If there are multiple downwards paths of different lengths, only one of\n the paths is actually considered for the depth check since commit\n 28d82dc1c4ed (\"epoll: limit paths\").\n\nEssentially, the current recursion depth check in ep_loop_check_proc() just\nserves to prevent it from recursing too deeply while checking for loops.\n\nA more thorough check is done in reverse_path_check() after the new graph\nedge has already been created; this checks, among other things, that no\npaths going upwards from any non-epoll file with a length of more than 5\nedges exist. However, this check does not apply to non-epoll files.\n\nAs a result, it is possible to recurse to a depth of at least roughly 500,\ntested on v6.15. (I am unsure if deeper recursion is possible; and this may\nhave changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion\nproblem\").)\n\nTo fix it:\n\n1. In ep_loop_check_proc(), note the subtree depth of each visited node,\nand use subtree depths for the total depth calculation even when a subtree\nhas already been visited.\n2. Add ep_get_upwards_depth_proc() for similarly determining the maximum\ndepth of an upwards walk.\n3. In ep_loop_check(), use these values to limit the total path length\nbetween epoll nodes to EP_MAX_NESTS edges.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38614"
},
{
"cve": "CVE-2025-38685",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix vmalloc out-of-bounds write in fast_imageblit\n\nThis issue triggers when a userspace program does an ioctl\nFBIOPUT_CON2FBMAP by passing console number and frame buffer number.\nIdeally this maps console to frame buffer and updates the screen if\nconsole is visible.\n\nAs part of mapping it has to do resize of console according to frame\nbuffer info. if this resize fails and returns from vc_do_resize() and\ncontinues further. At this point console and new frame buffer are mapped\nand sets display vars. Despite failure still it continue to proceed\nupdating the screen at later stages where vc_data is related to previous\nframe buffer and frame buffer info and display vars are mapped to new\nframe buffer and eventully leading to out-of-bounds write in\nfast_imageblit(). This bheviour is excepted only when fg_console is\nequal to requested console which is a visible console and updates screen\nwith invalid struct references in fbcon_putcs().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38685"
},
{
"cve": "CVE-2025-38691",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix uninited ptr deref in block/scsi layout\n\nThe error occurs on the third attempt to encode extents. When function\next_tree_prepare_commit() reallocates a larger buffer to retry encoding\nextents, the \"layoutupdate_pages\" page array is initialized only after the\nretry loop. But ext_tree_free_commitdata() is called on every iteration\nand tries to put pages in the array, thus dereferencing uninitialized\npointers.\n\nAn additional problem is that there is no limit on the maximum possible\nbuffer_size. When there are too many extents, the client may create a\nlayoutcommit that is larger than the maximum possible RPC size accepted\nby the server.\n\nDuring testing, we observed two typical scenarios. First, one memory page\nfor extents is enough when we work with small files, append data to the\nend of the file, or preallocate extents before writing. But when we fill\na new large file without preallocating, the number of extents can be huge,\nand counting the number of written extents in ext_tree_encode_commit()\ndoes not help much. Since this number increases even more between\nunlocking and locking of ext_tree, the reallocated buffer may not be\nlarge enough again and again.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38691"
},
{
"cve": "CVE-2025-38701",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: do not BUG when INLINE_DATA_FL lacks system.data xattr\n\nA syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data()\nwhen an inode had the INLINE_DATA_FL flag set but was missing the\nsystem.data extended attribute.\n\nSince this can happen due to a maiciouly fuzzed file system, we\nshouldn't BUG, but rather, report it as a corrupted file system.\n\nAdd similar replacements of BUG_ON with EXT4_ERROR_INODE() ii\next4_create_inline_data() and ext4_inline_data_truncate().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38701"
},
{
"cve": "CVE-2025-38702",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fix potential buffer overflow in do_register_framebuffer()\n\nThe current implementation may lead to buffer overflow when:\n1. Unregistration creates NULL gaps in registered_fb[]\n2. All array slots become occupied despite num_registered_fb < FB_MAX\n3. The registration loop exceeds array bounds\n\nAdd boundary check to prevent registered_fb[FB_MAX] access.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38702"
},
{
"cve": "CVE-2025-38704",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access\n\nIn the preparation stage of CPU online, if the corresponding\nthe rdp's->nocb_cb_kthread does not exist, will be created,\nthere is a situation where the rdp's rcuop kthreads creation fails,\nand then de-offload this CPU's rdp, does not assign this CPU's\nrdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and\nrdp's->rdp_gp->nocb_gp_kthread is still valid.\n\nThis will cause the subsequent re-offload operation of this offline\nCPU, which will pass the conditional check and the kthread_unpark()\nwill access invalid rdp's->nocb_cb_kthread pointer.\n\nThis commit therefore use rdp's->nocb_gp_kthread instead of\nrdp_gp's->nocb_gp_kthread for safety check.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38704"
},
{
"cve": "CVE-2025-38708",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: add missing kref_get in handle_write_conflicts\n\nWith `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes\nand handle write conflicts, so that even if you write to the same sector\nsimultaneously on both nodes, they end up with the identical data once\nthe writes are completed.\n\nIn handling \"superseeded\" writes, we forgot a kref_get,\nresulting in a premature drbd_destroy_device and use after free,\nand further to kernel crashes with symptoms.\n\nRelevance: No one should use DRBD as a random data generator, and apparently\nall users of \"two-primaries\" handle concurrent writes correctly on layer up.\nThat is cluster file systems use some distributed lock manager,\nand live migration in virtualization environments stops writes on one node\nbefore starting writes on the other node.\n\nWhich means that other than for \"test cases\",\nthis code path is never taken in real life.\n\nFYI, in DRBD 9, things are handled differently nowadays. We still detect\n\"write conflicts\", but no longer try to be smart about them.\nWe decided to disconnect hard instead: upper layers must not submit concurrent\nwrites. If they do, that's their fault.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38708"
},
{
"cve": "CVE-2025-38721",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: fix refcount leak on table dump\n\nThere is a reference count leak in ctnetlink_dump_table():\n if (res < 0) {\n nf_conntrack_get(&ct->ct_general); // HERE\n cb->args[1] = (unsigned long)ct;\n ...\n\nWhile its very unlikely, its possible that ct == last.\nIf this happens, then the refcount of ct was already incremented.\nThis 2nd increment is never undone.\n\nThis prevents the conntrack object from being released, which in turn\nkeeps prevents cnet->count from dropping back to 0.\n\nThis will then block the netns dismantle (or conntrack rmmod) as\nnf_conntrack_cleanup_net_list() will wait forever.\n\nThis can be reproduced by running conntrack_resize.sh selftest in a loop.\nIt takes ~20 minutes for me on a preemptible kernel on average before\nI see a runaway kworker spinning in nf_conntrack_cleanup_net_list.\n\nOne fix would to change this to:\n if (res < 0) {\n\t\tif (ct != last)\n\t nf_conntrack_get(&ct->ct_general);\n\nBut this reference counting isn't needed in the first place.\nWe can just store a cookie value instead.\n\nA followup patch will do the same for ctnetlink_exp_dump_table,\nit looks to me as if this has the same problem and like\nctnetlink_dump_table, we only need a 'skip hint', not the actual\nobject so we can apply the same cookie strategy there as well.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38721"
},
{
"cve": "CVE-2025-38724",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()\n\nLei Lu recently reported that nfsd4_setclientid_confirm() did not check\nthe return value from get_client_locked(). a SETCLIENTID_CONFIRM could\nrace with a confirmed client expiring and fail to get a reference. That\ncould later lead to a UAF.\n\nFix this by getting a reference early in the case where there is an\nextant confirmed client. If that fails then treat it as if there were no\nconfirmed client found at all.\n\nIn the case where the unconfirmed client is expiring, just fail and\nreturn the result from get_client_locked().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38724"
},
{
"cve": "CVE-2025-38727",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition ('Infinite Loop')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid infinite retry looping in netlink_unicast()\n\nnetlink_attachskb() checks for the socket's read memory allocation\nconstraints. Firstly, it has:\n\n rmem < READ_ONCE(sk->sk_rcvbuf)\n\nto check if the just increased rmem value fits into the socket's receive\nbuffer. If not, it proceeds and tries to wait for the memory under:\n\n rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)\n\nThe checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is\nequal to sk->sk_rcvbuf. Thus the function neither successfully accepts\nthese conditions, nor manages to reschedule the task - and is called in\nretry loop for indefinite time which is caught as:\n\n rcu: INFO: rcu_sched self-detected stall on CPU\n rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212\n (t=26000 jiffies g=230833 q=259957)\n NMI backtrace for cpu 0\n CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014\n Call Trace:\n \n dump_stack lib/dump_stack.c:120\n nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105\n nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62\n rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335\n rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590\n update_process_times kernel/time/timer.c:1953\n tick_sched_handle kernel/time/tick-sched.c:227\n tick_sched_timer kernel/time/tick-sched.c:1399\n __hrtimer_run_queues kernel/time/hrtimer.c:1652\n hrtimer_interrupt kernel/time/hrtimer.c:1717\n __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113\n asm_call_irq_on_stack arch/x86/entry/entry_64.S:808\n \n\n netlink_attachskb net/netlink/af_netlink.c:1234\n netlink_unicast net/netlink/af_netlink.c:1349\n kauditd_send_queue kernel/audit.c:776\n kauditd_thread kernel/audit.c:897\n kthread kernel/kthread.c:328\n ret_from_fork arch/x86/entry/entry_64.S:304\n\nRestore the original behavior of the check which commit in Fixes\naccidentally missed when restructuring the code.\n\nFound by Linux Verification Center (linuxtesting.org).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-38727"
},
{
"cve": "CVE-2025-39683",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Limit access to parser->buffer when trace_get_user failed\n\nWhen the length of the string written to set_ftrace_filter exceeds\nFTRACE_BUFF_MAX, the following KASAN alarm will be triggered:\n\nBUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0\nRead of size 1 at addr ffff0000d00bd5ba by task ash/165\n\nCPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty\nHardware name: linux,dummy-virt (DT)\nCall trace:\n show_stack+0x34/0x50 (C)\n dump_stack_lvl+0xa0/0x158\n print_address_description.constprop.0+0x88/0x398\n print_report+0xb0/0x280\n kasan_report+0xa4/0xf0\n __asan_report_load1_noabort+0x20/0x30\n strsep+0x18c/0x1b0\n ftrace_process_regex.isra.0+0x100/0x2d8\n ftrace_regex_release+0x484/0x618\n __fput+0x364/0xa58\n ____fput+0x28/0x40\n task_work_run+0x154/0x278\n do_notify_resume+0x1f0/0x220\n el0_svc+0xec/0xf0\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1ac/0x1b0\n\nThe reason is that trace_get_user will fail when processing a string\nlonger than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0.\nThen an OOB access will be triggered in ftrace_regex_release->\nftrace_process_regex->strsep->strpbrk. We can solve this problem by\nlimiting access to parser->buffer when trace_get_user failed.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39683"
},
{
"cve": "CVE-2025-39689",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Also allocate and copy hash for reading of filter files\n\nCurrently the reader of set_ftrace_filter and set_ftrace_notrace just adds\nthe pointer to the global tracer hash to its iterator. Unlike the writer\nthat allocates a copy of the hash, the reader keeps the pointer to the\nfilter hashes. This is problematic because this pointer is static across\nfunction calls that release the locks that can update the global tracer\nhashes. This can cause UAF and similar bugs.\n\nAllocate and copy the hash for reading the filter files like it is done\nfor the writers. This not only fixes UAF bugs, but also makes the code a\nbit simpler as it doesn't have to differentiate when to free the\niterator's hash between writers and readers.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39689"
},
{
"cve": "CVE-2025-39697",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a race when updating an existing write\n\nAfter nfs_lock_and_join_requests() tests for whether the request is\nstill attached to the mapping, nothing prevents a call to\nnfs_inode_remove_request() from succeeding until we actually lock the\npage group.\nThe reason is that whoever called nfs_inode_remove_request() doesn't\nnecessarily have a lock on the page group head.\n\nSo in order to avoid races, let's take the page group lock earlier in\nnfs_lock_and_join_requests(), and hold it across the removal of the\nrequest in nfs_inode_remove_request().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39697"
},
{
"cve": "CVE-2025-39724",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: fix panic due to PSLVERR\n\nWhen the PSLVERR_RESP_EN parameter is set to 1, the device generates\nan error response if an attempt is made to read an empty RBR (Receive\nBuffer Register) while the FIFO is enabled.\n\nIn serial8250_do_startup(), calling serial_port_out(port, UART_LCR,\nUART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes\ndw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter\nfunction enables the FIFO via serial_out(p, UART_FCR, p->fcr).\nExecution proceeds to the serial_port_in(port, UART_RX).\nThis satisfies the PSLVERR trigger condition.\n\nWhen another CPU (e.g., using printk()) is accessing the UART (UART\nis busy), the current CPU fails the check (value & ~UART_LCR_SPAR) ==\n(lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter\ndw8250_force_idle().\n\nPut serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock\nto fix this issue.\n\nPanic backtrace:\n[ 0.442336] Oops - unknown exception [#1]\n[ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a\n[ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e\n...\n[ 0.442416] console_on_rootfs+0x26/0x70",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39724"
},
{
"cve": "CVE-2025-39748",
"cwe": {
"id": "CWE-478",
"name": "Missing Default Case in Multiple Condition Expression"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Forget ranges when refining tnum after JSET\n\nSyzbot reported a kernel warning due to a range invariant violation on\nthe following BPF program.\n\n 0: call bpf_get_netns_cookie\n 1: if r0 == 0 goto \n 2: if r0 & Oxffffffff goto \n\nThe issue is on the path where we fall through both jumps.\n\nThat path is unreachable at runtime: after insn 1, we know r0 != 0, but\nwith the sign extension on the jset, we would only fallthrough insn 2\nif r0 == 0. Unfortunately, is_branch_taken() isn't currently able to\nfigure this out, so the verifier walks all branches. The verifier then\nrefines the register bounds using the second condition and we end\nup with inconsistent bounds on this unreachable path:\n\n 1: if r0 == 0 goto \n r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff)\n 2: if r0 & 0xffffffff goto \n r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0)\n r0 after reg_bounds_sync: u64=[0x1, 0] var_off=(0, 0)\n\nImproving the range refinement for JSET to cover all cases is tricky. We\nalso don't expect many users to rely on JSET given LLVM doesn't generate\nthose instructions. So instead of improving the range refinement for\nJSETs, Eduard suggested we forget the ranges whenever we're narrowing\ntnums after a JSET. This patch implements that approach.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39748"
},
{
"cve": "CVE-2025-39756",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Prevent file descriptor table allocations exceeding INT_MAX\n\nWhen sysctl_nr_open is set to a very high value (for example, 1073741816\nas set by systemd), processes attempting to use file descriptors near\nthe limit can trigger massive memory allocation attempts that exceed\nINT_MAX, resulting in a WARNING in mm/slub.c:\n\n WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288\n\nThis happens because kvmalloc_array() and kvmalloc() check if the\nrequested size exceeds INT_MAX and emit a warning when the allocation is\nnot flagged with __GFP_NOWARN.\n\nSpecifically, when nr_open is set to 1073741816 (0x3ffffff8) and a\nprocess calls dup2(oldfd, 1073741880), the kernel attempts to allocate:\n- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes\n- Multiple bitmaps: ~400MB\n- Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647)\n\nReproducer:\n1. Set /proc/sys/fs/nr_open to 1073741816:\n # echo 1073741816 > /proc/sys/fs/nr_open\n\n2. Run a program that uses a high file descriptor:\n #include \n #include \n\n int main() {\n struct rlimit rlim = {1073741824, 1073741824};\n setrlimit(RLIMIT_NOFILE, &rlim);\n dup2(2, 1073741880); // Triggers the warning\n return 0;\n }\n\n3. Observe WARNING in dmesg at mm/slub.c:5027\n\nsystemd commit a8b627a introduced automatic bumping of fs.nr_open to the\nmaximum possible value. The rationale was that systems with memory\ncontrol groups (memcg) no longer need separate file descriptor limits\nsince memory is properly accounted. However, this change overlooked\nthat:\n\n1. The kernel's allocation functions still enforce INT_MAX as a maximum\n size regardless of memcg accounting\n2. Programs and tests that legitimately test file descriptor limits can\n inadvertently trigger massive allocations\n3. The resulting allocations (>8GB) are impractical and will always fail\n\nsystemd's algorithm starts with INT_MAX and keeps halving the value\nuntil the kernel accepts it. On most systems, this results in nr_open\nbeing set to 1073741816 (0x3ffffff8), which is just under 1GB of file\ndescriptors.\n\nWhile processes rarely use file descriptors near this limit in normal\noperation, certain selftests (like\ntools/testing/selftests/core/unshare_test.c) and programs that test file\ndescriptor limits can trigger this issue.\n\nFix this by adding a check in alloc_fdtable() to ensure the requested\nallocation size does not exceed INT_MAX. This causes the operation to\nfail with -EMFILE instead of triggering a kernel warning and avoids the\nimpractical >8GB memory allocation request.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39756"
},
{
"cve": "CVE-2025-39764",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: remove refcounting in expectation dumpers\n\nSame pattern as previous patch: do not keep the expectation object\nalive via refcount, only store a cookie value and then use that\nas the skip hint for dump resumption.\n\nAFAICS this has the same issue as the one resolved in the conntrack\ndumper, when we do\n if (!refcount_inc_not_zero(&exp->use))\n\nto increment the refcount, there is a chance that exp == last, which\ncauses a double-increment of the refcount and subsequent memory leak.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39764"
},
{
"cve": "CVE-2025-39770",
"cwe": {
"id": "CWE-573",
"name": "Improper Following of Specification by Caller"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM\n\nWhen performing Generic Segmentation Offload (GSO) on an IPv6 packet that\ncontains extension headers, the kernel incorrectly requests checksum offload\nif the egress device only advertises NETIF_F_IPV6_CSUM feature, which has\na strict contract: it supports checksum offload only for plain TCP or UDP\nover IPv6 and explicitly does not support packets with extension headers.\nThe current GSO logic violates this contract by failing to disable the feature\nfor packets with extension headers, such as those used in GREoIPv6 tunnels.\n\nThis violation results in the device being asked to perform an operation\nit cannot support, leading to a `skb_warn_bad_offload` warning and a collapse\nof network throughput. While device TSO/USO is correctly bypassed in favor\nof software GSO for these packets, the GSO stack must be explicitly told not\nto request checksum offload.\n\nMask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4\nin gso_features_check if the IPv6 header contains extension headers to compute\nchecksum in software.\n\nThe exception is a BIG TCP extension, which, as stated in commit\n68e068cabd2c6c53 (\"net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\"):\n\"The feature is only enabled on devices that support BIG TCP TSO.\nThe header is only present for PF_PACKET taps like tcpdump,\nand not transmitted by physical devices.\"\n\nkernel log output (truncated):\nWARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140\n...\nCall Trace:\n \n skb_checksum_help+0x12a/0x1f0\n validate_xmit_skb+0x1a3/0x2d0\n validate_xmit_skb_list+0x4f/0x80\n sch_direct_xmit+0x1a2/0x380\n __dev_xmit_skb+0x242/0x670\n __dev_queue_xmit+0x3fc/0x7f0\n ip6_finish_output2+0x25e/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel]\n ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre]\n dev_hard_start_xmit+0x63/0x1c0\n __dev_queue_xmit+0x6d0/0x7f0\n ip6_finish_output2+0x214/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n inet6_csk_xmit+0xeb/0x150\n __tcp_transmit_skb+0x555/0xa80\n tcp_write_xmit+0x32a/0xe90\n tcp_sendmsg_locked+0x437/0x1110\n tcp_sendmsg+0x2f/0x50\n...\nskb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e\nskb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00\nskb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00\nskb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00\nskb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00\nskb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00\nskb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9\nskb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01\nskb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39770"
},
{
"cve": "CVE-2025-39773",
"cwe": {
"id": "CWE-667",
"name": "Improper Locking"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix soft lockup in br_multicast_query_expired()\n\nWhen set multicast_query_interval to a large value, the local variable\n'time' in br_multicast_send_query() may overflow. If the time is smaller\nthan jiffies, the timer will expire immediately, and then call mod_timer()\nagain, which creates a loop and may trigger the following soft lockup\nissue.\n\n watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66]\n CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none)\n Call Trace:\n \n __netdev_alloc_skb+0x2e/0x3a0\n br_ip6_multicast_alloc_query+0x212/0x1b70\n __br_multicast_send_query+0x376/0xac0\n br_multicast_send_query+0x299/0x510\n br_multicast_query_expired.constprop.0+0x16d/0x1b0\n call_timer_fn+0x3b/0x2a0\n __run_timers+0x619/0x950\n run_timer_softirq+0x11c/0x220\n handle_softirqs+0x18e/0x560\n __irq_exit_rcu+0x158/0x1a0\n sysvec_apic_timer_interrupt+0x76/0x90\n \n\nThis issue can be reproduced with:\n ip link add br0 type bridge\n echo 1 > /sys/class/net/br0/bridge/multicast_querier\n echo 0xffffffffffffffff >\n \t/sys/class/net/br0/bridge/multicast_query_interval\n ip link set dev br0 up\n\nThe multicast_startup_query_interval can also cause this issue. Similar to\nthe commit 99b40610956a (\"net: bridge: mcast: add and enforce query\ninterval minimum\"), add check for the query interval maximum to fix this\nissue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39773"
},
{
"cve": "CVE-2025-39783",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: Fix configfs group list head handling\n\nDoing a list_del() on the epf_group field of struct pci_epf_driver in\npci_epf_remove_cfs() is not correct as this field is a list head, not\na list entry. This list_del() call triggers a KASAN warning when an\nendpoint function driver which has a configfs attribute group is torn\ndown:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198\nWrite of size 8 at addr ffff00010f4a0d80 by task rmmod/319\n\nCPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE\nHardware name: Radxa ROCK 5B (DT)\nCall trace:\nshow_stack+0x2c/0x84 (C)\ndump_stack_lvl+0x70/0x98\nprint_report+0x17c/0x538\nkasan_report+0xb8/0x190\n__asan_report_store8_noabort+0x20/0x2c\npci_epf_remove_cfs+0x17c/0x198\npci_epf_unregister_driver+0x18/0x30\nnvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf]\n__arm64_sys_delete_module+0x264/0x424\ninvoke_syscall+0x70/0x260\nel0_svc_common.constprop.0+0xac/0x230\ndo_el0_svc+0x40/0x58\nel0_svc+0x48/0xdc\nel0t_64_sync_handler+0x10c/0x138\nel0t_64_sync+0x198/0x19c\n...\n\nRemove this incorrect list_del() call from pci_epf_remove_cfs().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39783"
},
{
"cve": "CVE-2025-39787",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: mdt_loader: Ensure we don't read past the ELF header\n\nWhen the MDT loader is used in remoteproc, the ELF header is sanitized\nbeforehand, but that's not necessary the case for other clients.\n\nValidate the size of the firmware buffer to ensure that we don't read\npast the end as we iterate over the header. e_phentsize and e_shentsize\nare validated as well, to ensure that the assumptions about step size in\nthe traversal are valid.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39787"
},
{
"cve": "CVE-2025-39795",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: avoid possible overflow for chunk_sectors check in blk_stack_limits()\n\nIn blk_stack_limits(), we check that the t->chunk_sectors value is a\nmultiple of the t->physical_block_size value.\n\nHowever, by finding the chunk_sectors value in bytes, we may overflow\nthe unsigned int which holds chunk_sectors, so change the check to be\nbased on sectors.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39795"
},
{
"cve": "CVE-2025-39798",
"cwe": {
"id": "CWE-273",
"name": "Improper Check for Dropped Privileges"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39798"
},
{
"cve": "CVE-2025-39866",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: writeback: fix use-after-free in __mark_inode_dirty()\n\nAn use-after-free issue occurred when __mark_inode_dirty() get the\nbdi_writeback that was in the progress of switching.\n\nCPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1\n......\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __mark_inode_dirty+0x124/0x418\nlr : __mark_inode_dirty+0x118/0x418\nsp : ffffffc08c9dbbc0\n........\nCall trace:\n __mark_inode_dirty+0x124/0x418\n generic_update_time+0x4c/0x60\n file_modified+0xcc/0xd0\n ext4_buffered_write_iter+0x58/0x124\n ext4_file_write_iter+0x54/0x704\n vfs_write+0x1c0/0x308\n ksys_write+0x74/0x10c\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x114\n el0_svc_common.constprop.0+0xc0/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x40/0xe4\n el0t_64_sync_handler+0x120/0x12c\n el0t_64_sync+0x194/0x198\n\nRoot cause is:\n\nsystemd-random-seed kworker\n----------------------------------------------------------------------\n___mark_inode_dirty inode_switch_wbs_work_fn\n\n spin_lock(&inode->i_lock);\n inode_attach_wb\n locked_inode_to_wb_and_lock_list\n get inode->i_wb\n spin_unlock(&inode->i_lock);\n spin_lock(&wb->list_lock)\n spin_lock(&inode->i_lock)\n inode_io_list_move_locked\n spin_unlock(&wb->list_lock)\n spin_unlock(&inode->i_lock)\n spin_lock(&old_wb->list_lock)\n inode_do_switch_wbs\n spin_lock(&inode->i_lock)\n inode->i_wb = new_wb\n spin_unlock(&inode->i_lock)\n spin_unlock(&old_wb->list_lock)\n wb_put_many(old_wb, nr_switched)\n cgwb_release\n old wb released\n wb_wakeup_delayed() accesses wb,\n then trigger the use-after-free\n issue\n\nFix this race condition by holding inode spinlock until\nwb_wakeup_delayed() finished.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39866"
},
{
"cve": "CVE-2025-39929",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path\n\nDuring tests of another unrelated patch I was able to trigger this\nerror: Objects remaining on __kmem_cache_shutdown()",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39929"
},
{
"cve": "CVE-2025-39931",
"cwe": {
"id": "CWE-457",
"name": "Use of Uninitialized Variable"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Set merge to zero early in af_alg_sendmsg\n\nIf an error causes af_alg_sendmsg to abort, ctx->merge may contain\na garbage value from the previous loop. This may then trigger a\ncrash on the next entry into af_alg_sendmsg when it attempts to do\na merge that can't be done.\n\nFix this by setting ctx->merge to zero near the start of the loop.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39931"
},
{
"cve": "CVE-2025-39977",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent use-after-free during requeue-PI\n\nsyzbot managed to trigger the following race:\n\n T1 T2\n\n futex_wait_requeue_pi()\n futex_do_wait()\n schedule()\n futex_requeue()\n futex_proxy_trylock_atomic()\n futex_requeue_pi_prepare()\n requeue_pi_wake_futex()\n futex_requeue_pi_complete()\n /* preempt */\n\n * timeout/ signal wakes T1 *\n\n futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED\n futex_hash_put()\n // back to userland, on stack futex_q is garbage\n\n /* back */\n wake_up_state(q->task, TASK_NORMAL);\n\nIn this scenario futex_wait_requeue_pi() is able to leave without using\nfutex_q::lock_ptr for synchronization.\n\nThis can be prevented by reading futex_q::task before updating the\nfutex_q::requeue_state. A reference on the task_struct is not needed\nbecause requeue_pi_wake_futex() is invoked with a spinlock_t held which\nimplies a RCU read section.\n\nEven if T1 terminates immediately after, the task_struct will remain valid\nduring T2's wake_up_state(). A READ_ONCE on futex_q::task before\nfutex_requeue_pi_complete() is enough because it ensures that the variable\nis read before the state is updated.\n\nRead futex_q::task before updating the requeue state, use it for the\nfollowing wakeup.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-39977"
},
{
"cve": "CVE-2025-40022",
"cwe": {
"id": "CWE-704",
"name": "Incorrect Type Conversion or Cast"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix incorrect boolean values in af_alg_ctx\n\nCommit 1b34cbbf4f01 (\"crypto: af_alg - Disallow concurrent writes in\naf_alg_sendmsg\") changed some fields from bool to 1-bit bitfields of\ntype u32.\n\nHowever, some assignments to these fields, specifically 'more' and\n'merge', assign values greater than 1. These relied on C's implicit\nconversion to bool, such that zero becomes false and nonzero becomes\ntrue.\n\nWith a 1-bit bitfields of type u32 instead, mod 2 of the value is taken\ninstead, resulting in 0 being assigned in some cases when 1 was intended.\n\nFix this by restoring the bool type.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-40022"
},
{
"cve": "CVE-2025-40135",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU in ip6_xmit()\n\nUse RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent\npossible UAF.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-40135"
},
{
"cve": "CVE-2025-40219",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/IOV: Fix race between SR-IOV enable/disable and hotplug\n\nCommit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking when\nenabling/disabling SR-IOV\") tried to fix a race between the VF removal\ninside sriov_del_vfs() and concurrent hot unplug by taking the PCI\nrescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock\nwas also taken in sriov_add_vfs() to protect addition of VFs.\n\nThis approach however causes deadlock on trying to remove PFs with SR-IOV\nenabled because PFs disable SR-IOV during removal and this removal happens\nunder the PCI rescan/remove lock. So the original fix had to be reverted.\n\nInstead of taking the PCI rescan/remove lock in sriov_add_vfs() and\nsriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs\nhotplug higher up in the callchain by taking the lock in\nsriov_numvfs_store() before calling into the driver's sriov_configure()\ncallback.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-40219"
},
{
"cve": "CVE-2025-40261",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()\n\nnvme_fc_delete_assocation() waits for pending I/O to complete before\nreturning, and an error can cause ->ioerr_work to be queued after\ncancel_work_sync() had been called. Move the call to cancel_work_sync() to\nbe after nvme_fc_delete_association() to ensure ->ioerr_work is not running\nwhen the nvme_fc_ctrl object is freed. Otherwise the following can occur:\n\n[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL\n[ 1135.917705] ------------[ cut here ]------------\n[ 1135.922336] kernel BUG at lib/list_debug.c:52!\n[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)\n[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025\n[ 1135.950969] Workqueue: 0x0 (nvme-wq)\n[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b\n[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046\n[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000\n[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0\n[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08\n[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100\n[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0\n[ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000\n[ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0\n[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[ 1136.055910] PKRU: 55555554\n[ 1136.058623] Call Trace:\n[ 1136.061074] \n[ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.071898] ? move_linked_works+0x4a/0xa0\n[ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.081744] ? __die_body.cold+0x8/0x12\n[ 1136.085584] ? die+0x2e/0x50\n[ 1136.088469] ? do_trap+0xca/0x110\n[ 1136.091789] ? do_error_trap+0x65/0x80\n[ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.101289] ? exc_invalid_op+0x50/0x70\n[ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20\n[ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.120806] move_linked_works+0x4a/0xa0\n[ 1136.124733] worker_thread+0x216/0x3a0\n[ 1136.128485] ? __pfx_worker_thread+0x10/0x10\n[ 1136.132758] kthread+0xfa/0x240\n[ 1136.135904] ? __pfx_kthread+0x10/0x10\n[ 1136.139657] ret_from_fork+0x31/0x50\n[ 1136.143236] ? __pfx_kthread+0x10/0x10\n[ 1136.146988] ret_from_fork_asm+0x1a/0x30\n[ 1136.150915] ",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-40261"
},
{
"cve": "CVE-2025-46836",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-46836"
},
{
"cve": "CVE-2025-59375",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "description",
"text": "libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-59375"
},
{
"cve": "CVE-2025-66382",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "description",
"text": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-66382"
},
{
"cve": "CVE-2025-68206",
"cwe": {
"id": "CWE-166",
"name": "Improper Handling of Missing Special Element"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: add seqadj extension for natted connections\n\nSequence adjustment may be required for FTP traffic with PASV/EPSV modes.\ndue to need to re-write packet payload (IP, port) on the ftp control\nconnection. This can require changes to the TCP length and expected\nseq / ack_seq.\n\nThe easiest way to reproduce this issue is with PASV mode.\nExample ruleset:\ntable inet ftp_nat {\n ct helper ftp_helper {\n type \"ftp\" protocol tcp\n l3proto inet\n }\n\n chain prerouting {\n type filter hook prerouting priority 0; policy accept;\n tcp dport 21 ct state new ct helper set \"ftp_helper\"\n }\n}\ntable ip nat {\n chain prerouting {\n type nat hook prerouting priority -100; policy accept;\n tcp dport 21 dnat ip prefix to ip daddr map {\n\t\t\t192.168.100.1 : 192.168.13.2/32 }\n }\n\n chain postrouting {\n type nat hook postrouting priority 100 ; policy accept;\n tcp sport 21 snat ip prefix to ip saddr map {\n\t\t\t192.168.13.2 : 192.168.100.1/32 }\n }\n}\n\nNote that the ftp helper gets assigned *after* the dnat setup.\n\nThe inverse (nat after helper assign) is handled by an existing\ncheck in nf_nat_setup_info() and will not show the problem.\n\nTopoloy:\n\n +-------------------+ +----------------------------------+\n | FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 |\n +-------------------+ +----------------------------------+\n |\n +-----------------------+\n | Client: 192.168.100.2 |\n +-----------------------+\n\nftp nat changes do not work as expected in this case:\nConnected to 192.168.100.1.\n[..]\nftp> epsv\nEPSV/EPRT on IPv4 off.\nftp> ls\n227 Entering passive mode (192,168,100,1,209,129).\n421 Service not available, remote server has closed connection.\n\nKernel logs:\nMissing nfct_seqadj_ext_add() setup call\nWARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41\n[..]\n __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]\n nf_nat_ftp+0x142/0x280 [nf_nat_ftp]\n help+0x4d1/0x880 [nf_conntrack_ftp]\n nf_confirm+0x122/0x2e0 [nf_conntrack]\n nf_hook_slow+0x3c/0xb0\n ..\n\nFix this by adding the required extension when a conntrack helper is assigned\nto a connection that has a nat binding.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-68206"
},
{
"cve": "CVE-2025-68265",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller's admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller's 'put' to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15\n Tainted: [E]=UNSIGNED_MODULE\n Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n Call Trace:\n \n dump_stack_lvl+0x4f/0x60\n print_report+0xc4/0x620\n ? _raw_spin_lock_irqsave+0x70/0xb0\n ? _raw_read_unlock_irqrestore+0x30/0x30\n ? blk_queue_enter+0x41c/0x4a0\n kasan_report+0xab/0xe0\n ? blk_queue_enter+0x41c/0x4a0\n blk_queue_enter+0x41c/0x4a0\n ? __irq_work_queue_local+0x75/0x1d0\n ? blk_queue_start_drain+0x70/0x70\n ? irq_work_queue+0x18/0x20\n ? vprintk_emit.part.0+0x1cc/0x350\n ? wake_up_klogd_work_func+0x60/0x60\n blk_mq_alloc_request+0x2b7/0x6b0\n ? __blk_mq_alloc_requests+0x1060/0x1060\n ? __switch_to+0x5b7/0x1060\n nvme_submit_user_cmd+0xa9/0x330\n nvme_user_cmd.isra.0+0x240/0x3f0\n ? force_sigsegv+0xe0/0xe0\n ? nvme_user_cmd64+0x400/0x400\n ? vfs_fileattr_set+0x9b0/0x9b0\n ? cgroup_update_frozen_flag+0x24/0x1c0\n ? cgroup_leave_frozen+0x204/0x330\n ? nvme_ioctl+0x7c/0x2c0\n blkdev_ioctl+0x1a8/0x4d0\n ? blkdev_common_ioctl+0x1930/0x1930\n ? fdget+0x54/0x380\n __x64_sys_ioctl+0x129/0x190\n do_syscall_64+0x5b/0x160\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f765f703b0b\n Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n ",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-68265"
},
{
"cve": "CVE-2025-71161",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition ('Infinite Loop')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: disable recursive forward error correction\n\nThere are two problems with the recursive correction:\n\n1. It may cause denial-of-service. In fec_read_bufs, there is a loop that\nhas 253 iterations. For each iteration, we may call verity_hash_for_block\nrecursively. There is a limit of 4 nested recursions - that means that\nthere may be at most 253^4 (4 billion) iterations. Red Hat QE team\nactually created an image that pushes dm-verity to this limit - and this\nimage just makes the udev-worker process get stuck in the 'D' state.\n\n2. It doesn't work. In fec_read_bufs we store data into the variable\n\"fio->bufs\", but fio bufs is shared between recursive invocations, if\n\"verity_hash_for_block\" invoked correction recursively, it would\noverwrite partially filled fio->bufs.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-71161"
},
{
"cve": "CVE-2025-71221",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()\n\nAdd proper locking in mmp_pdma_residue() to prevent use-after-free when\naccessing descriptor list and descriptor contents.\n\nThe race occurs when multiple threads call tx_status() while the tasklet\non another CPU is freeing completed descriptors:\n\nCPU 0 CPU 1\n----- -----\nmmp_pdma_tx_status()\nmmp_pdma_residue()\n -> NO LOCK held\n list_for_each_entry(sw, ..)\n DMA interrupt\n dma_do_tasklet()\n -> spin_lock(&desc_lock)\n list_move(sw->node, ...)\n spin_unlock(&desc_lock)\n | dma_pool_free(sw) <- FREED!\n -> access sw->desc <- UAF!\n\nThis issue can be reproduced when running dmatest on the same channel with\nmultiple threads (threads_per_chan > 1).\n\nFix by protecting the chain_running list iteration and descriptor access\nwith the chan->desc_lock spinlock.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-71221"
},
{
"cve": "CVE-2025-71265",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata\n\nWe found an infinite loop bug in the ntfs3 file system that can lead to a\nDenial-of-Service (DoS) condition.\n\nA malformed NTFS image can cause an infinite loop when an attribute header\nindicates an empty run list, while directory entries reference it as\ncontaining actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way\nto represent an empty run list, and run_unpack() correctly handles this by\nchecking if evcn + 1 equals svcn and returning early without parsing any run\ndata. However, this creates a problem when there is metadata inconsistency,\nwhere the attribute header claims to be empty (evcn=-1) but the caller\nexpects to read actual data. When run_unpack() immediately returns success\nupon seeing this condition, it leaves the runs_tree uninitialized with\nrun->runs as a NULL. The calling function attr_load_runs_range() assumes\nthat a successful return means that the runs were loaded and sets clen to 0,\nexpecting the next run_lookup_entry() call to succeed. Because runs_tree\nremains uninitialized, run_lookup_entry() continues to fail, and the loop\nincrements vcn by zero (vcn += 0), leading to an infinite loop.\n\nThis patch adds a retry counter to detect when run_lookup_entry() fails\nconsecutively after attr_load_runs_vcn(). If the run is still not found on\nthe second attempt, it indicates corrupted metadata and returns -EINVAL,\npreventing the Denial-of-Service (DoS) vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-71265"
},
{
"cve": "CVE-2025-71266",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition ('Infinite Loop')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: check return value of indx_find to avoid infinite loop\n\nWe found an infinite loop bug in the ntfs3 file system that can lead to a\nDenial-of-Service (DoS) condition.\n\nA malformed dentry in the ntfs3 filesystem can cause the kernel to hang\nduring the lookup operations. By setting the HAS_SUB_NODE flag in an\nINDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the\nVCN pointer, an attacker can cause the indx_find() function to repeatedly\nread the same block, allocating 4 KB of memory each time. The kernel lacks\nVCN loop detection and depth limits, causing memory exhaustion and an OOM\ncrash.\n\nThis patch adds a return value check for fnd_push() to prevent a memory\nexhaustion vulnerability caused by infinite loops. When the index exceeds the\nsize of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()\nfunction checks this return value and stops processing, preventing further\nmemory allocation.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-71266"
},
{
"cve": "CVE-2025-71267",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition ('Infinite Loop')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST\n\nWe found an infinite loop bug in the ntfs3 file system that can lead to a\nDenial-of-Service (DoS) condition.\n\nA malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute\nindicates a zero data size while the driver allocates memory for it.\n\nWhen ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set\nto zero, it still allocates memory because of al_aligned(0). This creates an\ninconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is\nnon-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute\nlist exists and enumerates only the primary MFT record. When it finds\nATTR_LIST, the code reloads it and restarts the enumeration, repeating\nindefinitely. The mount operation never completes, hanging the kernel thread.\n\nThis patch adds validation to ensure that data_size is non-zero before memory\nallocation. When a zero-sized ATTR_LIST is detected, the function returns\n-EINVAL, preventing a DoS vulnerability.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2025-71267"
},
{
"cve": "CVE-2026-3904",
"cwe": {
"id": "CWE-366",
"name": "Race Condition within a Thread"
},
"notes": [
{
"category": "description",
"text": "Calling NSS-backed functions that support caching via nscd may call the \nnscd client side code and in the GNU C Library version 2.36 under high \nload on x86_64 systems, the client may call memcmp on inputs that are \nconcurrently modified by other processes or threads and crash.\n\n\n\n\nThe nscd client in the GNU C Library uses the memcmp function with \ninputs that may be concurrently modified by another thread, potentially \nresulting in spurious cache misses, which in itself is not a security \nissue. However in the GNU C Library version 2.36 an optimized \nimplementation of memcmp was introduced for x86_64 which could crash \nwhen invoked with such undefined behaviour, turning this into a \npotential crash of the nscd client and the application that uses it. \nThis implementation was backported to the 2.35 branch, making the nscd \nclient in that branch vulnerable as well. Subsequently, the fix for \nthis issue was backported to all vulnerable branches in the GNU C \nLibrary repository.\n\n\nIt is advised that distributions that may have cherry-picked the memcpy \nSSE2 optimization in their copy of the GNU C Library, also apply the fix \nto avoid the potential crash in the nscd client.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-3904"
},
{
"cve": "CVE-2026-4046",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "description",
"text": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.\n\n\n\nThis vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-4046"
},
{
"cve": "CVE-2026-4437",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-4437"
},
{
"cve": "CVE-2026-4438",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-4438"
},
{
"cve": "CVE-2026-5435",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-5435"
},
{
"cve": "CVE-2026-5450",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-5450"
},
{
"cve": "CVE-2026-5928",
"cwe": {
"id": "CWE-127",
"name": "Buffer Under-read"
},
"notes": [
{
"category": "description",
"text": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-5928"
},
{
"cve": "CVE-2026-6238",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "description",
"text": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-6238"
},
{
"cve": "CVE-2026-23100",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb_pmd_shared()\n\nPatch series \"mm/hugetlb: fixes for PMD table sharing (incl. using\nmmu_gather)\", v3.\n\nOne functional fix, one performance regression fix, and two related\ncomment fixes.\n\nI cleaned up my prototype I recently shared [1] for the performance fix,\ndeferring most of the cleanups I had in the prototype to a later point. \nWhile doing that I identified the other things.\n\nThe goal of this patch set is to be backported to stable trees \"fairly\"\neasily. At least patch #1 and #4.\n\nPatch #1 fixes hugetlb_pmd_shared() not detecting any sharing\nPatch #2 + #3 are simple comment fixes that patch #4 interacts with.\nPatch #4 is a fix for the reported performance regression due to excessive\nIPI broadcasts during fork()+exit().\n\nThe last patch is all about TLB flushes, IPIs and mmu_gather.\nRead: complicated\n\nThere are plenty of cleanups in the future to be had + one reasonable\noptimization on x86. But that's all out of scope for this series.\n\nRuntime tested, with a focus on fixing the performance regression using\nthe original reproducer [2] on x86.\n\n\nThis patch (of 4):\n\nWe switched from (wrongly) using the page count to an independent shared\ncount. Now, shared page tables have a refcount of 1 (excluding\nspeculative references) and instead use ptdesc->pt_share_count to identify\nsharing.\n\nWe didn't convert hugetlb_pmd_shared(), so right now, we would never\ndetect a shared PMD table as such, because sharing/unsharing no longer\ntouches the refcount of a PMD table.\n\nPage migration, like mbind() or migrate_pages() would allow for migrating\nfolios mapped into such shared PMD tables, even though the folios are not\nexclusive. In smaps we would account them as \"private\" although they are\n\"shared\", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the\npagemap interface.\n\nFix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23100"
},
{
"cve": "CVE-2026-23111",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()\n\nnft_map_catchall_activate() has an inverted element activity check\ncompared to its non-catchall counterpart nft_mapelem_activate() and\ncompared to what is logically required.\n\nnft_map_catchall_activate() is called from the abort path to re-activate\ncatchall map elements that were deactivated during a failed transaction.\nIt should skip elements that are already active (they don't need\nre-activation) and process elements that are inactive (they need to be\nrestored). Instead, the current code does the opposite: it skips inactive\nelements and processes active ones.\n\nCompare the non-catchall activate callback, which is correct:\n\n nft_mapelem_activate():\n if (nft_set_elem_active(ext, iter->genmask))\n return 0; /* skip active, process inactive */\n\nWith the buggy catchall version:\n\n nft_map_catchall_activate():\n if (!nft_set_elem_active(ext, genmask))\n continue; /* skip inactive, process active */\n\nThe consequence is that when a DELSET operation is aborted,\nnft_setelem_data_activate() is never called for the catchall element.\nFor NFT_GOTO verdict elements, this means nft_data_hold() is never\ncalled to restore the chain->use reference count. Each abort cycle\npermanently decrements chain->use. Once chain->use reaches zero,\nDELCHAIN succeeds and frees the chain while catchall verdict elements\nstill reference it, resulting in a use-after-free.\n\nThis is exploitable for local privilege escalation from an unprivileged\nuser via user namespaces + nftables on distributions that enable\nCONFIG_USER_NS and CONFIG_NF_TABLES.\n\nFix by removing the negation so the check matches nft_mapelem_activate():\nskip active elements, process inactive ones.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23111"
},
{
"cve": "CVE-2026-23113",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition ('Infinite Loop')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop\n\nCurrently this is checked before running the pending work. Normally this\nis quite fine, as work items either end up blocking (which will create a\nnew worker for other items), or they complete fairly quickly. But syzbot\nreports an issue where io-wq takes seemingly forever to exit, and with a\nbit of debugging, this turns out to be because it queues a bunch of big\n(2GB - 4096b) reads with a /dev/msr* file. Since this file type doesn't\nsupport ->read_iter(), loop_rw_iter() ends up handling them. Each read\nreturns 16MB of data read, which takes 20 (!!) seconds. With a bunch of\nthese pending, processing the whole chain can take a long time. Easily\nlonger than the syzbot uninterruptible sleep timeout of 140 seconds.\nThis then triggers a complaint off the io-wq exit path:\n\nINFO: task syz.4.135:6326 blocked for more than 143 seconds.\n Not tainted syzkaller #0\n Blocked by coredump.\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:syz.4.135 state:D stack:26824 pid:6326 tgid:6324 ppid:5957 task_flags:0x400548 flags:0x00080000\nCall Trace:\n \n context_switch kernel/sched/core.c:5256 [inline]\n __schedule+0x1139/0x6150 kernel/sched/core.c:6863\n __schedule_loop kernel/sched/core.c:6945 [inline]\n schedule+0xe7/0x3a0 kernel/sched/core.c:6960\n schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75\n do_wait_for_common kernel/sched/completion.c:100 [inline]\n __wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121\n io_wq_exit_workers io_uring/io-wq.c:1328 [inline]\n io_wq_put_and_exit+0x271/0x8a0 io_uring/io-wq.c:1356\n io_uring_clean_tctx+0x10d/0x190 io_uring/tctx.c:203\n io_uring_cancel_generic+0x69c/0x9a0 io_uring/cancel.c:651\n io_uring_files_cancel include/linux/io_uring.h:19 [inline]\n do_exit+0x2ce/0x2bd0 kernel/exit.c:911\n do_group_exit+0xd3/0x2a0 kernel/exit.c:1112\n get_signal+0x2671/0x26d0 kernel/signal.c:3034\n arch_do_signal_or_restart+0x8f/0x7e0 arch/x86/kernel/signal.c:337\n __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]\n exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75\n __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]\n syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]\n syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]\n syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]\n do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fa02738f749\nRSP: 002b:00007fa0281ae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca\nRAX: fffffffffffffe00 RBX: 00007fa0275e6098 RCX: 00007fa02738f749\nRDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa0275e6098\nRBP: 00007fa0275e6090 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fa0275e6128 R14: 00007fff14e4fcb0 R15: 00007fff14e4fd98\n\nThere's really nothing wrong here, outside of processing these reads\nwill take a LONG time. However, we can speed up the exit by checking the\nIO_WQ_BIT_EXIT inside the io_worker_handle_work() loop, as syzbot will\nexit the ring after queueing up all of these reads. Then once the first\nitem is processed, io-wq will simply cancel the rest. That should avoid\nsyzbot running into this complaint again.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23113"
},
{
"cve": "CVE-2026-23154",
"cwe": {
"id": "CWE-237",
"name": "Improper Handling of Structural Elements"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix segmentation of forwarding fraglist GRO\n\nThis patch enhances GSO segment handling by properly checking\nthe SKB_GSO_DODGY flag for frag_list GSO packets, addressing\nlow throughput issues observed when a station accesses IPv4\nservers via hotspots with an IPv6-only upstream interface.\n\nSpecifically, it fixes a bug in GSO segmentation when forwarding\nGRO packets containing a frag_list. The function skb_segment_list\ncannot correctly process GRO skbs that have been converted by XLAT,\nsince XLAT only translates the header of the head skb. Consequently,\nskbs in the frag_list may remain untranslated, resulting in protocol\ninconsistencies and reduced throughput.\n\nTo address this, the patch explicitly sets the SKB_GSO_DODGY flag\nfor GSO packets in XLAT's IPv4/IPv6 protocol translation helpers\n(bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO\npackets as potentially modified after protocol translation. As a\nresult, GSO segmentation will avoid using skb_segment_list and\ninstead falls back to skb_segment for packets with the SKB_GSO_DODGY\nflag. This ensures that only safe and fully translated frag_list\npackets are processed by skb_segment_list, resolving protocol\ninconsistencies and improving throughput when forwarding GRO packets\nconverted by XLAT.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23154"
},
{
"cve": "CVE-2026-23204",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: use skb_header_pointer_careful()\n\nskb_header_pointer() does not fully validate negative @offset values.\n\nUse skb_header_pointer_careful() instead.\n\nGangMin Kim provided a report and a repro fooling u32_classify():\n\nBUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0\nnet/sched/cls_u32.c:221",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23204"
},
{
"cve": "CVE-2026-23231",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix use-after-free in nf_tables_addchain()\n\nnf_tables_addchain() publishes the chain to table->chains via\nlist_add_tail_rcu() (in nft_chain_add()) before registering hooks.\nIf nf_tables_register_hook() then fails, the error path calls\nnft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()\nwith no RCU grace period in between.\n\nThis creates two use-after-free conditions:\n\n 1) Control-plane: nf_tables_dump_chains() traverses table->chains\n under rcu_read_lock(). A concurrent dump can still be walking\n the chain when the error path frees it.\n\n 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly\n installs the IPv4 hook before IPv6 registration fails. Packets\n entering nft_do_chain() via the transient IPv4 hook can still be\n dereferencing chain->blob_gen_X when the error path frees the\n chain.\n\nAdd synchronize_rcu() between nft_chain_del() and the chain destroy\nso that all RCU readers -- both dump threads and in-flight packet\nevaluation -- have finished before the chain is freed.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23231"
},
{
"cve": "CVE-2026-23242",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix potential NULL pointer dereference in header processing\n\nIf siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),\nqp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()\ndereferences qp->rx_fpdu->more_ddp_segs without checking, which\nmay lead to a NULL pointer deref. Only check more_ddp_segs when\nrx_fpdu is present.\n\nKASAN splat:\n[ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]\n[ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23242"
},
{
"cve": "CVE-2026-23243",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umad: Reject negative data_len in ib_umad_write\n\nib_umad_write computes data_len from user-controlled count and the\nMAD header sizes. With a mismatched user MAD header size and RMPP\nheader length, data_len can become negative and reach ib_create_send_mad().\nThis can make the padding calculation exceed the segment size and trigger\nan out-of-bounds memset in alloc_send_rmpp_list().\n\nAdd an explicit check to reject negative data_len before creating the\nsend buffer.\n\nKASAN splat:\n[ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0\n[ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102\n[ 211.365867] ib_create_send_mad+0xa01/0x11b0\n[ 211.365887] ib_umad_write+0x853/0x1c80",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23243"
},
{
"cve": "CVE-2026-23245",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gate: snapshot parameters with RCU on replace\n\nThe gate action can be replaced while the hrtimer callback or dump path is\nwalking the schedule list.\n\nConvert the parameters to an RCU-protected snapshot and swap updates under\ntcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits\nthe entry list, preserve the existing schedule so the effective state is\nunchanged.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23245"
},
{
"cve": "CVE-2026-23270",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\n\nAs Paolo said earlier [1]:\n\n\"Since the blamed commit below, classify can return TC_ACT_CONSUMED while\nthe current skb being held by the defragmentation engine. As reported by\nGangMin Kim, if such packet is that may cause a UaF when the defrag engine\nlater on tries to tuch again such packet.\"\n\nact_ct was never meant to be used in the egress path, however some users\nare attaching it to egress today [2]. Attempting to reach a middle\nground, we noticed that, while most qdiscs are not handling\nTC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we\naddress the issue by only allowing act_ct to bind to clsact/ingress\nqdiscs and shared blocks. That way it's still possible to attach act_ct to\negress (albeit only with clsact).\n\n[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/\n[2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23270"
},
{
"cve": "CVE-2026-23271",
"cwe": {
"id": "CWE-672",
"name": "Operation on a Resource after Expiration or Release"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix __perf_event_overflow() vs perf_remove_from_context() race\n\nMake sure that __perf_event_overflow() runs with IRQs disabled for all\npossible callchains. Specifically the software events can end up running\nit with only preemption disabled.\n\nThis opens up a race vs perf_event_exit_event() and friends that will go\nand free various things the overflow path expects to be present, like\nthe BPF program.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23271"
},
{
"cve": "CVE-2026-23273",
"cwe": {
"id": "CWE-364",
"name": "Signal Handler Race Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: observe an RCU grace period in macvlan_common_newlink() error path\n\nvalis reported that a race condition still happens after my prior patch.\n\nmacvlan_common_newlink() might have made @dev visible before\ndetecting an error, and its caller will directly call free_netdev(dev).\n\nWe must respect an RCU period, either in macvlan or the core networking\nstack.\n\nAfter adding a temporary mdelay(1000) in macvlan_forward_source_one()\nto open the race window, valis repro was:\n\nip link add p1 type veth peer p2\nip link set address 00:00:00:00:00:20 dev p1\nip link set up dev p1\nip link set up dev p2\nip link add mv0 link p2 type macvlan mode source\n\n(ip link add invalid% link p2 type macvlan mode source macaddr add\n00:00:00:00:00:20 &) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4\nPING 1.2.3.4 (1.2.3.4): 56 data bytes\nRTNETLINK answers: Invalid argument\n\nBUG: KASAN: slab-use-after-free in macvlan_forward_source\n(drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nRead of size 8 at addr ffff888016bb89c0 by task e/175\n\nCPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nCall Trace:\n\ndump_stack_lvl (lib/dump_stack.c:123)\nprint_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nkasan_report (mm/kasan/report.c:597)\n? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nmacvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\n? tasklet_init (kernel/softirq.c:983)\nmacvlan_handle_frame (drivers/net/macvlan.c:501)\n\nAllocated by task 169:\nkasan_save_stack (mm/kasan/common.c:58)\nkasan_save_track (./arch/x86/include/asm/current.h:25\nmm/kasan/common.c:70 mm/kasan/common.c:79)\n__kasan_kmalloc (mm/kasan/common.c:419)\n__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657\nmm/slub.c:7140)\nalloc_netdev_mqs (net/core/dev.c:12012)\nrtnl_create_link (net/core/rtnetlink.c:3648)\nrtnl_newlink (net/core/rtnetlink.c:3830 net/core/rtnetlink.c:3957\nnet/core/rtnetlink.c:4072)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2550)\nnetlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1894)\n__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)\n__x64_sys_sendto (net/socket.c:2209)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n\nFreed by task 169:\nkasan_save_stack (mm/kasan/common.c:58)\nkasan_save_track (./arch/x86/include/asm/current.h:25\nmm/kasan/common.c:70 mm/kasan/common.c:79)\nkasan_save_free_info (mm/kasan/generic.c:587)\n__kasan_slab_free (mm/kasan/common.c:287)\nkfree (mm/slub.c:6674 mm/slub.c:6882)\nrtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957\nnet/core/rtnetlink.c:4072)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2550)\nnetlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1894)\n__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)\n__x64_sys_sendto (net/socket.c:2209)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23273"
},
{
"cve": "CVE-2026-23274",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels\n\nIDLETIMER revision 0 rules reuse existing timers by label and always call\nmod_timer() on timer->timer.\n\nIf the label was created first by revision 1 with XT_IDLETIMER_ALARM,\nthe object uses alarm timer semantics and timer->timer is never initialized.\nReusing that object from revision 0 causes mod_timer() on an uninitialized\ntimer_list, triggering debugobjects warnings and possible panic when\npanic_on_warn=1.\n\nFix this by rejecting revision 0 rule insertion when an existing timer with\nthe same label is of ALARM type.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23274"
},
{
"cve": "CVE-2026-23277",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit\n\nteql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit\nthrough slave devices, but does not update skb->dev to the slave device\nbeforehand.\n\nWhen a gretap tunnel is a TEQL slave, the transmit path reaches\niptunnel_xmit() which saves dev = skb->dev (still pointing to teql0\nmaster) and later calls iptunnel_xmit_stats(dev, pkt_len). This\nfunction does:\n\n get_cpu_ptr(dev->tstats)\n\nSince teql_master_setup() does not set dev->pcpu_stat_type to\nNETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats\nfor teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes\nNULL + __per_cpu_offset[cpu], resulting in a page fault.\n\n BUG: unable to handle page fault for address: ffff8880e6659018\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 68bc067 P4D 68bc067 PUD 0\n Oops: Oops: 0002 [#1] SMP KASAN PTI\n RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89)\n Call Trace:\n \n ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n __gre_xmit (net/ipv4/ip_gre.c:478)\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\n teql_master_xmit (net/sched/sch_teql.c:319)\n dev_hard_start_xmit (net/core/dev.c:3887)\n sch_direct_xmit (net/sched/sch_generic.c:347)\n __dev_queue_xmit (net/core/dev.c:4802)\n neigh_direct_output (net/core/neighbour.c:1660)\n ip_finish_output2 (net/ipv4/ip_output.c:237)\n __ip_finish_output.part.0 (net/ipv4/ip_output.c:315)\n ip_mc_output (net/ipv4/ip_output.c:369)\n ip_send_skb (net/ipv4/ip_output.c:1508)\n udp_send_skb (net/ipv4/udp.c:1195)\n udp_sendmsg (net/ipv4/udp.c:1485)\n inet_sendmsg (net/ipv4/af_inet.c:859)\n __sys_sendto (net/socket.c:2206)\n\nFix this by setting skb->dev = slave before calling\nnetdev_start_xmit(), so that tunnel xmit functions see the correct\nslave device with properly allocated tstats.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23277"
},
{
"cve": "CVE-2026-23284",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()\n\nReset eBPF program pointer to old_prog and do not decrease its ref-count\nif mtk_open routine in mtk_xdp_setup() fails.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23284"
},
{
"cve": "CVE-2026-23287",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/sifive-plic: Fix frozen interrupt due to affinity setting\n\nPLIC ignores interrupt completion message for disabled interrupt, explained\nby the specification:\n\n The PLIC signals it has completed executing an interrupt handler by\n writing the interrupt ID it received from the claim to the\n claim/complete register. The PLIC does not check whether the completion\n ID is the same as the last claim ID for that target. If the completion\n ID does not match an interrupt source that is currently enabled for\n the target, the completion is silently ignored.\n\nThis caused problems in the past, because an interrupt can be disabled\nwhile still being handled and plic_irq_eoi() had no effect. That was fixed\nby checking if the interrupt is disabled, and if so enable it, before\nsending the completion message. That check is done with irqd_irq_disabled().\n\nHowever, that is not sufficient because the enable bit for the handling\nhart can be zero despite irqd_irq_disabled(d) being false. This can happen\nwhen affinity setting is changed while a hart is still handling the\ninterrupt.\n\nThis problem is easily reproducible by dumping a large file to uart (which\ngenerates lots of interrupts) and at the same time keep changing the uart\ninterrupt's affinity setting. The uart port becomes frozen almost\ninstantaneously.\n\nFix this by checking PLIC's enable bit instead of irqd_irq_disabled().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23287"
},
{
"cve": "CVE-2026-23290",
"cwe": {
"id": "CWE-909",
"name": "Missing Initialization of Resource"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: validate USB endpoints\n\nThe pegasus driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it. If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23290"
},
{
"cve": "CVE-2026-23293",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the 'ipv6.disable=1' parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. If an IPv6 packet is injected into the interface,\nroute_shortcircuit() is called and a NULL pointer dereference happens on\nneigh_lookup().\n\n BUG: kernel NULL pointer dereference, address: 0000000000000380\n Oops: Oops: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x20/0x270\n [...]\n Call Trace:\n \n vxlan_xmit+0x638/0x1ef0 [vxlan]\n dev_hard_start_xmit+0x9e/0x2e0\n __dev_queue_xmit+0xbee/0x14e0\n packet_sendmsg+0x116f/0x1930\n __sys_sendto+0x1f5/0x200\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x12f/0x1590\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFix this by adding an early check on route_shortcircuit() when protocol\nis ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because\nVXLAN can be built-in even when IPv6 is built as a module.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23293"
},
{
"cve": "CVE-2026-23300",
"cwe": {
"id": "CWE-909",
"name": "Missing Initialization of Resource"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop\n\nWhen a standalone IPv6 nexthop object is created with a loopback device\n(e.g., \"ip -6 nexthop add id 100 dev lo\"), fib6_nh_init() misclassifies\nit as a reject route. This is because nexthop objects have no destination\nprefix (fc_dst=::), causing fib6_is_reject() to match any loopback\nnexthop. The reject path skips fib_nh_common_init(), leaving\nnhc_pcpu_rth_output unallocated. If an IPv4 route later references this\nnexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and\npanics.\n\nSimplify the check in fib6_nh_init() to only match explicit reject\nroutes (RTF_REJECT) instead of using fib6_is_reject(). The loopback\npromotion heuristic in fib6_is_reject() is handled separately by\nip6_route_info_create_nh(). After this change, the three cases behave\nas follows:\n\n1. Explicit reject route (\"ip -6 route add unreachable 2001:db8::/64\"):\n RTF_REJECT is set, enters reject path, skips fib_nh_common_init().\n No behavior change.\n\n2. Implicit loopback reject route (\"ip -6 route add 2001:db8::/32 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. ip6_route_info_create_nh() still promotes it to reject\n afterward. nhc_pcpu_rth_output is allocated but unused, which is\n harmless.\n\n3. Standalone nexthop object (\"ip -6 nexthop add id 100 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. nhc_pcpu_rth_output is properly allocated, fixing the crash\n when IPv4 routes reference this nexthop.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23300"
},
{
"cve": "CVE-2026-23304",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()\n\nl3mdev_master_dev_rcu() can return NULL when the slave device is being\nun-slaved from a VRF. All other callers deal with this, but we lost\nthe fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()\nwith commit 4832c30d5458 (\"net: ipv6: put host and anycast routes on\ndevice with address\").\n\n KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]\n RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)\n Call Trace:\n ip6_pol_route (net/ipv6/route.c:2318)\n fib6_rule_lookup (net/ipv6/fib6_rules.c:115)\n ip6_route_output_flags (net/ipv6/route.c:2607)\n vrf_process_v6_outbound (drivers/net/vrf.c:437)\n\nI was tempted to rework the un-slaving code to clear the flag first\nand insert synchronize_rcu() before we remove the upper. But looks like\nthe explicit fallback to loopback_dev is an established pattern.\nAnd I guess avoiding the synchronize_rcu() is nice, too.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23304"
},
{
"cve": "CVE-2026-23319",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n\nThe root cause of this bug is that when 'bpf_link_put' reduces the\nrefcount of 'shim_link->link.link' to zero, the resource is considered\nreleased but may still be referenced via 'tr->progs_hlist' in\n'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in\n'bpf_shim_tramp_link_release' is deferred. During this window, another\nprocess can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'.\n\nBased on Martin KaFai Lau's suggestions, I have created a simple patch.\n\nTo fix this:\n Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'.\n Only increment the refcount if it is not already zero.\n\nTesting:\n I verified the fix by adding a delay in\n 'bpf_shim_tramp_link_release' to make the bug easier to trigger:\n\nstatic void bpf_shim_tramp_link_release(struct bpf_link *link)\n{\n\t/* ... */\n\tif (!shim_link->trampoline)\n\t\treturn;\n\n+\tmsleep(100);\n\tWARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link,\n\t\tshim_link->trampoline, NULL));\n\tbpf_trampoline_put(shim_link->trampoline);\n}\n\nBefore the patch, running a PoC easily reproduced the crash(almost 100%)\nwith a call trace similar to KaiyanM's report.\nAfter the patch, the bug no longer occurs even after millions of\niterations.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23319"
},
{
"cve": "CVE-2026-23321",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: in-kernel: always mark signal+subflow endp as used\n\nSyzkaller managed to find a combination of actions that was generating\nthis warning:\n\n msk->pm.local_addr_used == 0\n WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961\n WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline], CPU#1: syz.2.17/961\n WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210, CPU#1: syz.2.17/961\n Modules linked in:\n CPU: 1 UID: 0 PID: 961 Comm: syz.2.17 Not tainted 6.19.0-08368-gfafda3b4b06b #22 PREEMPT(full)\n Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.17.0-debian-1.17.0-1build1 04/01/2014\n RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline]\n RIP: 0010:mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline]\n RIP: 0010:mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210\n Code: 89 c5 e8 46 30 6f fe e9 21 fd ff ff 49 83 ed 80 e8 38 30 6f fe 4c 89 ef be 03 00 00 00 e8 db 49 df fe eb ac e8 24 30 6f fe 90 <0f> 0b 90 e9 1d ff ff ff e8 16 30 6f fe eb 05 e8 0f 30 6f fe e8 9a\n RSP: 0018:ffffc90001663880 EFLAGS: 00010293\n RAX: ffffffff82de1a6c RBX: 0000000000000000 RCX: ffff88800722b500\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffff8880158b22d0 R08: 0000000000010425 R09: ffffffffffffffff\n R10: ffffffff82de18ba R11: 0000000000000000 R12: ffff88800641a640\n R13: ffff8880158b1880 R14: ffff88801ec3c900 R15: ffff88800641a650\n FS: 00005555722c3500(0000) GS:ffff8880f909d000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f66346e0f60 CR3: 000000001607c000 CR4: 0000000000350ef0\n Call Trace:\n \n genl_family_rcv_msg_doit+0x117/0x180 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x3a8/0x3f0 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x16d/0x240 net/netlink/af_netlink.c:2550\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x3e9/0x4c0 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x4aa/0x5b0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0xc9/0xf0 net/socket.c:742\n ____sys_sendmsg+0x272/0x3b0 net/socket.c:2592\n ___sys_sendmsg+0x2de/0x320 net/socket.c:2646\n __sys_sendmsg net/socket.c:2678 [inline]\n __do_sys_sendmsg net/socket.c:2683 [inline]\n __se_sys_sendmsg net/socket.c:2681 [inline]\n __x64_sys_sendmsg+0x110/0x1a0 net/socket.c:2681\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x143/0x440 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f66346f826d\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007ffc83d8bdc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 00007f6634985fa0 RCX: 00007f66346f826d\n RDX: 00000000040000b0 RSI: 0000200000000740 RDI: 0000000000000007\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6634985fa8\n R13: 00007f6634985fac R14: 0000000000000000 R15: 0000000000001770\n \n\nThe actions that caused that seem to be:\n\n - Set the MPTCP subflows limit to 0\n - Create an MPTCP endpoint with both the 'signal' and 'subflow' flags\n - Create a new MPTCP connection from a different address: an ADD_ADDR\n linked to the MPTCP endpoint will be sent ('signal' flag), but no\n subflows is initiated ('subflow' flag)\n - Remove the MPTCP endpoint\n\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23321"
},
{
"cve": "CVE-2026-23335",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()\n\nstruct irdma_create_ah_resp { // 8 bytes, no padding\n __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx)\n __u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK\n};\n\nrsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().\n\nThe reserved members of the structure were not zeroed.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23335"
},
{
"cve": "CVE-2026-23340",
"cwe": {
"id": "CWE-364",
"name": "Signal Handler Race Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc->seqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n iperf3 -ub0 -c $peer -t 0 &\n while :; do\n ethtool -L eth0 combined 1\n ethtool -L eth0 combined 2\n done\n\nWith KASAN enabled, this leads to reports like:\n\n BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n ...\n Call Trace:\n \n ...\n __qdisc_run+0x133f/0x1760\n __dev_queue_xmit+0x248f/0x3550\n ip_finish_output2+0xa42/0x2110\n ip_output+0x1a7/0x410\n ip_send_skb+0x2e6/0x480\n udp_send_skb+0xb0a/0x1590\n udp_sendmsg+0x13c9/0x1fc0\n ...\n \n\n Allocated by task 1270 on cpu 5 at 44.558414s:\n ...\n alloc_skb_with_frags+0x84/0x7c0\n sock_alloc_send_pskb+0x69a/0x830\n __ip_append_data+0x1b86/0x48c0\n ip_make_skb+0x1e8/0x2b0\n udp_sendmsg+0x13a6/0x1fc0\n ...\n\n Freed by task 1306 on cpu 3 at 44.558445s:\n ...\n kmem_cache_free+0x117/0x5e0\n pfifo_fast_reset+0x14d/0x580\n qdisc_reset+0x9e/0x5f0\n netif_set_real_num_tx_queues+0x303/0x840\n virtnet_set_channels+0x1bf/0x260 [virtio_net]\n ethnl_set_channels+0x684/0xae0\n ethnl_default_set_doit+0x31a/0x890\n ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23340"
},
{
"cve": "CVE-2026-23343",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: produce a warning when calculated tailroom is negative\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq->frag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case, but due\nto tailroom being stored as an unsigned int, it is reported to be somewhere\nnear UINT_MAX, resulting in a tail being grown, even if the requested\noffset is too much (it is around 2K in the abovementioned test). This later\nleads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 <4c> 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff <8b> 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 <8b> 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23343"
},
{
"cve": "CVE-2026-23351",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: split gc into unlink and reclaim phase\n\nYiming Qian reports Use-after-free in the pipapo set type:\n Under a large number of expired elements, commit-time GC can run for a very\n long time in a non-preemptible context, triggering soft lockup warnings and\n RCU stall reports (local denial of service).\n\nWe must split GC in an unlink and a reclaim phase.\n\nWe cannot queue elements for freeing until pointers have been swapped.\nExpired elements are still exposed to both the packet path and userspace\ndumpers via the live copy of the data structure.\n\ncall_rcu() does not protect us: dump operations or element lookups starting\nafter call_rcu has fired can still observe the free'd element, unless the\ncommit phase has made enough progress to swap the clone and live pointers\nbefore any new reader has picked up the old version.\n\nThis a similar approach as done recently for the rbtree backend in commit\n35f83a75529a (\"netfilter: nft_set_rbtree: don't gc elements on insert\").",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23351"
},
{
"cve": "CVE-2026-23359",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stack-out-of-bounds write in devmap\n\nget_upper_ifindexes() iterates over all upper devices and writes their\nindices into an array without checking bounds.\n\nAlso the callers assume that the max number of upper devices is\nMAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,\nbut that assumption is not correct and the number of upper devices could\nbe larger than MAX_NEST_DEV (e.g., many macvlans), causing a\nstack-out-of-bounds write.\n\nAdd a max parameter to get_upper_ifindexes() to avoid the issue.\nWhen there are too many upper devices, return -EOVERFLOW and abort the\nredirect.\n\nTo reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with\nan XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.\nThen send a packet to the device to trigger the XDP redirect path.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23359"
},
{
"cve": "CVE-2026-23365",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kalmia: validate USB endpoints\n\nThe kalmia driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it. If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23365"
},
{
"cve": "CVE-2026-23368",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: register phy led_triggers during probe to avoid AB-BA deadlock\n\nThere is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and\nLED_TRIGGER_PHY are enabled:\n\n[ 1362.049207] [<8054e4b8>] led_trigger_register+0x5c/0x1fc <-- Trying to get lock \"triggers_list_lock\" via down_write(&triggers_list_lock);\n[ 1362.054536] [<80662830>] phy_led_triggers_register+0xd0/0x234\n[ 1362.060329] [<8065e200>] phy_attach_direct+0x33c/0x40c\n[ 1362.065489] [<80651fc4>] phylink_fwnode_phy_connect+0x15c/0x23c\n[ 1362.071480] [<8066ee18>] mtk_open+0x7c/0xba0\n[ 1362.075849] [<806d714c>] __dev_open+0x280/0x2b0\n[ 1362.080384] [<806d7668>] __dev_change_flags+0x244/0x24c\n[ 1362.085598] [<806d7698>] dev_change_flags+0x28/0x78\n[ 1362.090528] [<807150e4>] dev_ioctl+0x4c0/0x654 <-- Hold lock \"rtnl_mutex\" by calling rtnl_lock();\n[ 1362.094985] [<80694360>] sock_ioctl+0x2f4/0x4e0\n[ 1362.099567] [<802e9c4c>] sys_ioctl+0x32c/0xd8c\n[ 1362.104022] [<80014504>] syscall_common+0x34/0x58\n\nHere LED_TRIGGER_PHY is registering LED triggers during phy_attach\nwhile holding RTNL and then taking triggers_list_lock.\n\n[ 1362.191101] [<806c2640>] register_netdevice_notifier+0x60/0x168 <-- Trying to get lock \"rtnl_mutex\" via rtnl_lock();\n[ 1362.197073] [<805504ac>] netdev_trig_activate+0x194/0x1e4\n[ 1362.202490] [<8054e28c>] led_trigger_set+0x1d4/0x360 <-- Hold lock \"triggers_list_lock\" by down_read(&triggers_list_lock);\n[ 1362.207511] [<8054eb38>] led_trigger_write+0xd8/0x14c\n[ 1362.212566] [<80381d98>] sysfs_kf_bin_write+0x80/0xbc\n[ 1362.217688] [<8037fcd8>] kernfs_fop_write_iter+0x17c/0x28c\n[ 1362.223174] [<802cbd70>] vfs_write+0x21c/0x3c4\n[ 1362.227712] [<802cc0c4>] ksys_write+0x78/0x12c\n[ 1362.232164] [<80014504>] syscall_common+0x34/0x58\n\nHere LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes\ntriggers_list_lock and then RTNL. A classical AB-BA deadlock.\n\nphy_led_triggers_registers() does not require the RTNL, it does not\nmake any calls into the network stack which require protection. There\nis also no requirement the PHY has been attached to a MAC, the\ntriggers only make use of phydev state. This allows the call to\nphy_led_triggers_registers() to be placed elsewhere. PHY probe() and\nrelease() don't hold RTNL, so solving the AB-BA deadlock.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23368"
},
{
"cve": "CVE-2026-23370",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: Don't hex dump plaintext password data\n\nset_new_password() hex dumps the entire buffer, which contains plaintext\npassword data, including current and new passwords. Remove the hex dump\nto avoid leaking credentials.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23370"
},
{
"cve": "CVE-2026-23378",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[ 138.423369][ C1] ==================================================================\n[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 138.425800][ C1] Call Trace:\n[ 138.425804][ C1] \n[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)\n[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23378"
},
{
"cve": "CVE-2026-23379",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: ets: fix divide by zero in the offload path\n\nOffloading ETS requires computing each class' WRR weight: this is done by\naveraging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned\nint, the same integer size as the individual DRR quanta, can overflow and\neven cause division by zero, like it happened in the following splat:\n\n Oops: divide error: 0000 [#1] SMP PTI\n CPU: 13 UID: 0 PID: 487 Comm: tc Tainted: G E 6.19.0-virtme #45 PREEMPT(full)\n Tainted: [E]=UNSIGNED_MODULE\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]\n Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44\n RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246\n RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660\n RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe\n R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe\n R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000\n FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0\n Call Trace:\n \n ets_qdisc_change+0x870/0xf40 [sch_ets]\n qdisc_create+0x12b/0x540\n tc_modify_qdisc+0x6d7/0xbd0\n rtnetlink_rcv_msg+0x168/0x6b0\n netlink_rcv_skb+0x5c/0x110\n netlink_unicast+0x1d6/0x2b0\n netlink_sendmsg+0x22e/0x470\n ____sys_sendmsg+0x38a/0x3c0\n ___sys_sendmsg+0x99/0xe0\n __sys_sendmsg+0x8a/0xf0\n do_syscall_64+0x111/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f440b81c77e\n Code: 4d 89 d8 e8 d4 bc 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa\n RSP: 002b:00007fff951e4c10 EFLAGS: 00000202 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000481820 RCX: 00007f440b81c77e\n RDX: 0000000000000000 RSI: 00007fff951e4cd0 RDI: 0000000000000003\n RBP: 00007fff951e4c20 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff951f4fa8\n R13: 00000000699ddede R14: 00007f440bb01000 R15: 0000000000486980\n \n Modules linked in: sch_ets(E) netdevsim(E)\n ---[ end trace 0000000000000000 ]---\n RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]\n Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44\n RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246\n RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660\n RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe\n R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe\n R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000\n FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0\n Kernel panic - not syncing: Fatal exception\n Kernel Offset: 0x30000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)\n ---[ end Kernel panic - not syncing: Fatal exception ]---\n\nFix this using 64-bit integers for 'q_sum' and 'q_psum'.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23379"
},
{
"cve": "CVE-2026-23381",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the 'ipv6.disable=1' parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. Then, if neigh_suppress is enabled and an ICMPv6\nNeighbor Discovery packet reaches the bridge, br_do_suppress_nd() will\ndereference ipv6_stub->nd_tbl which is NULL, passing it to\nneigh_lookup(). This causes a kernel NULL pointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000268\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x16/0xe0\n [...]\n Call Trace:\n \n ? neigh_lookup+0x16/0xe0\n br_do_suppress_nd+0x160/0x290 [bridge]\n br_handle_frame_finish+0x500/0x620 [bridge]\n br_handle_frame+0x353/0x440 [bridge]\n __netif_receive_skb_core.constprop.0+0x298/0x1110\n __netif_receive_skb_one_core+0x3d/0xa0\n process_backlog+0xa0/0x140\n __napi_poll+0x2c/0x170\n net_rx_action+0x2c4/0x3a0\n handle_softirqs+0xd0/0x270\n do_softirq+0x3f/0x60\n\nFix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in\nthe callers. This is in essence disabling NS/NA suppression when IPv6 is\ndisabled.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23381"
},
{
"cve": "CVE-2026-23391",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_CT: drop pending enqueued packets on template removal\n\nTemplates refer to objects that can go away while packets are sitting in\nnfqueue refer to:\n\n- helper, this can be an issue on module removal.\n- timeout policy, nfnetlink_cttimeout might remove it.\n\nThe use of templates with zone and event cache filter are safe, since\nthis just copies values.\n\nFlush these enqueued packets in case the template rule gets removed.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23391"
},
{
"cve": "CVE-2026-23392",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: release flowtable after rcu grace period on error\n\nCall synchronize_rcu() after unregistering the hooks from error path,\nsince a hook that already refers to this flowtable can be already\nregistered, exposing this flowtable to packet path and nfnetlink_hook\ncontrol plane.\n\nThis error path is rare, it should only happen by reaching the maximum\nnumber hooks or by failing to set up to hardware offload, just call\nsynchronize_rcu().\n\nThere is a check for already used device hooks by different flowtable\nthat could result in EEXIST at this late stage. The hook parser can be\nupdated to perform this check earlier to this error path really becomes\nrarely exercised.\n\nUncovered by KASAN reported as use-after-free from nfnetlink_hook path\nwhen dumping hooks.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23392"
},
{
"cve": "CVE-2026-23397",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfnetlink_osf: validate individual option lengths in fingerprints\n\nnfnl_osf_add_callback() validates opt_num bounds and string\nNUL-termination but does not check individual option length fields.\nA zero-length option causes nf_osf_match_one() to enter the option\nmatching loop even when foptsize sums to zero, which matches packets\nwith no TCP options where ctx->optp is NULL:\n\n Oops: general protection fault\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n nf_osf_match (net/netfilter/nfnetlink_osf.c:227)\n xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n ipt_do_table (net/ipv4/netfilter/ip_tables.c:293)\n nf_hook_slow (net/netfilter/core.c:623)\n ip_local_deliver (net/ipv4/ip_input.c:262)\n ip_rcv (net/ipv4/ip_input.c:573)\n\nAdditionally, an MSS option (kind=2) with length < 4 causes\nout-of-bounds reads when nf_osf_match_one() unconditionally accesses\noptp[2] and optp[3] for MSS value extraction. While RFC 9293\nsection 3.2 specifies that the MSS option is always exactly 4\nbytes (Kind=2, Length=4), the check uses \"< 4\" rather than\n\"!= 4\" because lengths greater than 4 do not cause memory\nsafety issues -- the buffer is guaranteed to be at least\nfoptsize bytes by the ctx->optsize == foptsize check.\n\nReject fingerprints where any option has zero length, or where an MSS\noption has length less than 4, at add time rather than trusting these\nvalues in the packet matching hot path.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23397"
},
{
"cve": "CVE-2026-23398",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: fix NULL pointer dereference in icmp_tag_validation()\n\nicmp_tag_validation() unconditionally dereferences the result of\nrcu_dereference(inet_protos[proto]) without checking for NULL.\nThe inet_protos[] array is sparse -- only about 15 of 256 protocol\nnumbers have registered handlers. When ip_no_pmtu_disc is set to 3\n(hardened PMTU mode) and the kernel receives an ICMP Fragmentation\nNeeded error with a quoted inner IP header containing an unregistered\nprotocol number, the NULL dereference causes a kernel panic in\nsoftirq context.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143)\n Call Trace:\n \n icmp_rcv (net/ipv4/icmp.c:1527)\n ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)\n ip_local_deliver_finish (net/ipv4/ip_input.c:242)\n ip_local_deliver (net/ipv4/ip_input.c:262)\n ip_rcv (net/ipv4/ip_input.c:573)\n __netif_receive_skb_one_core (net/core/dev.c:6164)\n process_backlog (net/core/dev.c:6628)\n handle_softirqs (kernel/softirq.c:561)\n \n\nAdd a NULL check before accessing icmp_strict_tag_validation. If the\nprotocol has no registered handler, return false since it cannot\nperform strict tag validation.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23398"
},
{
"cve": "CVE-2026-23414",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: Purge async_hold in tls_decrypt_async_wait()\n\nThe async_hold queue pins encrypted input skbs while\nthe AEAD engine references their scatterlist data. Once\ntls_decrypt_async_wait() returns, every AEAD operation\nhas completed and the engine no longer references those\nskbs, so they can be freed unconditionally.\n\nA subsequent patch adds batch async decryption to\ntls_sw_read_sock(), introducing a new call site that\nmust drain pending AEAD operations and release held\nskbs. Move __skb_queue_purge(&ctx->async_hold) into\ntls_decrypt_async_wait() so the purge is centralized\nand every caller -- recvmsg's drain path, the -EBUSY\nfallback in tls_do_decryption(), and the new read_sock\nbatch path -- releases held skbs on synchronization\nwithout each site managing the purge independently.\n\nThis fixes a leak when tls_strp_msg_hold() fails part-way through,\nafter having added some cloned skbs to the async_hold\nqueue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to\nprocess all pending decrypts, and drop back to synchronous mode, but\ntls_sw_recvmsg() only flushes the async_hold queue when one record has\nbeen processed in \"fully-async\" mode, which may not be the case here.\n\n[pabeni@redhat.com: added leak comment]",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23414"
},
{
"cve": "CVE-2026-23422",
"cwe": {
"id": "CWE-392",
"name": "Missing Report of Error Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler\n\nCommit 31a7a0bbeb00 (\"dpaa2-switch: add bounds check for if_id in IRQ\nhandler\") introduces a range check for if_id to avoid an out-of-bounds\naccess. If an out-of-bounds if_id is detected, the interrupt status is\nnot cleared. This may result in an interrupt storm.\n\nClear the interrupt status after detecting an out-of-bounds if_id to avoid\nthe problem.\n\nFound by an experimental AI code review agent at Google.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23422"
},
{
"cve": "CVE-2026-23434",
"cwe": {
"id": "CWE-820",
"name": "Missing Synchronization"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: serialize lock/unlock against other NAND operations\n\nnand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area\nwithout holding the NAND device lock. On controllers that implement\nSET_FEATURES via multiple low-level PIO commands, these can race with\nconcurrent UBI/UBIFS background erase/write operations that hold the\ndevice lock, resulting in cmd_pending conflicts on the NAND controller.\n\nAdd nand_get_device()/nand_release_device() around the lock/unlock\noperations to serialize them against all other NAND controller access.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23434"
},
{
"cve": "CVE-2026-23438",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: guard flow control update with global_tx_fc in buffer switching\n\nmvpp2_bm_switch_buffers() unconditionally calls\nmvpp2_bm_pool_update_priv_fc() when switching between per-cpu and\nshared buffer pool modes. This function programs CM3 flow control\nregisters via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference\npriv->cm3_base without any NULL check.\n\nWhen the CM3 SRAM resource is not present in the device tree (the\nthird reg entry added by commit 60523583b07c (\"dts: marvell: add CM3\nSRAM memory to cp11x ethernet device tree\")), priv->cm3_base remains\nNULL and priv->global_tx_fc is false. Any operation that triggers\nmvpp2_bm_switch_buffers(), for example an MTU change that crosses\nthe jumbo frame threshold, will crash:\n\n Unable to handle kernel NULL pointer dereference at\n virtual address 0000000000000000\n Mem abort info:\n ESR = 0x0000000096000006\n EC = 0x25: DABT (current EL), IL = 32 bits\n pc : readl+0x0/0x18\n lr : mvpp2_cm3_read.isra.0+0x14/0x20\n Call trace:\n readl+0x0/0x18\n mvpp2_bm_pool_update_fc+0x40/0x12c\n mvpp2_bm_pool_update_priv_fc+0x94/0xd8\n mvpp2_bm_switch_buffers.isra.0+0x80/0x1c0\n mvpp2_change_mtu+0x140/0x380\n __dev_set_mtu+0x1c/0x38\n dev_set_mtu_ext+0x78/0x118\n dev_set_mtu+0x48/0xa8\n dev_ifsioc+0x21c/0x43c\n dev_ioctl+0x2d8/0x42c\n sock_ioctl+0x314/0x378\n\nEvery other flow control call site in the driver already guards\nhardware access with either priv->global_tx_fc or port->tx_fc.\nmvpp2_bm_switch_buffers() is the only place that omits this check.\n\nAdd the missing priv->global_tx_fc guard to both the disable and\nre-enable calls in mvpp2_bm_switch_buffers(), consistent with the\nrest of the driver.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23438"
},
{
"cve": "CVE-2026-23439",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n\n\nWhen CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0\n(success) without actually creating a socket. Callers such as\nfou_create() then proceed to dereference the uninitialized socket\npointer, resulting in a NULL pointer dereference.\n\nThe captured NULL deref crash:\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)\n [...]\n Call Trace:\n \n genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)\n genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)\n [...]\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n genl_rcv (net/netlink/genetlink.c:1219)\n netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n netlink_sendmsg (net/netlink/af_netlink.c:1894)\n __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))\n __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))\n __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)\n\nThis patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so\ncallers correctly take their error paths. There is only one caller of\nthe vulnerable function and only privileged users can trigger it.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23439"
},
{
"cve": "CVE-2026-23446",
"cwe": {
"id": "CWE-833",
"name": "Deadlock"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: aqc111: Do not perform PM inside suspend callback\n\nsyzbot reports \"task hung in rpm_resume\"\n\nThis is caused by aqc111_suspend calling\nthe PM variant of its write_cmd routine.\n\nThe simplified call trace looks like this:\n\nrpm_suspend()\n usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING\n aqc111_suspend() - called for the usb device interface\n aqc111_write32_cmd()\n usb_autopm_get_interface()\n pm_runtime_resume_and_get()\n rpm_resume() - here we call rpm_resume() on our parent\n rpm_resume() - Here we wait for a status change that will never happen.\n\nAt this point we block another task which holds\nrtnl_lock and locks up the whole networking stack.\n\nFix this by replacing the write_cmd calls with their _nopm variants",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23446"
},
{
"cve": "CVE-2026-23449",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: teql: Fix double-free in teql_master_xmit\n\nWhenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should\nbe called using the seq_lock to avoid racing with the datapath. Failure\nto do so may cause crashes like the following:\n\n[ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139)\n[ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318\n[ 238.029749][ T318]\n[ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full)\n[ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 238.029910][ T318] Call Trace:\n[ 238.029913][ T318] \n[ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122)\n[ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139)\n[ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n...\n[ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139)\n[ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563)\n[ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139)\n[ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231)\n[ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1))\n[ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139)\n...\n[ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256)\n[ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827)\n[ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n...\n[ 238.030054][ T318] qdisc_reset (net/sched/sch_generic.c:1034)\n[ 238.030062][ T318] teql_destroy (./include/linux/spinlock.h:395 net/sched/sch_teql.c:157)\n[ 238.030071][ T318] __qdisc_destroy (./include/net/pkt_sched.h:328 net/sched/sch_generic.c:1077)\n[ 238.030077][ T318] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)\n[ 238.030089][ T318] ? __pfx_qdisc_graft (net/sched/sch_api.c:1091)\n[ 238.030095][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 238.030102][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 238.030106][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 238.030114][ T318] tc_get_qdisc (net/sched/sch_api.c:1529 net/sched/sch_api.c:1556)\n...\n[ 238.072958][ T318] Allocated by task 303 on cpu 5 at 238.026275s:\n[ 238.073392][ T318] kasan_save_stack (mm/kasan/common.c:58)\n[ 238.073884][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5))\n[ 238.074230][ T318] __kasan_slab_alloc (mm/kasan/common.c:369)\n[ 238.074578][ T318] kmem_cache_alloc_node_noprof (./include/linux/kasan.h:253 mm/slub.c:4542 mm/slub.c:4869 mm/slub.c:4921)\n[ 238.076091][ T318] kmalloc_reserve (net/core/skbuff.c:616 (discriminator 107))\n[ 238.076450][ T318] __alloc_skb (net/core/skbuff.c:713)\n[ 238.076834][ T318] alloc_skb_with_frags (./include/linux/skbuff.h:1383 net/core/skbuff.c:6763)\n[ 238.077178][ T318] sock_alloc_send_pskb (net/core/sock.c:2997)\n[ 238.077520][ T318] packet_sendmsg (net/packet/af_packet.c:2926 net/packet/af_packet.c:3019 net/packet/af_packet.c:3108)\n[ 238.081469][ T318]\n[ 238.081870][ T318] Freed by task 299 on cpu 1 at 238.028496s:\n[ 238.082761][ T318] kasan_save_stack (mm/kasan/common.c:58)\n[ 238.083481][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5))\n[ 238.085348][ T318] kasan_save_free_info (mm/kasan/generic.c:587 (discriminator 1))\n[ 238.085900][ T318] __kasan_slab_free (mm/\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23449"
},
{
"cve": "CVE-2026-23450",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\n\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\n\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\n(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP\nlistening socket). It reads sk_user_data to get the smc_sock\npointer. However, when the SMC listen socket is being closed\nconcurrently, smc_close_active() sets clcsock->sk_user_data\nto NULL under sk_callback_lock, and then the smc_sock itself\ncan be freed via sock_put() in smc_release().\n\nThis leads to two issues:\n\n1) NULL pointer dereference: sk_user_data is NULL when\n accessed.\n2) Use-after-free: sk_user_data is read as non-NULL, but the\n smc_sock is freed before its fields (e.g., queued_smc_hs,\n ori_af_ops) are accessed.\n\nThe race window looks like this (the syzkaller crash [1]\ntriggers via the SYN cookie path: tcp_get_cookie_sock() ->\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\nhas the same race):\n\n CPU A (softirq) CPU B (process ctx)\n\n tcp_v4_rcv()\n TCP_NEW_SYN_RECV:\n sk = req->rsk_listener\n sock_hold(sk)\n /* No lock on listener */\n smc_close_active():\n write_lock_bh(cb_lock)\n sk_user_data = NULL\n write_unlock_bh(cb_lock)\n ...\n smc_clcsock_release()\n sock_put(smc->sk) x2\n -> smc_sock freed!\n tcp_check_req()\n smc_tcp_syn_recv_sock():\n smc = user_data(sk)\n -> NULL or dangling\n smc->queued_smc_hs\n -> crash!\n\nNote that the clcsock and smc_sock are two independent objects\nwith separate refcounts. TCP stack holds a reference on the\nclcsock, which keeps it alive, but this does NOT prevent the\nsmc_sock from being freed.\n\nFix this by using RCU and refcount_inc_not_zero() to safely\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\nthe TCP three-way handshake path, taking read_lock_bh on\nsk_callback_lock is too heavy and would not survive a SYN\nflood attack. Using rcu_read_lock() is much more lightweight.\n\n- Set SOCK_RCU_FREE on the SMC listen socket so that\n smc_sock freeing is deferred until after the RCU grace\n period. This guarantees the memory is still valid when\n accessed inside rcu_read_lock().\n- Use rcu_read_lock() to protect reading sk_user_data.\n- Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the\n smc_sock. If the refcount has already reached zero (close\n path completed), it returns false and we bail out safely.\n\nNote: smc_hs_congested() has a similar lockless read of\nsk_user_data without rcu_read_lock(), but it only checks for\nNULL and accesses the global smc_hs_wq, never dereferencing\nany smc_sock field, so it is not affected.\n\nReproducer was verified with mdelay injection and smc_run,\nthe issue no longer occurs with this patch applied.\n\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23450"
},
{
"cve": "CVE-2026-23452",
"cwe": {
"id": "CWE-364",
"name": "Signal Handler Race Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: runtime: Fix a race condition related to device removal\n\nThe following code in pm_runtime_work() may dereference the dev->parent\npointer after the parent device has been freed:\n\n\t/* Maybe the parent is now able to suspend. */\n\tif (parent && !parent->power.ignore_children) {\n\t\tspin_unlock(&dev->power.lock);\n\n\t\tspin_lock(&parent->power.lock);\n\t\trpm_idle(parent, RPM_ASYNC);\n\t\tspin_unlock(&parent->power.lock);\n\n\t\tspin_lock(&dev->power.lock);\n\t}\n\nFix this by inserting a flush_work() call in pm_runtime_remove().\n\nWithout this patch blktest block/001 triggers the following complaint\nsporadically:\n\nBUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160\nRead of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081\nWorkqueue: pm pm_runtime_work\nCall Trace:\n \n dump_stack_lvl+0x61/0x80\n print_address_description.constprop.0+0x8b/0x310\n print_report+0xfd/0x1d7\n kasan_report+0xd8/0x1d0\n __kasan_check_byte+0x42/0x60\n lock_acquire.part.0+0x38/0x230\n lock_acquire+0x70/0x160\n _raw_spin_lock+0x36/0x50\n rpm_suspend+0xc6a/0xfe0\n rpm_idle+0x578/0x770\n pm_runtime_work+0xee/0x120\n process_one_work+0xde3/0x1410\n worker_thread+0x5eb/0xfe0\n kthread+0x37b/0x480\n ret_from_fork+0x6cb/0x920\n ret_from_fork_asm+0x11/0x20\n \n\nAllocated by task 4314:\n kasan_save_stack+0x2a/0x50\n kasan_save_track+0x18/0x40\n kasan_save_alloc_info+0x3d/0x50\n __kasan_kmalloc+0xa0/0xb0\n __kmalloc_noprof+0x311/0x990\n scsi_alloc_target+0x122/0xb60 [scsi_mod]\n __scsi_scan_target+0x101/0x460 [scsi_mod]\n scsi_scan_channel+0x179/0x1c0 [scsi_mod]\n scsi_scan_host_selected+0x259/0x2d0 [scsi_mod]\n store_scan+0x2d2/0x390 [scsi_mod]\n dev_attr_store+0x43/0x80\n sysfs_kf_write+0xde/0x140\n kernfs_fop_write_iter+0x3ef/0x670\n vfs_write+0x506/0x1470\n ksys_write+0xfd/0x230\n __x64_sys_write+0x76/0xc0\n x64_sys_call+0x213/0x1810\n do_syscall_64+0xee/0xfc0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nFreed by task 4314:\n kasan_save_stack+0x2a/0x50\n kasan_save_track+0x18/0x40\n kasan_save_free_info+0x3f/0x50\n __kasan_slab_free+0x67/0x80\n kfree+0x225/0x6c0\n scsi_target_dev_release+0x3d/0x60 [scsi_mod]\n device_release+0xa3/0x220\n kobject_cleanup+0x105/0x3a0\n kobject_put+0x72/0xd0\n put_device+0x17/0x20\n scsi_device_dev_release+0xacf/0x12c0 [scsi_mod]\n device_release+0xa3/0x220\n kobject_cleanup+0x105/0x3a0\n kobject_put+0x72/0xd0\n put_device+0x17/0x20\n scsi_device_put+0x7f/0xc0 [scsi_mod]\n sdev_store_delete+0xa5/0x120 [scsi_mod]\n dev_attr_store+0x43/0x80\n sysfs_kf_write+0xde/0x140\n kernfs_fop_write_iter+0x3ef/0x670\n vfs_write+0x506/0x1470\n ksys_write+0xfd/0x230\n __x64_sys_write+0x76/0xc0\n x64_sys_call+0x213/0x1810",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23452"
},
{
"cve": "CVE-2026-23454",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown\n\nA potential race condition exists in mana_hwc_destroy_channel() where\nhwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and\nEvent Queue (EQ) are destroyed. This allows an in-flight CQ interrupt\nhandler to dereference freed memory, leading to a use-after-free or\nNULL pointer dereference in mana_hwc_handle_resp().\n\nmana_smc_teardown_hwc() signals the hardware to stop but does not\nsynchronize against IRQ handlers already executing on other CPUs. The\nIRQ synchronization only happens in mana_hwc_destroy_cq() via\nmana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs\nafter kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler()\ncan dereference freed caller_ctx (and rxq->msg_buf) in\nmana_hwc_handle_resp().\n\nFix this by reordering teardown to reverse-of-creation order: destroy\nthe TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This\nensures all in-flight interrupt handlers complete before the memory they\naccess is freed.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23454"
},
{
"cve": "CVE-2026-23455",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: check for zero length in DecodeQ931()\n\nIn DecodeQ931(), the UserUserIE code path reads a 16-bit length from\nthe packet, then decrements it by 1 to skip the protocol discriminator\nbyte before passing it to DecodeH323_UserInformation(). If the encoded\nlength is 0, the decrement wraps to -1, which is then passed as a\nlarge value to the decoder, leading to an out-of-bounds read.\n\nAdd a check to ensure len is positive after the decrement.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23455"
},
{
"cve": "CVE-2026-23456",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case\n\nIn decode_int(), the CONS case calls get_bits(bs, 2) to read a length\nvalue, then calls get_uint(bs, len) without checking that len bytes\nremain in the buffer. The existing boundary check only validates the\n2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint()\nreads. This allows a malformed H.323/RAS packet to cause a 1-4 byte\nslab-out-of-bounds read.\n\nAdd a boundary check for len bytes after get_bits() and before\nget_uint().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23456"
},
{
"cve": "CVE-2026-23457",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()\n\nsip_help_tcp() parses the SIP Content-Length header with\nsimple_strtoul(), which returns unsigned long, but stores the result in\nunsigned int clen. On 64-bit systems, values exceeding UINT_MAX are\nsilently truncated before computing the SIP message boundary.\n\nFor example, Content-Length 4294967328 (2^32 + 32) is truncated to 32,\ncausing the parser to miscalculate where the current message ends. The\nloop then treats trailing data in the TCP segment as a second SIP\nmessage and processes it through the SDP parser.\n\nFix this by changing clen to unsigned long to match the return type of\nsimple_strtoul(), and reject Content-Length values that exceed the\nremaining TCP payload length.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23457"
},
{
"cve": "CVE-2026-23458",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()\n\nctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the\nnetlink dump callback ctnetlink_exp_ct_dump_table(), but drops the\nconntrack reference immediately after netlink_dump_start(). When the\ndump spans multiple rounds, the second recvmsg() triggers the dump\ncallback which dereferences the now-freed conntrack via nfct_help(ct),\nleading to a use-after-free on ct->ext.\n\nThe bug is that the netlink_dump_control has no .start or .done\ncallbacks to manage the conntrack reference across dump rounds. Other\ndump functions in the same file (e.g. ctnetlink_get_conntrack) properly\nuse .start/.done callbacks for this purpose.\n\nFix this by adding .start and .done callbacks that hold and release the\nconntrack reference for the duration of the dump, and move the\nnfct_help() call after the cb->args[0] early-return check in the dump\ncallback to avoid dereferencing ct->ext unnecessarily.\n\n BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0\n Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133\n\n CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY\n Call Trace:\n \n ctnetlink_exp_ct_dump_table+0x4f/0x2e0\n netlink_dump+0x333/0x880\n netlink_recvmsg+0x3e2/0x4b0\n ? aa_sk_perm+0x184/0x450\n sock_recvmsg+0xde/0xf0\n\n Allocated by task 133:\n kmem_cache_alloc_noprof+0x134/0x440\n __nf_conntrack_alloc+0xa8/0x2b0\n ctnetlink_create_conntrack+0xa1/0x900\n ctnetlink_new_conntrack+0x3cf/0x7d0\n nfnetlink_rcv_msg+0x48e/0x510\n netlink_rcv_skb+0xc9/0x1f0\n nfnetlink_rcv+0xdb/0x220\n netlink_unicast+0x3ec/0x590\n netlink_sendmsg+0x397/0x690\n __sys_sendmsg+0xf4/0x180\n\n Freed by task 0:\n slab_free_after_rcu_debug+0xad/0x1e0\n rcu_core+0x5c3/0x9c0",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23458"
},
{
"cve": "CVE-2026-23463",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: fsl: qbman: fix race condition in qman_destroy_fq\n\nWhen QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between\nfq_table[fq->idx] state and freeing/allocating from the pool and\nWARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered.\n\nIndeed, we can have:\n Thread A Thread B\n qman_destroy_fq() qman_create_fq()\n qman_release_fqid()\n qman_shutdown_fq()\n gen_pool_free()\n -- At this point, the fqid is available again --\n qman_alloc_fqid()\n -- so, we can get the just-freed fqid in thread B --\n fq->fqid = fqid;\n fq->idx = fqid * 2;\n WARN_ON(fq_table[fq->idx]);\n fq_table[fq->idx] = fq;\n fq_table[fq->idx] = NULL;\n\nAnd adding some logs between qman_release_fqid() and\nfq_table[fq->idx] = NULL makes the WARN_ON() trigger a lot more.\n\nTo prevent that, ensure that fq_table[fq->idx] is set to NULL before\ngen_pool_free() is called by using smp_wmb().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23463"
},
{
"cve": "CVE-2026-23474",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: Avoid boot crash in RedBoot partition table parser\n\nGiven CONFIG_FORTIFY_SOURCE=y and a recent compiler,\ncommit 439a1bcac648 (\"fortify: Use __builtin_dynamic_object_size() when\navailable\") produces the warning below and an oops.\n\n Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000\n ------------[ cut here ]------------\n WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1\n memcmp: detected buffer overflow: 15 byte read of buffer size 14\n Modules linked in:\n CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE\n\nAs Kees said, \"'names' is pointing to the final 'namelen' many bytes\nof the allocation ... 'namelen' could be basically any length at all.\nThis fortify warning looks legit to me -- this code used to be reading\nbeyond the end of the allocation.\"\n\nSince the size of the dynamic allocation is calculated with strlen()\nwe can use strcmp() instead of memcmp() and remain within bounds.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23474"
},
{
"cve": "CVE-2026-23475",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fix statistics allocation\n\nThe controller per-cpu statistics is not allocated until after the\ncontroller has been registered with driver core, which leaves a window\nwhere accessing the sysfs attributes can trigger a NULL-pointer\ndereference.\n\nFix this by moving the statistics allocation to controller allocation\nwhile tying its lifetime to that of the controller (rather than using\nimplicit devres).",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-23475"
},
{
"cve": "CVE-2026-31389",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fix use-after-free on controller registration failure\n\nMake sure to deregister from driver core also in the unlikely event that\nper-cpu statistics allocation fails during controller registration to\navoid use-after-free (of driver resources) and unclocked register\naccesses.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31389"
},
{
"cve": "CVE-2026-31391",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: atmel-sha204a - Fix OOM ->tfm_count leak\n\nIf memory allocation fails, decrement ->tfm_count to avoid blocking\nfuture reads.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31391"
},
{
"cve": "CVE-2026-31396",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix use-after-free access to PTP clock\n\nPTP clock is registered on every opening of the interface and destroyed on\nevery closing. However it may be accessed via get_ts_info ethtool call\nwhich is possible while the interface is just present in the kernel.\n\nBUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426\nRead of size 4 at addr ffff8880194345cc by task syz.0.6/948\n\nCPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:316 [inline]\n print_report+0x17f/0x496 mm/kasan/report.c:420\n kasan_report+0xd9/0x180 mm/kasan/report.c:524\n ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426\n gem_get_ts_info+0x138/0x1e0 drivers/net/ethernet/cadence/macb_main.c:3349\n macb_get_ts_info+0x68/0xb0 drivers/net/ethernet/cadence/macb_main.c:3371\n __ethtool_get_ts_info+0x17c/0x260 net/ethtool/common.c:558\n ethtool_get_ts_info net/ethtool/ioctl.c:2367 [inline]\n __dev_ethtool net/ethtool/ioctl.c:3017 [inline]\n dev_ethtool+0x2b05/0x6290 net/ethtool/ioctl.c:3095\n dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510\n sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215\n sock_ioctl+0x577/0x6d0 net/socket.c:1320\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:46 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n \n\nAllocated by task 457:\n kmalloc include/linux/slab.h:563 [inline]\n kzalloc include/linux/slab.h:699 [inline]\n ptp_clock_register+0x144/0x10e0 drivers/ptp/ptp_clock.c:235\n gem_ptp_init+0x46f/0x930 drivers/net/ethernet/cadence/macb_ptp.c:375\n macb_open+0x901/0xd10 drivers/net/ethernet/cadence/macb_main.c:2920\n __dev_open+0x2ce/0x500 net/core/dev.c:1501\n __dev_change_flags+0x56a/0x740 net/core/dev.c:8651\n dev_change_flags+0x92/0x170 net/core/dev.c:8722\n do_setlink+0xaf8/0x3a80 net/core/rtnetlink.c:2833\n __rtnl_newlink+0xbf4/0x1940 net/core/rtnetlink.c:3608\n rtnl_newlink+0x63/0xa0 net/core/rtnetlink.c:3655\n rtnetlink_rcv_msg+0x3c6/0xed0 net/core/rtnetlink.c:6150\n netlink_rcv_skb+0x15d/0x430 net/netlink/af_netlink.c:2511\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x6d7/0xa30 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x97e/0xeb0 net/netlink/af_netlink.c:1872\n sock_sendmsg_nosec net/socket.c:718 [inline]\n __sock_sendmsg+0x14b/0x180 net/socket.c:730\n __sys_sendto+0x320/0x3b0 net/socket.c:2152\n __do_sys_sendto net/socket.c:2164 [inline]\n __se_sys_sendto net/socket.c:2160 [inline]\n __x64_sys_sendto+0xdc/0x1b0 net/socket.c:2160\n do_syscall_x64 arch/x86/entry/common.c:46 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFreed by task 938:\n kasan_slab_free include/linux/kasan.h:177 [inline]\n slab_free_hook mm/slub.c:1729 [inline]\n slab_free_freelist_hook mm/slub.c:1755 [inline]\n slab_free mm/slub.c:3687 [inline]\n __kmem_cache_free+0xbc/0x320 mm/slub.c:3700\n device_release+0xa0/0x240 drivers/base/core.c:2507\n kobject_cleanup lib/kobject.c:681 [inline]\n kobject_release lib/kobject.c:712 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x1cd/0x350 lib/kobject.c:729\n put_device+0x1b/0x30 drivers/base/core.c:3805\n ptp_clock_unregister+0x171/0x270 drivers/ptp/ptp_clock.c:391\n gem_ptp_remove+0x4e/0x1f0 drivers/net/ethernet/cadence/macb_ptp.c:404\n macb_close+0x1c8/0x270 drivers/net/ethernet/cadence/macb_main.c:2966\n __dev_close_many+0x1b9/0x310 net/core/dev.c:1585\n __dev_close net/core/dev.c:1597 [inline]\n __dev_change_flags+0x2bb/0x740 net/core/dev.c:8649\n dev_change_fl\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31396"
},
{
"cve": "CVE-2026-31402",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31402"
},
{
"cve": "CVE-2026-31403",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd\n\nThe /proc/fs/nfs/exports proc entry is created at module init\nand persists for the module's lifetime. exports_proc_open()\ncaptures the caller's current network namespace and stores\nits svc_export_cache in seq->private, but takes no reference\non the namespace. If the namespace is subsequently torn down\n(e.g. container destruction after the opener does setns() to a\ndifferent namespace), nfsd_net_exit() calls nfsd_export_shutdown()\nwhich frees the cache. Subsequent reads on the still-open fd\ndereference the freed cache_detail, walking a freed hash table.\n\nHold a reference on the struct net for the lifetime of the open\nfile descriptor. This prevents nfsd_net_exit() from running --\nand thus prevents nfsd_export_shutdown() from freeing the cache\n-- while any exports fd is open. cache_detail already stores\nits net pointer (cd->net, set by cache_create_net()), so\nexports_release() can retrieve it without additional per-file\nstorage.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31403"
},
{
"cve": "CVE-2026-31411",
"cwe": {
"id": "CWE-822",
"name": "Untrusted Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix crash due to unvalidated vcc pointer in sigd_send()\n\nReproducer available at [1].\n\nThe ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc\npointer from msg->vcc and uses it directly without any validation. This\npointer comes from userspace via sendmsg() and can be arbitrarily forged:\n\n int fd = socket(AF_ATMSVC, SOCK_DGRAM, 0);\n ioctl(fd, ATMSIGD_CTRL); // become ATM signaling daemon\n struct msghdr msg = { .msg_iov = &iov, ... };\n *(unsigned long *)(buf + 4) = 0xdeadbeef; // fake vcc pointer\n sendmsg(fd, &msg, 0); // kernel dereferences 0xdeadbeef\n\nIn normal operation, the kernel sends the vcc pointer to the signaling\ndaemon via sigd_enq() when processing operations like connect(), bind(),\nor listen(). The daemon is expected to return the same pointer when\nresponding. However, a malicious daemon can send arbitrary pointer values.\n\nFix this by introducing find_get_vcc() which validates the pointer by\nsearching through vcc_hash (similar to how sigd_close() iterates over\nall VCCs), and acquires a reference via sock_hold() if found.\n\nSince struct atm_vcc embeds struct sock as its first member, they share\nthe same lifetime. Therefore using sock_hold/sock_put is sufficient to\nkeep the vcc alive while it is being used.\n\nNote that there may be a race with sigd_close() which could mark the vcc\nwith various flags (e.g., ATM_VF_RELEASED) after find_get_vcc() returns.\nHowever, sock_hold() guarantees the memory remains valid, so this race\nonly affects the logical state, not memory safety.\n\n[1]: https://gist.github.com/mrpre/1ba5949c45529c511152e2f4c755b0f3",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31411"
},
{
"cve": "CVE-2026-31414",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: use expect->helper\n\nUse expect->helper in ctnetlink and /proc to dump the helper name.\nUsing nfct_help() without holding a reference to the master conntrack\nis unsafe.\n\nUse exp->master->helper in ctnetlink path if userspace does not provide\nan explicit helper when creating an expectation to retain the existing\nbehaviour. The ctnetlink expectation path holds the reference on the\nmaster conntrack and nf_conntrack_expect lock and the nfnetlink glue\npath refers to the master ct that is attached to the skb.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31414"
},
{
"cve": "CVE-2026-31415",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: avoid overflows in ip6_datagram_send_ctl()\n\nYiming Qian reported :\n\n I believe I found a locally triggerable kernel bug in the IPv6 sendmsg\n ancillary-data path that can panic the kernel via `skb_under_panic()`\n (local DoS).\n\n The core issue is a mismatch between:\n\n - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type\n `__u16`) and\n - a pointer to the *last* provided destination-options header (`opt->dst1opt`)\n\n when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided.\n\n - `include/net/ipv6.h`:\n - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible).\n (lines 291-307, especially 298)\n - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`:\n - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen`\n without rejecting duplicates. (lines 909-933)\n - `net/ipv6/ip6_output.c:__ip6_append_data()`:\n - Uses `opt->opt_flen + opt->opt_nflen` to compute header\n sizes/headroom decisions. (lines 1448-1466, especially 1463-1465)\n - `net/ipv6/ip6_output.c:__ip6_make_skb()`:\n - Calls `ipv6_push_frag_opts()` if `opt->opt_flen` is non-zero.\n (lines 1930-1934)\n - `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`:\n - Push size comes from `ipv6_optlen(opt->dst1opt)` (based on the\n pointed-to header). (lines 1179-1185 and 1206-1211)\n\n 1. `opt_flen` is a 16-bit accumulator:\n\n - `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`.\n\n 2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_DSTOPTS` cmsgs\n and increments `opt_flen` each time:\n\n - In `net/ipv6/datagram.c:909-933`, for `IPV6_DSTOPTS`:\n - It computes `len = ((hdr->hdrlen + 1) << 3);`\n - It checks `CAP_NET_RAW` using `ns_capable(net->user_ns,\n CAP_NET_RAW)`. (line 922)\n - Then it does:\n - `opt->opt_flen += len;` (line 927)\n - `opt->dst1opt = hdr;` (line 928)\n\n There is no duplicate rejection here (unlike the legacy\n `IPV6_2292DSTOPTS` path which rejects duplicates at\n `net/ipv6/datagram.c:901-904`).\n\n If enough large `IPV6_DSTOPTS` cmsgs are provided, `opt_flen` wraps\n while `dst1opt` still points to a large (2048-byte)\n destination-options header.\n\n In the attached PoC (`poc.c`):\n\n - 32 cmsgs with `hdrlen=255` => `len = (255+1)*8 = 2048`\n - 1 cmsg with `hdrlen=0` => `len = 8`\n - Total increment: `32*2048 + 8 = 65544`, so `(__u16)opt_flen == 8`\n - The last cmsg is 2048 bytes, so `dst1opt` points to a 2048-byte header.\n\n 3. The transmit path sizes headers using the wrapped `opt_flen`:\n\n- In `net/ipv6/ip6_output.c:1463-1465`:\n - `headersize = sizeof(struct ipv6hdr) + (opt ? opt->opt_flen +\n opt->opt_nflen : 0) + ...;`\n\n With wrapped `opt_flen`, `headersize`/headroom decisions underestimate\n what will be pushed later.\n\n 4. When building the final skb, the actual push length comes from\n `dst1opt` and is not limited by wrapped `opt_flen`:\n\n - In `net/ipv6/ip6_output.c:1930-1934`:\n - `if (opt->opt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);`\n - In `net/ipv6/exthdrs.c:1206-1211`, `ipv6_push_frag_opts()` pushes\n `dst1opt` via `ipv6_push_exthdr()`.\n - In `net/ipv6/exthdrs.c:1179-1184`, `ipv6_push_exthdr()` does:\n - `skb_push(skb, ipv6_optlen(opt));`\n - `memcpy(h, opt, ipv6_optlen(opt));`\n\n With insufficient headroom, `skb_push()` underflows and triggers\n `skb_under_panic()` -> `BUG()`:\n\n - `net/core/skbuff.c:2669-2675` (`skb_push()` calls `skb_under_panic()`)\n - `net/core/skbuff.c:207-214` (`skb_panic()` ends in `BUG()`)\n\n - The `IPV6_DSTOPTS` cmsg path requires `CAP_NET_RAW` in the target\n netns user namespace (`ns_capable(net->user_ns, CAP_NET_RAW)`).\n - Root (or any task with `CAP_NET_RAW`) can trigger this without user\n namespaces.\n - An unprivileged `uid=1000` user can trigger this if unprivileged\n user namespaces are enabled and it can create a userns+netns to obtain\n namespaced `CAP_NET_RAW` (the attached PoC does this).\n\n - Local denial of service: kernel BUG/panic (system crash).\n -\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31415"
},
{
"cve": "CVE-2026-31416",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: account for netlink header size\n\nThis is a followup to an old bug fix: NLMSG_DONE needs to account\nfor the netlink header size, not just the attribute size.\n\nThis can result in a WARN splat + drop of the netlink message,\nbut other than this there are no ill effects.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31416"
},
{
"cve": "CVE-2026-31417",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: Fix overflow when accumulating packets\n\nAdd a check to ensure that `x25_sock.fraglen` does not overflow.\n\nThe `fraglen` also needs to be resetted when purging `fragment_queue` in\n`x25_clear_queues()`.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31417"
},
{
"cve": "CVE-2026-31418",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: drop logically empty buckets in mtype_del\n\nmtype_del() counts empty slots below n->pos in k, but it only drops the\nbucket when both n->pos and k are zero. This misses buckets whose live\nentries have all been removed while n->pos still points past deleted slots.\n\nTreat a bucket as empty when all positions below n->pos are unused and\nrelease it directly instead of shrinking it further.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31418"
},
{
"cve": "CVE-2026-31421",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_fw: fix NULL pointer dereference on shared blocks\n\nThe old-method path in fw_classify() calls tcf_block_q() and\ndereferences q->handle. Shared blocks leave block->q NULL, causing a\nNULL deref when an empty cls_fw filter is attached to a shared block\nand a packet with a nonzero major skb mark is classified.\n\nReject the configuration in fw_change() when the old method (no\nTCA_OPTIONS) is used on a shared block, since fw_classify()'s\nold-method path needs block->q which is NULL for shared blocks.\n\nThe fixed null-ptr-deref calling stack:\n KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\n RIP: 0010:fw_classify (net/sched/cls_fw.c:81)\n Call Trace:\n tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860)\n tc_run (net/core/dev.c:4401)\n __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31421"
},
{
"cve": "CVE-2026-31422",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_flow: fix NULL pointer dereference on shared blocks\n\nflow_change() calls tcf_block_q() and dereferences q->handle to derive\na default baseclass. Shared blocks leave block->q NULL, causing a NULL\nderef when a flow filter without a fully qualified baseclass is created\non a shared block.\n\nCheck tcf_block_shared() before accessing block->q and return -EINVAL\nfor shared blocks. This avoids the null-deref shown below:\n\n=======================================================================\nKASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\nRIP: 0010:flow_change (net/sched/cls_flow.c:508)\nCall Trace:\n tc_new_tfilter (net/sched/cls_api.c:2432)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)\n [...]\n=======================================================================",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31422"
},
{
"cve": "CVE-2026-31423",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_hfsc: fix divide-by-zero in rtsc_min()\n\nm2sm() converts a u32 slope to a u64 scaled value. For large inputs\n(e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores\nthe difference of two such u64 values in a u32 variable `dsm` and\nuses it as a divisor. When the difference is exactly 2^32 the\ntruncation yields zero, causing a divide-by-zero oops in the\nconcave-curve intersection path:\n\n Oops: divide error: 0000\n RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601)\n Call Trace:\n init_ed (net/sched/sch_hfsc.c:629)\n hfsc_enqueue (net/sched/sch_hfsc.c:1569)\n [...]\n\nWiden `dsm` to u64 and replace do_div() with div64_u64() so the full\ndifference is preserved.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31423"
},
{
"cve": "CVE-2026-31424",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP\n\nWeiming Shi says:\n\nxt_match and xt_target structs registered with NFPROTO_UNSPEC can be\nloaded by any protocol family through nft_compat. When such a\nmatch/target sets .hooks to restrict which hooks it may run on, the\nbitmask uses NF_INET_* constants. This is only correct for families\nwhose hook layout matches NF_INET_*: IPv4, IPv6, INET, and bridge\nall share the same five hooks (PRE_ROUTING ... POST_ROUTING).\n\nARP only has three hooks (IN=0, OUT=1, FORWARD=2) with different\nsemantics. Because NF_ARP_OUT == 1 == NF_INET_LOCAL_IN, the .hooks\nvalidation silently passes for the wrong reasons, allowing matches to\nrun on ARP chains where the hook assumptions (e.g. state->in being\nset on input hooks) do not hold. This leads to NULL pointer\ndereferences; xt_devgroup is one concrete example:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]\n RIP: 0010:devgroup_mt+0xff/0x350\n Call Trace:\n \n nft_match_eval (net/netfilter/nft_compat.c:407)\n nft_do_chain (net/netfilter/nf_tables_core.c:285)\n nft_do_chain_arp (net/netfilter/nft_chain_filter.c:61)\n nf_hook_slow (net/netfilter/core.c:623)\n arp_xmit (net/ipv4/arp.c:666)\n \n Kernel panic - not syncing: Fatal exception in interrupt\n\nFix it by restricting arptables to NFPROTO_ARP extensions only.\nNote that arptables-legacy only supports:\n\n- arpt_CLASSIFY\n- arpt_mangle\n- arpt_MARK\n\nthat provide explicit NFPROTO_ARP match/target declarations.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31424"
},
{
"cve": "CVE-2026-31427",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp\n\nprocess_sdp() declares union nf_inet_addr rtp_addr on the stack and\npasses it to the nf_nat_sip sdp_session hook after walking the SDP\nmedia descriptions. However rtp_addr is only initialized inside the\nmedia loop when a recognized media type with a non-zero port is found.\n\nIf the SDP body contains no m= lines, only inactive media sections\n(m=audio 0 ...) or only unrecognized media types, rtp_addr is never\nassigned. Despite that, the function still calls hooks->sdp_session()\nwith &rtp_addr, causing nf_nat_sdp_session() to format the stale stack\nvalue as an IP address and rewrite the SDP session owner and connection\nlines with it.\n\nWith CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this\nresults in the session-level o= and c= addresses being rewritten to\n0.0.0.0 for inactive SDP sessions. Without stack auto-init the\nrewritten address is whatever happened to be on the stack.\n\nFix this by pre-initializing rtp_addr from the session-level connection\naddress (caddr) when available, and tracking via a have_rtp_addr flag\nwhether any valid address was established. Skip the sdp_session hook\nentirely when no valid address exists.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31427"
},
{
"cve": "CVE-2026-31428",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD\n\n__build_packet_message() manually constructs the NFULA_PAYLOAD netlink\nattribute using skb_put() and skb_copy_bits(), bypassing the standard\nnla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes\nare allocated (including NLA alignment padding), only data_len bytes\nof actual packet data are copied. The trailing nla_padlen(data_len)\nbytes (1-3 when data_len is not 4-byte aligned) are never initialized,\nleaking stale heap contents to userspace via the NFLOG netlink socket.\n\nReplace the manual attribute construction with nla_reserve(), which\nhandles the tailroom check, header setup, and padding zeroing via\n__nla_reserve(). The subsequent skb_copy_bits() fills in the payload\ndata on top of the properly initialized attribute.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31428"
},
{
"cve": "CVE-2026-31431",
"cwe": {
"id": "CWE-669",
"name": "Incorrect Resource Transfer Between Spheres"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31431"
},
{
"cve": "CVE-2026-31441",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix memory leak when a wq is reset\n\nidxd_wq_disable_cleanup() which is called from the reset path for a\nworkqueue, sets the wq type to NONE, which for other parts of the\ndriver mean that the wq is empty (all its resources were released).\n\nOnly set the wq type to NONE after its resources are released.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31441"
},
{
"cve": "CVE-2026-31446",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in update_super_work when racing with umount\n\nCommit b98535d09179 (\"ext4: fix bug_on in start_this_handle during umount\nfilesystem\") moved ext4_unregister_sysfs() before flushing s_sb_upd_work\nto prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups\nreads during unmount. However, this introduced a use-after-free because\nupdate_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which\naccesses the kobject's kernfs_node after it has been freed by kobject_del()\nin ext4_unregister_sysfs():\n\n update_super_work ext4_put_super\n ----------------- --------------\n ext4_unregister_sysfs(sb)\n kobject_del(&sbi->s_kobj)\n __kobject_del()\n sysfs_remove_dir()\n kobj->sd = NULL\n sysfs_put(sd)\n kernfs_put() // RCU free\n ext4_notify_error_sysfs(sbi)\n sysfs_notify(&sbi->s_kobj)\n kn = kobj->sd // stale pointer\n kernfs_get(kn) // UAF on freed kernfs_node\n ext4_journal_destroy()\n flush_work(&sbi->s_sb_upd_work)\n\nInstead of reordering the teardown sequence, fix this by making\next4_notify_error_sysfs() detect that sysfs has already been torn down\nby checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call\nin that case. A dedicated mutex (s_error_notify_mutex) serializes\next4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()\nto prevent TOCTOU races where the kobject could be deleted between the\nstate_in_sysfs check and the sysfs_notify() call.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31446"
},
{
"cve": "CVE-2026-31447",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: reject mount if bigalloc with s_first_data_block != 0\n\nbigalloc with s_first_data_block != 0 is not supported, reject mounting\nit.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31447"
},
{
"cve": "CVE-2026-31448",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid infinite loops caused by residual data\n\nOn the mkdir/mknod path, when mapping logical blocks to physical blocks,\nif inserting a new extent into the extent tree fails (in this example,\nbecause the file system disabled the huge file feature when marking the\ninode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to\nreclaim the physical block without deleting the corresponding data in\nthe extent tree. This causes subsequent mkdir operations to reference\nthe previously reclaimed physical block number again, even though this\nphysical block is already being used by the xattr block. Therefore, a\nsituation arises where both the directory and xattr are using the same\nbuffer head block in memory simultaneously.\n\nThe above causes ext4_xattr_block_set() to enter an infinite loop about\n\"inserted\" and cannot release the inode lock, ultimately leading to the\n143s blocking problem mentioned in [1].\n\nIf the metadata is corrupted, then trying to remove some extent space\ncan do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE\nwas passed, remove space wrongly update quota information.\nJan Kara suggests distinguishing between two cases:\n\n1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully\nconsistent and we must maintain its consistency including all the\naccounting. However these errors can happen only early before we've\ninserted the extent into the extent tree. So current code works correctly\nfor this case.\n\n2) Some other error - this means metadata is corrupted. We should strive to\ndo as few modifications as possible to limit damage. So I'd just skip\nfreeing of allocated blocks.\n\n[1]\nINFO: task syz.0.17:5995 blocked for more than 143 seconds.\nCall Trace:\n inode_lock_nested include/linux/fs.h:1073 [inline]\n __start_dirop fs/namei.c:2923 [inline]\n start_dirop fs/namei.c:2934 [inline]",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31448"
},
{
"cve": "CVE-2026-31450",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei->jinode to concurrent users.\nIt used to set ei->jinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei->jinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31450"
},
{
"cve": "CVE-2026-31452",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode's actual\ninline capacity (EXT4_I(inode)->i_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31452"
},
{
"cve": "CVE-2026-31466",
"cwe": {
"id": "CWE-366",
"name": "Race Condition within a Thread"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix folio isn't locked in softleaf_to_folio()\n\nOn arm64 server, we found folio that get from migration entry isn't locked\nin softleaf_to_folio(). This issue triggers when mTHP splitting and\nzap_nonpresent_ptes() races, and the root cause is lack of memory barrier\nin softleaf_to_folio(). The race is as follows:\n\n\tCPU0 CPU1\n\ndeferred_split_scan() zap_nonpresent_ptes()\n lock folio\n split_folio()\n unmap_folio()\n change ptes to migration entries\n __split_folio_to_order() softleaf_to_folio()\n set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))\n smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))\n prep_compound_page() for tail pages\n\nIn __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages\nare visible before the tail page becomes non-compound. smp_wmb() should\nbe paired with smp_rmb() in softleaf_to_folio(), which is missed. As a\nresult, if zap_nonpresent_ptes() accesses migration entry that stores tail\npfn, softleaf_to_folio() may see the updated compound_head of tail page\nbefore page->flags.\n\nThis issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()\nbecause of the race between folio split and zap_nonpresent_ptes()\nleading to a folio incorrectly undergoing modification without a folio\nlock being held.\n\nThis is a BUG_ON() before commit 93976a20345b (\"mm: eliminate further\nswapops predicates\"), which in merged in v6.19-rc1.\n\nTo fix it, add missing smp_rmb() if the softleaf entry is migration entry\nin softleaf_to_folio() and softleaf_to_page().\n\n[tujinjiang@huawei.com: update function name and comments]",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31466"
},
{
"cve": "CVE-2026-31469",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device's IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb->dst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n ...\n percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n dst_release+0xe0/0x110 net/core/dst.c:177\n skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]\n free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n ...\n\nReproduction Steps:\nNETDEV=\"enp3s0\"\n\nconfig_qdisc_route_filter() {\n tc qdisc del dev $NETDEV root\n tc qdisc add dev $NETDEV root handle 1: prio\n tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n ip netns add testns\n ip link set $NETDEV netns testns\n ip netns exec testns ifconfig $NETDEV 10.0.32.46/24\n ip netns exec testns ping -c 1 10.0.32.1\n ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31469"
},
{
"cve": "CVE-2026-31485",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver. The SPI controller is\nregistered using devm_spi_register_controller(), which delays\nunregistration of the SPI controller until after the fsl_lpspi_remove()\nfunction returns.\n\nAs the fsl_lpspi_remove() function synchronously tears down the DMA\nchannels, a running SPI transfer triggers the following NULL pointer\ndereference due to use after free:\n\n| fsl_lpspi 42550000.spi: I/O Error in DMA RX\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[...]\n| Call trace:\n| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]\n| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]\n| spi_transfer_one_message+0x49c/0x7c8\n| __spi_pump_transfer_message+0x120/0x420\n| __spi_sync+0x2c4/0x520\n| spi_sync+0x34/0x60\n| spidev_message+0x20c/0x378 [spidev]\n| spidev_ioctl+0x398/0x750 [spidev]\n[...]\n\nSwitch from devm_spi_register_controller() to spi_register_controller() in\nfsl_lpspi_probe() and add the corresponding spi_unregister_controller() in\nfsl_lpspi_remove().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31485"
},
{
"cve": "CVE-2026-31494",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: use the current queue number for stats\n\nThere's a potential mismatch between the memory reserved for statistics\nand the amount of memory written.\n\ngem_get_sset_count() correctly computes the number of stats based on the\nactive queues, whereas gem_get_ethtool_stats() indiscriminately copies\ndata using the maximum number of queues, and in the case the number of\nactive queues is less than MACB_MAX_QUEUES, this results in a OOB write\nas observed in the KASAN splat.\n\n==================================================================\nBUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78\n [macb]\nWrite of size 760 at addr ffff80008080b000 by task ethtool/1027\n\nCPU: [...]\nTainted: [E]=UNSIGNED_MODULE\nHardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025\nCall trace:\n show_stack+0x20/0x38 (C)\n dump_stack_lvl+0x80/0xf8\n print_report+0x384/0x5e0\n kasan_report+0xa0/0xf0\n kasan_check_range+0xe8/0x190\n __asan_memcpy+0x54/0x98\n gem_get_ethtool_stats+0x54/0x78 [macb\n 926c13f3af83b0c6fe64badb21ec87d5e93fcf65]\n dev_ethtool+0x1220/0x38c0\n dev_ioctl+0x4ac/0xca8\n sock_do_ioctl+0x170/0x1d8\n sock_ioctl+0x484/0x5d8\n __arm64_sys_ioctl+0x12c/0x1b8\n invoke_syscall+0xd4/0x258\n el0_svc_common.constprop.0+0xb4/0x240\n do_el0_svc+0x48/0x68\n el0_svc+0x40/0xf8\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1b0/0x1b8\n\nThe buggy address belongs to a 1-page vmalloc region starting at\n 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff00000a333000 pfn:0xa333\nflags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)\nraw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000\nraw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n==================================================================\n\nFix it by making sure the copied size only considers the active number of\nqueues.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31494"
},
{
"cve": "CVE-2026-31495",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use netlink policy range checks\n\nReplace manual range and mask validations with netlink policy\nannotations in ctnetlink code paths, so that the netlink core rejects\ninvalid values early and can generate extack errors.\n\n- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at\n policy level, removing the manual >= TCP_CONNTRACK_MAX check.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE\n (14). The normal TCP option parsing path already clamps to this value,\n but the ctnetlink path accepted 0-255, causing undefined behavior when\n used as a u32 shift count.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with\n CTA_FILTER_F_ALL, removing the manual mask checks.\n- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding\n a new mask define grouping all valid expect flags.\n\nExtracted from a broader nf-next patch by Florian Westphal, scoped to\nctnetlink for the fixes tree.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31495"
},
{
"cve": "CVE-2026-31496",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: skip expectations in other netns via proc\n\nSkip expectations that do not reside in this netns.\n\nSimilar to e77e6ff502ea (\"netfilter: conntrack: do not dump other netns's\nconntrack entries via proc\").",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31496"
},
{
"cve": "CVE-2026-31503",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable->hash and udptable->hash2) for collision\ndetection. The current code switches to \"hash2\" when\nhslot->count > 10.\n\n\"hash2\" is keyed by local address and local port.\n\"hash\" is keyed by local port only.\n\nThe issue can be shown in the following bind sequence (pseudo code):\n\nbind(fd1, \"[fd00::1]:8888\")\nbind(fd2, \"[fd00::2]:8888\")\nbind(fd3, \"[fd00::3]:8888\")\nbind(fd4, \"[fd00::4]:8888\")\nbind(fd5, \"[fd00::5]:8888\")\nbind(fd6, \"[fd00::6]:8888\")\nbind(fd7, \"[fd00::7]:8888\")\nbind(fd8, \"[fd00::8]:8888\")\nbind(fd9, \"[fd00::9]:8888\")\nbind(fd10, \"[fd00::10]:8888\")\n\n/* Correctly return -EADDRINUSE because \"hash\" is used\n * instead of \"hash2\". udp_lib_lport_inuse() detects the\n * conflict.\n */\nbind(fail_fd, \"[::]:8888\")\n\n/* After one more socket is bound to \"[fd00::11]:8888\",\n * hslot->count exceeds 10 and \"hash2\" is used instead.\n */\nbind(fd11, \"[fd00::11]:8888\")\nbind(fail_fd, \"[::]:8888\") /* succeeds unexpectedly */\n\nThe same issue applies to the IPv4 wildcard address \"0.0.0.0\"\nand the IPv4-mapped wildcard address \"::ffff:0.0.0.0\". For\nexample, if there are existing sockets bound to\n\"192.168.1.[1-11]:8888\", then binding \"0.0.0.0:8888\" or\n\"[::ffff:0.0.0.0]:8888\" can also miss the conflict when\nhslot->count > 10.\n\nTCP inet_csk_get_port() already has the correct check in\ninet_use_bhash2_on_bind(). Rename it to\ninet_use_hash2_on_bind() and move it to inet_hashtables.h\nso udp.c can reuse it in this fix.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31503"
},
{
"cve": "CVE-2026-31504",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group's `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po->num` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f->arr[]` and increments `f->num_members`,\nbut does NOT increment `f->sk_ref`.\n\nThe fix sets `po->num` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31504"
},
{
"cve": "CVE-2026-31507",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer\n\nsmc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores\nthe pointer in pipe_buffer.private. The pipe_buf_operations for these\nbuffers used .get = generic_pipe_buf_get, which only increments the page\nreference count when tee(2) duplicates a pipe buffer. The smc_spd_priv\npointer itself was not handled, so after tee() both the original and the\ncloned pipe_buffer share the same smc_spd_priv *.\n\nWhen both pipes are subsequently released, smc_rx_pipe_buf_release() is\ncalled twice against the same object:\n\n 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]\n 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which\nthen escalates to a NULL-pointer dereference and kernel panic via\nsmc_rx_update_consumer() when it chases the freed priv->smc pointer:\n\n BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0\n Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74\n Call Trace:\n \n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Call Trace:\n \n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n Kernel panic - not syncing: Fatal exception\n\nBeyond the memory-safety problem, duplicating an SMC splice buffer is\nsemantically questionable: smc_rx_update_cons() would advance the\nconsumer cursor twice for the same data, corrupting receive-window\naccounting. A refcount on smc_spd_priv could fix the double-free, but\nthe cursor-accounting issue would still need to be addressed separately.\n\nThe .get callback is invoked by both tee(2) and splice_pipe_to_pipe()\nfor partial transfers; both will now return -EFAULT. Users who need\nto duplicate SMC socket data must use a copy-based read path.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31507"
},
{
"cve": "CVE-2026-31508",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: Avoid releasing netdev before teardown completes\n\nThe patch cited in the Fixes tag below changed the teardown code for\nOVS ports to no longer unconditionally take the RTNL. After this change,\nthe netdev_destroy() callback can proceed immediately to the call_rcu()\ninvocation if the IFF_OVS_DATAPATH flag is already cleared on the\nnetdev.\n\nThe ovs_netdev_detach_dev() function clears the flag before completing\nthe unregistration, and if it gets preempted after clearing the flag (as\ncan happen on an -rt kernel), netdev_destroy() can complete and the\ndevice can be freed before the unregistration completes. This leads to a\nsplat like:\n\n[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI\n[ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT\n[ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025\n[ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0\n[ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90\n[ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246\n[ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000\n[ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05\n[ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000\n[ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006\n[ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000\n[ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000\n[ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0\n[ 998.393944] PKRU: 55555554\n[ 998.393946] Call Trace:\n[ 998.393949] \n[ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0\n[ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0\n[ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch]\n[ 998.394009] ? __die_body.cold+0x8/0x12\n[ 998.394016] ? die_addr+0x3c/0x60\n[ 998.394027] ? exc_general_protection+0x16d/0x390\n[ 998.394042] ? asm_exc_general_protection+0x26/0x30\n[ 998.394058] ? dev_set_promiscuity+0x8d/0xa0\n[ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch]\n[ 998.394092] dp_device_event+0x41/0x80 [openvswitch]\n[ 998.394102] notifier_call_chain+0x5a/0xd0\n[ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60\n[ 998.394110] rtnl_dellink+0x169/0x3e0\n[ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0\n[ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0\n[ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0\n[ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n[ 998.394132] netlink_rcv_skb+0x50/0x100\n[ 998.394138] netlink_unicast+0x292/0x3f0\n[ 998.394141] netlink_sendmsg+0x21b/0x470\n[ 998.394145] ____sys_sendmsg+0x39d/0x3d0\n[ 998.394149] ___sys_sendmsg+0x9a/0xe0\n[ 998.394156] __sys_sendmsg+0x7a/0xd0\n[ 998.394160] do_syscall_64+0x7f/0x170\n[ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 998.394165] RIP: 0033:0x7fad61bf4724\n[ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89\n[ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e\n[ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724\n[ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003\n[ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f\n[ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2\n---truncated---",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31508"
},
{
"cve": "CVE-2026-31515",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_key: validate families in pfkey_send_migrate()\n\nsyzbot was able to trigger a crash in skb_put() [1]\n\nIssue is that pfkey_send_migrate() does not check old/new families,\nand that set_ipsecrequest() @family argument was truncated,\nthus possibly overfilling the skb.\n\nValidate families early, do not wait set_ipsecrequest().\n\n[1]\n\nskbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:\n kernel BUG at net/core/skbuff.c:214 !\nCall Trace:\n \n skb_over_panic net/core/skbuff.c:219 [inline]\n skb_put+0x159/0x210 net/core/skbuff.c:2655\n skb_put_zero include/linux/skbuff.h:2788 [inline]\n set_ipsecrequest net/key/af_key.c:3532 [inline]\n pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636\n km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848\n xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705\n xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31515"
},
{
"cve": "CVE-2026-31518",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nesp: fix skb leak with espintcp and async crypto\n\nWhen the TX queue for espintcp is full, esp_output_tail_tcp will\nreturn an error and not free the skb, because with synchronous crypto,\nthe common xfrm output code will drop the packet for us.\n\nWith async crypto (esp_output_done), we need to drop the skb when\nesp_output_tail_tcp returns an error.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31518"
},
{
"cve": "CVE-2026-31521",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmodule: Fix kernel panic when a symbol st_shndx is out of bounds\n\nThe module loader doesn't check for bounds of the ELF section index in\nsimplify_symbols():\n\n for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {\n\t\tconst char *name = info->strtab + sym[i].st_name;\n\n\t\tswitch (sym[i].st_shndx) {\n\t\tcase SHN_COMMON:\n\n\t\t[...]\n\n\t\tdefault:\n\t\t\t/* Divert to percpu allocation if a percpu var. */\n\t\t\tif (sym[i].st_shndx == info->index.pcpu)\n\t\t\t\tsecbase = (unsigned long)mod_percpu(mod);\n\t\t\telse\n /** HERE --> **/\t\tsecbase = info->sechdrs[sym[i].st_shndx].sh_addr;\n\t\t\tsym[i].st_value += secbase;\n\t\t\tbreak;\n\t\t}\n\t}\n\nA symbol with an out-of-bounds st_shndx value, for example 0xffff\n(known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:\n\n BUG: unable to handle page fault for address: ...\n RIP: 0010:simplify_symbols+0x2b2/0x480\n ...\n Kernel panic - not syncing: Fatal exception\n\nThis can happen when module ELF is legitimately using SHN_XINDEX or\nwhen it is corrupted.\n\nAdd a bounds check in simplify_symbols() to validate that st_shndx is\nwithin the valid range before using it.\n\nThis issue was discovered due to a bug in llvm-objcopy, see relevant\ndiscussion for details [1].\n\n[1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31521"
},
{
"cve": "CVE-2026-31533",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: fix use-after-free in -EBUSY error path of tls_do_encryption\n\nThe -EBUSY handling in tls_do_encryption(), introduced by commit\n859054147318 (\"net: tls: handle backlogging of crypto requests\"), has\na use-after-free due to double cleanup of encrypt_pending and the\nscatterlist entry.\n\nWhen crypto_aead_encrypt() returns -EBUSY, the request is enqueued to\nthe cryptd backlog and the async callback tls_encrypt_done() will be\ninvoked upon completion. That callback unconditionally restores the\nscatterlist entry (sge->offset, sge->length) and decrements\nctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an\nerror, the synchronous error path in tls_do_encryption() performs the\nsame cleanup again, double-decrementing encrypt_pending and\ndouble-restoring the scatterlist.\n\nThe double-decrement corrupts the encrypt_pending sentinel (initialized\nto 1), making tls_encrypt_async_wait() permanently skip the wait for\npending async callbacks. A subsequent sendmsg can then free the\ntls_rec via bpf_exec_tx_verdict() while a cryptd callback is still\npending, resulting in a use-after-free when the callback fires on the\nfreed record.\n\nFix this by skipping the synchronous cleanup when the -EBUSY async\nwait returns an error, since the callback has already handled\nencrypt_pending and sge restoration.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31533"
},
{
"cve": "CVE-2026-31546",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix NULL deref in bond_debug_rlb_hash_show\n\nrlb_clear_slave intentionally keeps RLB hash-table entries on\nthe rx_hashtbl_used_head list with slave set to NULL when no\nreplacement slave is available. However, bond_debug_rlb_hash_show\nvisites client_info->slave without checking if it's NULL.\n\nOther used-list iterators in bond_alb.c already handle this NULL-slave\nstate safely:\n\n- rlb_update_client returns early on !client_info->slave\n- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance\ncompare slave values before visiting\n- lb_req_update_subnet_clients continues if slave is NULL\n\nThe following NULL deref crash can be trigger in\nbond_debug_rlb_hash_show:\n\n[ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)\n[ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286\n[ 1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204\n[ 1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078\n[ 1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000\n[ 1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0\n[ 1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8\n[ 1.294864] FS: 0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000\n[ 1.295239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0\n[ 1.295897] Call Trace:\n[ 1.296134] seq_read_iter (fs/seq_file.c:231)\n[ 1.296341] seq_read (fs/seq_file.c:164)\n[ 1.296493] full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))\n[ 1.296658] vfs_read (fs/read_write.c:572)\n[ 1.296981] ksys_read (fs/read_write.c:717)\n[ 1.297132] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[ 1.297325] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd a NULL check and print \"(none)\" for entries with no assigned slave.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31546"
},
{
"cve": "CVE-2026-31555",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in 'exiting'.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n CPU0\t\t\t CPU1\t\t CPU2\n futex_lock_pi(uaddr)\n // acquires the PI futex\n exit()\n futex_cleanup_begin()\n futex_state = EXITING;\n\t\t\t futex_lock_pi(uaddr)\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t // observes EXITING\n\t\t\t\t *exiting = owner; // takes ref\n\t\t\t\t return -EBUSY\n\t\t\t wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct(); // drops ref\n\t\t\t // exiting still points to owner\n\t\t\t goto retry;\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31555"
},
{
"cve": "CVE-2026-31563",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: Use dev_consume_skb_any() to free TX SKBs\n\nThe napi_consume_skb() function is not intended to be called in an IRQ\ndisabled context. However, after commit 6bc8a5098bf4 (\"net: macb: Fix\ntx_ptr_lock locking\"), the freeing of TX SKBs is performed with IRQs\ndisabled. To resolve the following call trace, use dev_consume_skb_any()\nfor freeing TX SKBs:\n WARNING: kernel/softirq.c:430 at __local_bh_enable_ip+0x174/0x188, CPU#0: ksoftirqd/0/15\n Modules linked in:\n CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 7.0.0-rc4-next-20260319-yocto-standard-dirty #37 PREEMPT\n Hardware name: ZynqMP ZCU102 Rev1.1 (DT)\n pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __local_bh_enable_ip+0x174/0x188\n lr : local_bh_enable+0x24/0x38\n sp : ffff800082b3bb10\n x29: ffff800082b3bb10 x28: ffff0008031f3c00 x27: 000000000011ede0\n x26: ffff000800a7ff00 x25: ffff800083937ce8 x24: 0000000000017a80\n x23: ffff000803243a78 x22: 0000000000000040 x21: 0000000000000000\n x20: ffff000800394c80 x19: 0000000000000200 x18: 0000000000000001\n x17: 0000000000000001 x16: ffff000803240000 x15: 0000000000000000\n x14: ffffffffffffffff x13: 0000000000000028 x12: ffff000800395650\n x11: ffff8000821d1528 x10: ffff800081c2bc08 x9 : ffff800081c1e258\n x8 : 0000000100000301 x7 : ffff8000810426ec x6 : 0000000000000000\n x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000\n x2 : 0000000000000008 x1 : 0000000000000200 x0 : ffff8000810428dc\n Call trace:\n __local_bh_enable_ip+0x174/0x188 (P)\n local_bh_enable+0x24/0x38\n skb_attempt_defer_free+0x190/0x1d8\n napi_consume_skb+0x58/0x108\n macb_tx_poll+0x1a4/0x558\n __napi_poll+0x50/0x198\n net_rx_action+0x1f4/0x3d8\n handle_softirqs+0x16c/0x560\n run_ksoftirqd+0x44/0x80\n smpboot_thread_fn+0x1d8/0x338\n kthread+0x120/0x150\n ret_from_fork+0x10/0x20\n irq event stamp: 29751\n hardirqs last enabled at (29750): [] _raw_spin_unlock_irqrestore+0x44/0x88\n hardirqs last disabled at (29751): [] _raw_spin_lock_irqsave+0x38/0x98\n softirqs last enabled at (29150): [] handle_softirqs+0x504/0x560\n softirqs last disabled at (29153): [] run_ksoftirqd+0x44/0x80",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31563"
},
{
"cve": "CVE-2026-31565",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix deadlock during netdev reset with active connections\n\nResolve deadlock that occurs when user executes netdev reset while RDMA\napplications (e.g., rping) are active. The netdev reset causes ice\ndriver to remove irdma auxiliary driver, triggering device_delete and\nsubsequent client removal. During client removal, uverbs_client waits\nfor QP reference count to reach zero while cma_client holds the final\nreference, creating circular dependency and indefinite wait in iWARP\nmode. Skip QP reference count wait during device reset to prevent\ndeadlock.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31565"
},
{
"cve": "CVE-2026-31628",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU: Fix FPDSS on Zen1\n\nZen1's hardware divider can leave, under certain circumstances, partial\nresults from previous operations. Those results can be leaked by\nanother, attacker thread.\n\nFix that with a chicken bit.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31628"
},
{
"cve": "CVE-2026-31634",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix reference count leak in rxrpc_server_keyring()\n\nThis patch fixes a reference count leak in rxrpc_server_keyring()\nby checking if rx->securities is already set.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31634"
},
{
"cve": "CVE-2026-31649",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix integer underflow in chain mode\n\nThe jumbo_frm() chain-mode implementation unconditionally computes\n\n len = nopaged_len - bmax;\n\nwhere nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is\nBUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit()\ndecides to invoke jumbo_frm() based on skb->len (total length including\npage fragments):\n\n is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);\n\nWhen a packet has a small linear portion (nopaged_len <= bmax) but a\nlarge total length due to page fragments (skb->len > bmax), the\nsubtraction wraps as an unsigned integer, producing a huge len value\n(~0xFFFFxxxx). This causes the while (len != 0) loop to execute\nhundreds of thousands of iterations, passing skb->data + bmax * i\npointers far beyond the skb buffer to dma_map_single(). On IOMMU-less\nSoCs (the typical deployment for stmmac), this maps arbitrary kernel\nmemory to the DMA engine, constituting a kernel memory disclosure and\npotential memory corruption from hardware.\n\nFix this by introducing a buf_len local variable clamped to\nmin(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then\nalways safe: it is zero when the linear portion fits within a single\ndescriptor, causing the while (len != 0) loop to be skipped naturally,\nand the fragment loop in stmmac_xmit() handles page fragments afterward.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31649"
},
{
"cve": "CVE-2026-31651",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix NULL-deref on disconnect\n\nMake sure to deregister the controller before dropping the reference to\nthe driver data on disconnect to avoid NULL-pointer dereferences or\nuse-after-free.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31651"
},
{
"cve": "CVE-2026-31658",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()\n\nWhen dma_map_single() fails in tse_start_xmit(), the function returns\nNETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the\nstack the packet was consumed, the skb is never freed, leaking memory\non every DMA mapping failure.\n\nAdd dev_kfree_skb_any() before returning to properly free the skb.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31658"
},
{
"cve": "CVE-2026-31664",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: clear trailing padding in build_polexpire()\n\nbuild_expire() clears the trailing padding bytes of struct\nxfrm_user_expire after setting the hard field via memset_after(),\nbut the analogous function build_polexpire() does not do this for\nstruct xfrm_user_polexpire.\n\nThe padding bytes after the __u8 hard field are left\nuninitialized from the heap allocation, and are then sent to\nuserspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,\nleaking kernel heap memory contents.\n\nAdd the missing memset_after() call, matching build_expire().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31664"
},
{
"cve": "CVE-2026-31665",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: fix use-after-free in timeout object destroy\n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n nf_conntrack_tcp_packet+0x1381/0x29d0\n nf_conntrack_in+0x612/0x8b0\n nf_hook_slow+0x70/0x100\n __ip_local_out+0x1b2/0x210\n tcp_sendmsg_locked+0x722/0x1580\n __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n nft_ct_timeout_obj_init+0xf6/0x290\n nft_obj_init+0x107/0x1b0\n nf_tables_newobj+0x680/0x9c0\n nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n nft_obj_destroy+0x3f/0xa0\n nf_tables_trans_destroy_work+0x51c/0x5c0\n process_one_work+0x2c4/0x5a0",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31665"
},
{
"cve": "CVE-2026-31669",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix slab-use-after-free in __inet_lookup_established\n\nThe ehash table lookups are lockless and rely on\nSLAB_TYPESAFE_BY_RCU to guarantee socket memory stability\nduring RCU read-side critical sections. Both tcp_prot and\ntcpv6_prot have their slab caches created with this flag\nvia proto_register().\n\nHowever, MPTCP's mptcp_subflow_init() copies tcpv6_prot into\ntcpv6_prot_override during inet_init() (fs_initcall, level 5),\nbefore inet6_init() (module_init/device_initcall, level 6) has\ncalled proto_register(&tcpv6_prot). At that point,\ntcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab\nremains NULL permanently.\n\nThis causes MPTCP v6 subflow child sockets to be allocated via\nkmalloc (falling into kmalloc-4k) instead of the TCPv6 slab\ncache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so\nwhen these sockets are freed without SOCK_RCU_FREE (which is\ncleared for child sockets by design), the memory can be\nimmediately reused. Concurrent ehash lookups under\nrcu_read_lock can then access freed memory, triggering a\nslab-use-after-free in __inet_lookup_established.\n\nFix this by splitting the IPv6-specific initialization out of\nmptcp_subflow_init() into a new mptcp_subflow_v6_init(), called\nfrom mptcp_proto_v6_init() before protocol registration. This\nensures tcpv6_prot_override.slab correctly inherits the\nSLAB_TYPESAFE_BY_RCU slab cache.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31669"
},
{
"cve": "CVE-2026-31670",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: prevent unlimited numbers of rfkill events from being created\n\nUserspace can create an unlimited number of rfkill events if the system\nis so configured, while not consuming them from the rfkill file\ndescriptor, causing a potential out of memory situation. Prevent this\nfrom bounding the number of pending rfkill events at a \"large\" number\n(i.e. 1000) to prevent abuses like this.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31670"
},
{
"cve": "CVE-2026-31671",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_report()\n\nstruct xfrm_user_report is a __u8 proto field followed by a struct\nxfrm_selector which means there is three \"empty\" bytes of padding, but\nthe padding is never zeroed before copying to userspace. Fix that up by\nzeroing the structure before setting individual member variables.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31671"
},
{
"cve": "CVE-2026-31674",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()\n\nReject rt match rules whose addrnr exceeds IP6T_RT_HOPS.\n\nrt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].\nValidate addrnr during rule installation so malformed rules are rejected\nbefore the match logic can use an out-of-range value.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31674"
},
{
"cve": "CVE-2026-31680",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: flowlabel: defer exclusive option free until RCU teardown\n\n`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file\nRCU read-side lock and prints `fl->opt->opt_nflen` when an option block\nis present.\n\nExclusive flowlabels currently free `fl->opt` as soon as `fl->users`\ndrops to zero in `fl_release()`. However, the surrounding\n`struct ip6_flowlabel` remains visible in the global hash table until\nlater garbage collection removes it and `fl_free_rcu()` finally tears it\ndown.\n\nA concurrent `/proc/net/ip6_flowlabel` reader can therefore race that\nearly `kfree()` and dereference freed option state, triggering a crash\nin `ip6fl_seq_show()`.\n\nFix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches\nthe lifetime already required for the enclosing flowlabel while readers\ncan still reach it under RCU.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31680"
},
{
"cve": "CVE-2026-31682",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: linearize skb before parsing ND options\n\nbr_nd_send() parses neighbour discovery options from ns->opt[] and\nassumes that these options are in the linear part of request.\n\nIts callers only guarantee that the ICMPv6 header and target address\nare available, so the option area can still be non-linear. Parsing\nns->opt[] in that case can access data past the linear buffer.\n\nLinearize request before option parsing and derive ns from the linear\nnetwork header.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31682"
},
{
"cve": "CVE-2026-31737",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ftgmac100: fix ring allocation unwind on open failure\n\nftgmac100_alloc_rings() allocates rx_skbs, tx_skbs, rxdes, txdes, and\nrx_scratch in stages. On intermediate failures it returned -ENOMEM\ndirectly, leaking resources allocated earlier in the function.\n\nRework the failure path to use staged local unwind labels and free\nallocated resources in reverse order before returning -ENOMEM. This\nmatches common netdev allocation cleanup style.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31737"
},
{
"cve": "CVE-2026-31752",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyond the computed\noption span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31752"
},
{
"cve": "CVE-2026-31761",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Move iio_device_register() to correct location\n\niio_device_register() should be at the end of the probe function to\nprevent race conditions.\n\nPlace iio_device_register() at the end of the probe function and place\niio_device_unregister() accordingly.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31761"
},
{
"cve": "CVE-2026-31768",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ti-adc161s626: use DMA-safe memory for spi_read()\n\nAdd a DMA-safe buffer and use it for spi_read() instead of a stack\nmemory. All SPI buffers must be DMA-safe.\n\nSince we only need up to 3 bytes, we just use a u8[] instead of __be16\nand __be32 and change the conversion functions appropriately.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-31768"
},
{
"cve": "CVE-2026-32776",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-32776"
},
{
"cve": "CVE-2026-32777",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition ('Infinite Loop')"
},
"notes": [
{
"category": "description",
"text": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-32777"
},
{
"cve": "CVE-2026-32778",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-32778"
},
{
"cve": "CVE-2026-40355",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-40355"
},
{
"cve": "CVE-2026-41080",
"cwe": {
"id": "CWE-331",
"name": "Insufficient Entropy"
},
"notes": [
{
"category": "description",
"text": "libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-41080"
},
{
"cve": "CVE-2026-41989",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-41989"
},
{
"cve": "CVE-2026-43011",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: Fix potential double free of skb\n\nWhen alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at\nline 48 and returns 1 (error).\nThis error propagates back through the call chain:\n\nx25_queue_rx_frame returns 1\n |\n v\nx25_state3_machine receives the return value 1 and takes the else\nbranch at line 278, setting queued=0 and returning 0\n |\n v\nx25_process_rx_frame returns queued=0\n |\n v\nx25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)\nagain\n\nThis would free the same skb twice. Looking at x25_backlog_rcv:\n\nnet/x25/x25_in.c:x25_backlog_rcv() {\n ...\n queued = x25_process_rx_frame(sk, skb);\n ...\n if (!queued)\n kfree_skb(skb);\n}",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43011"
},
{
"cve": "CVE-2026-43024",
"cwe": {
"id": "CWE-115",
"name": "Misinterpretation of Input"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject immediate NF_QUEUE verdict\n\nnft_queue is always used from userspace nftables to deliver the NF_QUEUE\nverdict. Immediately emitting an NF_QUEUE verdict is never used by the\nuserspace nft tools, so reject immediate NF_QUEUE verdicts.\n\nThe arp family does not provide queue support, but such an immediate\nverdict is still reachable. Globally reject NF_QUEUE immediate verdicts\nto address this issue.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43024"
},
{
"cve": "CVE-2026-43025",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: ignore explicit helper on new expectations\n\nUse the existing master conntrack helper, anything else is not really\nsupported and it just makes validation more complicated, so just ignore\nwhat helper userspace suggests for this expectation.\n\nThis was uncovered when validating CTA_EXPECT_CLASS via different helper\nprovided by userspace than the existing master conntrack helper:\n\n BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0\n Read of size 4 at addr ffff8880043fe408 by task poc/102\n Call Trace:\n nf_ct_expect_related_report+0x2479/0x27c0\n ctnetlink_create_expect+0x22b/0x3b0\n ctnetlink_new_expect+0x4bd/0x5c0\n nfnetlink_rcv_msg+0x67a/0x950\n netlink_rcv_skb+0x120/0x350\n\nAllowing to read kernel memory bytes off the expectation boundary.\n\nCTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace\nvia netlink dump.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43025"
},
{
"cve": "CVE-2026-43026",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent\n\nctnetlink_alloc_expect() allocates expectations from a non-zeroing\nslab cache via nf_ct_expect_alloc(). When CTA_EXPECT_NAT is not\npresent in the netlink message, saved_addr and saved_proto are\nnever initialized. Stale data from a previous slab occupant can\nthen be dumped to userspace by ctnetlink_exp_dump_expect(), which\nchecks these fields to decide whether to emit CTA_EXPECT_NAT.\n\nThe safe sibling nf_ct_expect_init(), used by the packet path,\nexplicitly zeroes these fields.\n\nZero saved_addr, saved_proto and dir in the else branch, guarded\nby IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when\nNAT is enabled.\n\nConfirmed by priming the expect slab with NAT-bearing expectations,\nfreeing them, creating a new expectation without CTA_EXPECT_NAT,\nand observing that the ctnetlink dump emits a spurious\nCTA_EXPECT_NAT containing stale data from the prior allocation.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43026"
},
{
"cve": "CVE-2026-43027",
"cwe": {
"id": "CWE-459",
"name": "Incomplete Cleanup"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_helper: pass helper to expect cleanup\n\nnf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()\nto remove expectations belonging to the helper being unregistered.\nHowever, it passes NULL instead of the helper pointer as the data\nargument, so expect_iter_me() never matches any expectation and all\nof them survive the cleanup.\n\nAfter unregister returns, nfnl_cthelper_del() frees the helper\nobject immediately. Subsequent expectation dumps or packet-driven\ninit_conntrack() calls then dereference the freed exp->helper,\ncausing a use-after-free.\n\nPass the actual helper pointer so expectations referencing it are\nproperly destroyed before the helper object is freed.\n\n BUG: KASAN: slab-use-after-free in string+0x38f/0x430\n Read of size 1 at addr ffff888003b14d20 by task poc/103\n Call Trace:\n string+0x38f/0x430\n vsnprintf+0x3cc/0x1170\n seq_printf+0x17a/0x240\n exp_seq_show+0x2e5/0x560\n seq_read_iter+0x419/0x1280\n proc_reg_read+0x1ac/0x270\n vfs_read+0x179/0x930\n ksys_read+0xef/0x1c0\n Freed by task 103:\n The buggy address is located 32 bytes inside of\n freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43027"
},
{
"cve": "CVE-2026-43028",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: ensure names are nul-terminated\n\nReject names that lack a \\0 character before feeding them\nto functions that expect c-strings.\n\nFixes tag is the most recent commit that needs this change.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43028"
},
{
"cve": "CVE-2026-43030",
"cwe": {
"id": "CWE-372",
"name": "Incomplete Internal State Distinction"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix regsafe() for pointers to packet\n\nIn case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N\nregsafe() may return true which may lead to current state with\nvalid packet range not being explored. Fix the bug.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43030"
},
{
"cve": "CVE-2026-43033",
"cwe": {
"id": "CWE-237",
"name": "Improper Handling of Structural Elements"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption\n\nWhen decrypting data that is not in-place (src != dst), there is\nno need to save the high-order sequence bits in dst as it could\nsimply be re-copied from the source.\n\nHowever, the data to be hashed need to be rearranged accordingly.\n\n\nThanks,",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43033"
},
{
"cve": "CVE-2026-43035",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak\n\nWhen building netlink messages, tc_chain_fill_node() never initializes\nthe tcm_info field of struct tcmsg. Since the allocation is not zeroed,\nkernel heap memory is leaked to userspace through this 4-byte field.\n\nThe fix simply zeroes tcm_info alongside the other fields that are\nalready initialized.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43035"
},
{
"cve": "CVE-2026-43038",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type ('Type Confusion')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()\n\nSashiko AI-review observed:\n\n In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet\n where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2\n and passed to icmp6_send(), it uses IP6CB(skb2).\n\n IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso\n offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm\n at offset 18.\n\n If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao\n would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called\n and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO).\n\n This would scan the inner, attacker-controlled IPv6 packet starting at that\n offset, potentially returning a fake TLV without checking if the remaining\n packet length can hold the full 18-byte struct ipv6_destopt_hao.\n\n Could mip6_addr_swap() then perform a 16-byte swap that extends past the end\n of the packet data into skb_shared_info?\n\n Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and\n ip6ip6_err() to prevent this?\n\nThis patch implements the first suggestion.\n\nI am not sure if ip6ip6_err() needs to be changed.\nA separate patch would be better anyway.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43038"
},
{
"cve": "CVE-2026-43040",
"cwe": {
"id": "CWE-909",
"name": "Missing Initialization of Resource"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43040"
},
{
"cve": "CVE-2026-43057",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: correctly handle tunneled traffic on IPV6_CSUM GSO fallback\n\nNETIF_F_IPV6_CSUM only advertises support for checksum offload of\npackets without IPv6 extension headers. Packets with extension\nheaders must fall back onto software checksumming. Since TSO\ndepends on checksum offload, those must revert to GSO.\n\nThe below commit introduces that fallback. It always checks\nnetwork header length. For tunneled packets, the inner header length\nmust be checked instead. Extend the check accordingly.\n\nA special case is tunneled packets without inner IP protocol. Such as\nRFC 6951 SCTP in UDP. Those are not standard IPv6 followed by\ntransport header either, so also must revert to the software GSO path.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43057"
},
{
"cve": "CVE-2026-43284",
"cwe": {
"id": "CWE-123",
"name": "Write-what-where Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: esp: avoid in-place decrypt on shared skb frags\n\nMSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP\nmarks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),\nso later paths that may modify packet data can first make a private\ncopy. The IPv4/IPv6 datagram append paths did not set this flag when\nsplicing pages into UDP skbs.\n\nThat leaves an ESP-in-UDP packet made from shared pipe pages looking\nlike an ordinary uncloned nonlinear skb. ESP input then takes the no-COW\nfast path for uncloned skbs without a frag_list and decrypts in place\nover data that is not owned privately by the skb.\n\nMark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching\nTCP. Also make ESP input fall back to skb_cow_data() when the flag is\npresent, so ESP does not decrypt externally backed frags in place.\nPrivate nonlinear skb frags still use the existing fast path.\n\nThis intentionally does not change ESP output. In esp_output_head(),\nthe path that appends the ESP trailer to existing skb tailroom without\ncalling skb_cow_data() is not reachable for nonlinear skbs:\nskb_tailroom() returns zero when skb->data_len is nonzero, while ESP\ntailen is positive. Thus ESP output will either use the separate\ndestination-frag path or fall back to skb_cow_data().",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-43284"
},
{
"cve": "CVE-2026-45186",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "description",
"text": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"2",
"4",
"6",
"8",
"10"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.1.6 or later version",
"product_ids": [
"2",
"4",
"6",
"8",
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"2",
"4",
"6",
"8",
"10"
]
}
],
"title": "CVE-2026-45186"
},
{
"cve": "CVE-2026-46174",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache\n\nMake sure resources are not improperly shared in the op cache and\ncause instruction corruption this way.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-46174"
},
{
"cve": "CVE-2026-46300",
"cwe": {
"id": "CWE-123",
"name": "Write-what-where Condition"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: preserve shared-frag marker during coalescing\n\nskb_try_coalesce() can attach paged frags from @from to @to. If @from\nhas SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same\nexternally-owned or page-cache-backed frags, but the shared-frag marker\nis currently lost.\n\nThat breaks the invariant relied on by later in-place writers. In\nparticular, ESP input checks skb_has_shared_frag() before deciding\nwhether an uncloned nonlinear skb can skip skb_cow_data(). If TCP\nreceive coalescing has moved shared frags into an unmarked skb, ESP can\nsee skb_has_shared_frag() as false and decrypt in place over page-cache\nbacked frags.\n\nPropagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged\nfrags. The tailroom copy path does not need the marker because it copies\nbytes into @to's linear data rather than transferring frag descriptors.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"3",
"5",
"7",
"9"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "mitigation",
"details": "Only build and run applications from trusted sources.",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"3",
"5",
"7",
"9"
]
}
],
"title": "CVE-2026-46300"
}
]
}
```
## [ssa-779310](https://vulnerability.circl.lu/vuln/ssa-779310)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Mendix Studio Pro versions before V11.12 are affected by a file parsing vulnerability that could be triggered when the application reads specially crafted malicious project during the build pipeline. This could allow an attacker to execute arbitrary code in the context of that user.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-779310: Arbitrary Code Execution Vulnerability in Mendix Studio Pro Before V11.12 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-779310.html"
},
{
"category": "self",
"summary": "SSA-779310: Arbitrary Code Execution Vulnerability in Mendix Studio Pro Before V11.12 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-779310.json"
}
],
"title": "SSA-779310: Arbitrary Code Execution Vulnerability in Mendix Studio Pro Before V11.12",
"tracking": {
"current_release_date": "2026-06-30T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-779310",
"initial_release_date": "2026-06-30T00:00:00.000Z",
"revision_history": [
{
"date": "2026-06-30T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.11",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.11"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.12",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.12"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.13",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.13"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.14",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.14"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.15",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.15"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.16",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.16"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.17",
"product_id": "7"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.18",
"product_id": "8"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.19",
"product_id": "9"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.20",
"product_id": "10"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.20"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.21",
"product_id": "11"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.21"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.22",
"product_id": "12"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.22"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 10.23",
"product_id": "13"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.23"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.24.21",
"product": {
"name": "Mendix Studio Pro 10.24 < V10.24.21",
"product_id": "14"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 10.24"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.0",
"product_id": "15"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.1",
"product_id": "16"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.10",
"product_id": "17"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.10"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.11",
"product_id": "18"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.11"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.2",
"product_id": "19"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.3",
"product_id": "20"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.4",
"product_id": "21"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.5",
"product_id": "22"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<11.6.7",
"product": {
"name": "Mendix Studio Pro 11.6 < V11.6.7",
"product_id": "23"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.7",
"product_id": "24"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.8",
"product_id": "25"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.8"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mendix Studio Pro 11.9",
"product_id": "26"
}
}
],
"category": "product_name",
"name": "Mendix Studio Pro 11.9"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-48192",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code ('Code Injection')"
},
"notes": [
{
"category": "description",
"text": "Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline.\r\nThis could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26"
]
},
"remediations": [
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"24",
"25",
"26"
]
},
{
"category": "vendor_fix",
"details": "Update to V10.24.21 or later version",
"product_ids": [
"14"
],
"url": "https://docs.mendix.com/releasenotes/studio-pro/10.24/"
},
{
"category": "vendor_fix",
"details": "Update to V11.6.7 or later version",
"product_ids": [
"23"
],
"url": "https://docs.mendix.com/releasenotes/studio-pro/11.6/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26"
]
}
],
"title": "CVE-2026-48192"
}
]
}
```
## [ssa-962515](https://vulnerability.circl.lu/vuln/ssa-962515)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Several industrial products contain an out of bounds read vulnerability that could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel, leading to denial of service condition. \n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-962515: Out of Bounds Read Vulnerability in Industrial Products - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-962515.html"
},
{
"category": "self",
"summary": "SSA-962515: Out of Bounds Read Vulnerability in Industrial Products - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-962515.json"
}
],
"title": "SSA-962515: Out of Bounds Read Vulnerability in Industrial Products",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-962515",
"initial_release_date": "2024-05-14T00:00:00.000Z",
"revision_history": [
{
"date": "2024-05-14T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2024-07-09T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added fix for SIMATIC NET PC Software V18, SIMATIC WinCC Runtime Professional V16, V18, and V19 and SIMATIC WinCC V7.5, and V8.0, and TIA Portal V18"
},
{
"date": "2024-09-10T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added fix for SIMATIC PCS 7 V9.1, SIMATIC BATCH V9.1, SIMATIC WinCC Runtime Professional V17, SIMATIC Automation Tool, Simatic NET PC Software V16, SIMATIC Route Control V9.1 and SIMATIC PDM V9.2"
},
{
"date": "2024-10-08T00:00:00.000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added fix for SIMATIC NET PC Software V19"
},
{
"date": "2024-11-12T00:00:00.000Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Added fix for SINUMERIK PLC Programming Tool"
},
{
"date": "2024-12-10T00:00:00.000Z",
"legacy_version": "1.5",
"number": "6",
"summary": "Added fix for SIMATIC S7-PCT, SIMATIC STEP 7 V5, SIMATIC WinCC Runtime Advanced and Totally Integrated Automation Portal (TIA Portal) V17"
},
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.6",
"number": "7",
"summary": "Updated remediation of SIMATIC NET PC Software V17 to no fix planned"
}
],
"status": "interim",
"version": "7"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Security Configuration Tool (SCT)",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "Security Configuration Tool (SCT)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.0.2",
"product": {
"name": "SIMATIC Automation Tool",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "SIMATIC Automation Tool"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<9.1.2.5",
"product": {
"name": "SIMATIC BATCH V9.1",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "SIMATIC BATCH V9.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<16.0.0.8",
"product": {
"name": "SIMATIC NET PC Software V16",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "SIMATIC NET PC Software V16"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC NET PC Software V17",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "SIMATIC NET PC Software V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<18.0.1",
"product": {
"name": "SIMATIC NET PC Software V18",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "SIMATIC NET PC Software V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<19.0.0.2",
"product": {
"name": "SIMATIC NET PC Software V19",
"product_id": "7"
}
}
],
"category": "product_name",
"name": "SIMATIC NET PC Software V19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<9.1.2.05",
"product": {
"name": "SIMATIC PCS 7 V9.1",
"product_id": "8"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS 7 V9.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<9.2.2.3",
"product": {
"name": "SIMATIC PDM V9.2",
"product_id": "9"
}
}
],
"category": "product_name",
"name": "SIMATIC PDM V9.2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<9.1.2.3",
"product": {
"name": "SIMATIC Route Control V9.1",
"product_id": "10"
}
}
],
"category": "product_name",
"name": "SIMATIC Route Control V9.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.5.3.6",
"product": {
"name": "SIMATIC S7-PCT",
"product_id": "11"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-PCT"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.7.3",
"product": {
"name": "SIMATIC STEP 7 V5",
"product_id": "12"
}
}
],
"category": "product_name",
"name": "SIMATIC STEP 7 V5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC OA V3.17",
"product_id": "13"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC OA V3.17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.18.025",
"product": {
"name": "SIMATIC WinCC OA V3.18",
"product_id": "14"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC OA V3.18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.19.010",
"product": {
"name": "SIMATIC WinCC OA V3.19",
"product_id": "15"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC OA V3.19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<17.0.8",
"product": {
"name": "SIMATIC WinCC Runtime Advanced",
"product_id": "16"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Runtime Advanced"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<16.0.0.6",
"product": {
"name": "SIMATIC WinCC Runtime Professional V16",
"product_id": "17"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Runtime Professional V16"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<17.0.0.8",
"product": {
"name": "SIMATIC WinCC Runtime Professional V17",
"product_id": "18"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Runtime Professional V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<18.0.0.4",
"product": {
"name": "SIMATIC WinCC Runtime Professional V18",
"product_id": "19"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Runtime Professional V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<19.0.0.2",
"product": {
"name": "SIMATIC WinCC Runtime Professional V19",
"product_id": "20"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Runtime Professional V19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC V7.4",
"product_id": "21"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V7.4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<7.5.2.17",
"product": {
"name": "SIMATIC WinCC V7.5",
"product_id": "22"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V7.5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.0.0.5",
"product": {
"name": "SIMATIC WinCC V8.0",
"product_id": "23"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V8.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<19.1",
"product": {
"name": "SINAMICS Startdrive",
"product_id": "24"
}
}
],
"category": "product_name",
"name": "SINAMICS Startdrive"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.23",
"product": {
"name": "SINUMERIK ONE virtual",
"product_id": "25"
}
}
],
"category": "product_name",
"name": "SINUMERIK ONE virtual"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.3.12",
"product": {
"name": "SINUMERIK PLC Programming Tool",
"product_id": "26"
}
}
],
"category": "product_name",
"name": "SINUMERIK PLC Programming Tool"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.0",
"product": {
"name": "TIA Portal Cloud Connector",
"product_id": "27"
}
}
],
"category": "product_name",
"name": "TIA Portal Cloud Connector"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Totally Integrated Automation Portal (TIA Portal) V15.1",
"product_id": "28"
}
}
],
"category": "product_name",
"name": "Totally Integrated Automation Portal (TIA Portal) V15.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Totally Integrated Automation Portal (TIA Portal) V16",
"product_id": "29"
}
}
],
"category": "product_name",
"name": "Totally Integrated Automation Portal (TIA Portal) V16"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<17.0.8",
"product": {
"name": "Totally Integrated Automation Portal (TIA Portal) V17",
"product_id": "30"
}
}
],
"category": "product_name",
"name": "Totally Integrated Automation Portal (TIA Portal) V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<18.0.4",
"product": {
"name": "Totally Integrated Automation Portal (TIA Portal) V18",
"product_id": "31"
}
}
],
"category": "product_name",
"name": "Totally Integrated Automation Portal (TIA Portal) V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<19.0.2",
"product": {
"name": "Totally Integrated Automation Portal (TIA Portal) V19",
"product_id": "32"
}
}
],
"category": "product_name",
"name": "Totally Integrated Automation Portal (TIA Portal) V19"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-46280",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32"
]
},
"remediations": [
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"5",
"13",
"21",
"28",
"29"
]
},
{
"category": "vendor_fix",
"details": "Update to V16 Update 6 or later version",
"product_ids": [
"17"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109776017/"
},
{
"category": "vendor_fix",
"details": "Update to V16 Update 8 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109974091/"
},
{
"category": "vendor_fix",
"details": "Update to V17 Update 8 or later version",
"product_ids": [
"18"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109800913/"
},
{
"category": "vendor_fix",
"details": "Update to V17 Update 8 or later version",
"product_ids": [
"16",
"30"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109800912/"
},
{
"category": "vendor_fix",
"details": "Update to V18 Update 4 or later version",
"product_ids": [
"19"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109807225/"
},
{
"category": "vendor_fix",
"details": "Update to V18 SP1 or later version",
"product_ids": [
"6"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109972655/"
},
{
"category": "vendor_fix",
"details": "Update to V18 Update 4 or later version",
"product_ids": [
"31"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109817218/"
},
{
"category": "vendor_fix",
"details": "Update to V19 Update 2 or later version",
"product_ids": [
"20"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109820999/"
},
{
"category": "vendor_fix",
"details": "Update to V19 Update 2 or later version",
"product_ids": [
"7"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109975600/"
},
{
"category": "vendor_fix",
"details": "Update to V19 Update 2 or later version",
"product_ids": [
"32"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109925643/"
},
{
"category": "vendor_fix",
"details": "Update to V19 SP1 or later version",
"product_ids": [
"24"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109963196/"
},
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"27"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109780755/"
},
{
"category": "vendor_fix",
"details": "Update to V3.18 P025 or later version",
"product_ids": [
"14"
],
"url": "https://www.winccoa.com/downloads/category/versions-patches.html"
},
{
"category": "vendor_fix",
"details": "Update to V3.19 P010 or later version",
"product_ids": [
"15"
],
"url": "https://www.winccoa.com/downloads/category/versions-patches.html"
},
{
"category": "vendor_fix",
"details": "Update to V3.3.12 or later version\nPLC Programming Tool V3.3.12 or later versions are integrated in SINUMERIK 828D Toolbox version V5.24 or later; Updated software version can be obtained from Siemens customer support or a local partner.",
"product_ids": [
"26"
]
},
{
"category": "vendor_fix",
"details": "Update to V3.5 SP3 Update 6 or later version",
"product_ids": [
"11"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/32469496/"
},
{
"category": "vendor_fix",
"details": "Update to V5.0 SP2 or later version",
"product_ids": [
"2"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/98161300/"
},
{
"category": "vendor_fix",
"details": "Update to V5.7 SP3 or later version",
"product_ids": [
"12"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109973519/"
},
{
"category": "vendor_fix",
"details": "Update to V6.23 or later version",
"product_ids": [
"25"
]
},
{
"category": "vendor_fix",
"details": "Update to V7.5 SP2 Update 17 or later version",
"product_ids": [
"22"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109793460/"
},
{
"category": "vendor_fix",
"details": "Update to V8.0 Update 5 or later version",
"product_ids": [
"23"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109818723/"
},
{
"category": "vendor_fix",
"details": "Update to V9.1 SP2 UC05 or later version",
"product_ids": [
"8"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109812242/"
},
{
"category": "vendor_fix",
"details": "Update to V9.1 SP2 Upd3 or later version",
"product_ids": [
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109812242/"
},
{
"category": "vendor_fix",
"details": "Update to V9.1 SP2 Upd5 or later version",
"product_ids": [
"3"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109812242/"
},
{
"category": "vendor_fix",
"details": "Update to V9.2 SP2 Upd3 or later version",
"product_ids": [
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109812242/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32"
]
}
],
"title": "CVE-2023-46280"
}
]
}
```
## [ssa-870926](https://vulnerability.circl.lu/vuln/ssa-870926)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Simcenter Femap is affected by file parsing vulnerabilities in Datakit library and Parasolid Translator Component that could be triggered when the application reads files in IPT or IGS format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process.\n\nSiemens has released a new version for Simcenter Femap and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-870926: Datakit and Parasolid Vulnerabilities in Simcenter Femap - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-870926.html"
},
{
"category": "self",
"summary": "SSA-870926: Datakit and Parasolid Vulnerabilities in Simcenter Femap - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-870926.json"
}
],
"title": "SSA-870926: Datakit and Parasolid Vulnerabilities in Simcenter Femap",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-870926",
"initial_release_date": "2026-05-12T00:00:00.000Z",
"revision_history": [
{
"date": "2026-05-12T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added CVE-2025-40936"
}
],
"status": "interim",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2512.0003",
"product": {
"name": "Simcenter Femap",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "Simcenter Femap"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-12659",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The affected applications contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27349, ZDI-CAN-27389)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2512.0003 or later version",
"product_ids": [
"1"
],
"url": "https://support.sw.siemens.com/product/275652363/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-12659"
},
{
"cve": "CVE-2025-40936",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS files. This could allow an attacker to crash the application or execute code in the context of the current process. (ZDI-CAN-26755)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2512.0003 or later version",
"product_ids": [
"1"
],
"url": "https://support.sw.siemens.com/product/275652363/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40936"
}
]
}
```
## [ssa-860189](https://vulnerability.circl.lu/vuln/ssa-860189)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SINEC INS before V1.0 SP2 Update 6 is affected by multiple vulnerabilities.\n\nSiemens has released a new version for SINEC INS and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-860189: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 6 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-860189.html"
},
{
"category": "self",
"summary": "SSA-860189: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 6 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-860189.json"
}
],
"title": "SSA-860189: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 6",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-860189",
"initial_release_date": "2026-06-09T00:00:00.000Z",
"revision_history": [
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.0.2.6",
"product": {
"name": "SINEC INS",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SINEC INS"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-46746",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
},
"notes": [
{
"category": "summary",
"text": "The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.0 SP2 Update 6 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002283/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-46746"
},
{
"cve": "CVE-2026-46747",
"cwe": {
"id": "CWE-26",
"name": "Path Traversal: '/dir/../filename'"
},
"notes": [
{
"category": "summary",
"text": "The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFiles` endpoint used for directory listing. This allows path traversal through crafted input, enabling access to unintended file system locations.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.0 SP2 Update 6 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002283/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-46747"
},
{
"cve": "CVE-2026-46748",
"cwe": {
"id": "CWE-250",
"name": "Execution with Unnecessary Privileges"
},
"notes": [
{
"category": "summary",
"text": "The affected system includes a binary that is configured with the cap_dac_override capability. This capability allows the process to bypass file system permission checks, resulting in unrestricted file system access. This could allow a local attacker to escalate privileges leading to arbitrary file modification and gaining root privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.0 SP2 Update 6 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002283/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-46748"
},
{
"cve": "CVE-2026-46749",
"cwe": {
"id": "CWE-760",
"name": "Use of a One-Way Hash with a Predictable Salt"
},
"notes": [
{
"category": "summary",
"text": "The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentially resulting in unauthorized access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.0 SP2 Update 6 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002283/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-46749"
}
]
}
```
## [ssa-794185](https://vulnerability.circl.lu/vuln/ssa-794185)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "This advisory documents the impact of CVE-2024-3596 (also dubbed \"Blastradius\"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products.\n\nThe vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an \"Access-Reject\" message into an \"Access-Accept\". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials).\n\nFurther details incl. external references can be found in the chapter \"Additional Information\".\nSiemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter \"Additional Information\".\nSiemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. See chapter \"Additional Information\" for details.",
"title": "Summary"
},
{
"category": "general",
"text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\nhttps://www.siemens.com/gridsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html"
},
{
"category": "self",
"summary": "SSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-794185.json"
}
],
"title": "SSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-794185",
"initial_release_date": "2025-05-13T00:00:00.000Z",
"revision_history": [
{
"date": "2025-05-13T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2025-08-12T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added fix for affected firmware modules in SICAM A8000 (CPCI85 for CP-8031/CP-8050, CPC80 for CP-8000/CP-8021/CP-8022, SICORE for CP-8010/CP-8012), SICAM EGS (CPCI85) and SICAM S8000 (SICORE). Added fix for SICAM Q200, for SIPROTEC 5 - CP300 and CP150 Devices, and for SIPROTEC 5 Compact 7SX800 (CP050). Added SICAM AK 3, SICAM BC, SICAM TM, SICAM GridEdge and SIPROTEC 5 - CP200 Devices to the list of known not affected products"
},
{
"date": "2025-11-11T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added fix for SIPROTEC 5 - CP100 Devices"
},
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added fix for PowerLink IP"
}
],
"status": "interim",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<16.51",
"product": {
"name": "CPC80 Central Processing/Communication",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "CPC80 Central Processing/Communication"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.20",
"product": {
"name": "CPCI85 Central Processing/Communication",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "CPCI85 Central Processing/Communication"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.70",
"product": {
"name": "POWER METER SICAM Q100 family",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "POWER METER SICAM Q100 family"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.83",
"product": {
"name": "POWER METER SICAM Q200 family",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "POWER METER SICAM Q200 family"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.22",
"product": {
"name": "Powerlink IP",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "Powerlink IP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICAM AK 3",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "SICAM AK 3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICAM BC",
"product_id": "7"
}
}
],
"category": "product_name",
"name": "SICAM BC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICAM GridEdge (Classic)",
"product_id": "8"
}
}
],
"category": "product_name",
"name": "SICAM GridEdge (Classic)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICAM GridEdge Applications for SICAM 8 Platform",
"product_id": "9"
}
}
],
"category": "product_name",
"name": "SICAM GridEdge Applications for SICAM 8 Platform"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.50",
"product": {
"name": "SICAM GridPass",
"product_id": "10"
}
}
],
"category": "product_name",
"name": "SICAM GridPass"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SICAM TM",
"product_id": "11"
}
}
],
"category": "product_name",
"name": "SICAM TM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.20.0",
"product": {
"name": "SICORE Base system",
"product_id": "12"
}
}
],
"category": "product_name",
"name": "SICORE Base system"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 - CP200 Devices",
"product_id": "13"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 - CP200 Devices"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 6MD84 (CP300)",
"product_id": "14"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD84 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 6MD85 (CP300)",
"product_id": "15"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 6MD86 (CP300)",
"product_id": "16"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 6MD89 (CP300)",
"product_id": "17"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD89 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<9.68",
"product": {
"name": "SIPROTEC 5 6MD89 (CP300) V9.6x",
"product_id": "18"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD89 (CP300) V9.6x"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 6MU85 (CP300)",
"product_id": "19"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MU85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7KE85 (CP300)",
"product_id": "20"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7KE85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<8.90",
"product": {
"name": "SIPROTEC 5 7SA82 (CP100)",
"product_id": "21"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SA82 (CP150)",
"product_id": "22"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SA86 (CP300)",
"product_id": "23"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SA87 (CP300)",
"product_id": "24"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<8.90",
"product": {
"name": "SIPROTEC 5 7SD82 (CP100)",
"product_id": "25"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SD82 (CP150)",
"product_id": "26"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SD86 (CP300)",
"product_id": "27"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SD87 (CP300)",
"product_id": "28"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<8.90",
"product": {
"name": "SIPROTEC 5 7SJ81 (CP100)",
"product_id": "29"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ81 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SJ81 (CP150)",
"product_id": "30"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ81 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<8.90",
"product": {
"name": "SIPROTEC 5 7SJ82 (CP100)",
"product_id": "31"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SJ82 (CP150)",
"product_id": "32"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SJ85 (CP300)",
"product_id": "33"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SJ86 (CP300)",
"product_id": "34"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<8.90",
"product": {
"name": "SIPROTEC 5 7SK82 (CP100)",
"product_id": "35"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SK82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SK82 (CP150)",
"product_id": "36"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SK82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SK85 (CP300)",
"product_id": "37"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SK85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<8.90",
"product": {
"name": "SIPROTEC 5 7SL82 (CP100)",
"product_id": "38"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SL82 (CP150)",
"product_id": "39"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SL86 (CP300)",
"product_id": "40"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SL87 (CP300)",
"product_id": "41"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7SS85 (CP300)",
"product_id": "42"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SS85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7ST85 (CP300)",
"product_id": "43"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7ST85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<9.68",
"product": {
"name": "SIPROTEC 5 7ST85 (CP300) V9.6x",
"product_id": "44"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7ST85 (CP300) V9.6x"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7ST86 (CP300)",
"product_id": "45"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7ST86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<9.83",
"product": {
"name": "SIPROTEC 5 7ST86 (CP300) V9.8x",
"product_id": "46"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7ST86 (CP300) V9.8x"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SX82 (CP150)",
"product_id": "47"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SX82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SX85 (CP300)",
"product_id": "48"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SX85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7SY82 (CP150)",
"product_id": "49"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SY82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7UM85 (CP300)",
"product_id": "50"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UM85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<8.90",
"product": {
"name": "SIPROTEC 5 7UT82 (CP100)",
"product_id": "51"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7UT82 (CP150)",
"product_id": "52"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7UT85 (CP300)",
"product_id": "53"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7UT86 (CP300)",
"product_id": "54"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7UT87 (CP300)",
"product_id": "55"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7VE85 (CP300)",
"product_id": "56"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7VE85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=7.80|<10.0",
"product": {
"name": "SIPROTEC 5 7VK87 (CP300)",
"product_id": "57"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7VK87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 7VU85 (CP300)",
"product_id": "58"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7VU85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<10.0",
"product": {
"name": "SIPROTEC 5 Compact 7SX800 (CP050)",
"product_id": "59"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 Compact 7SX800 (CP050)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-3596",
"cwe": {
"id": "CWE-924",
"name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel"
},
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"6",
"11",
"13",
"7",
"9"
]
},
{
"label": "vulnerable_code_not_in_execute_path",
"product_ids": [
"8"
]
}
],
"notes": [
{
"category": "summary",
"text": "RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify responses Access-Reject or Access-Accept using a chosen-prefix collision attack against MD5 Response Authenticator signature.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"10",
"12",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59"
],
"known_not_affected": [
"6",
"7",
"8",
"9",
"11",
"13"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"10",
"12",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59"
]
},
{
"category": "mitigation",
"details": "Restrict access to the networks where RADIUS messages are exchanged (e.g., send RADIUS traffic via management network or a dedicated VLAN)",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"10",
"12",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59"
]
},
{
"category": "vendor_fix",
"details": "Update to V10.0 or later version",
"product_ids": [
"14",
"15",
"16",
"17",
"19",
"20",
"22",
"23",
"24",
"26",
"27",
"28",
"30",
"32",
"33",
"34",
"36",
"37",
"39",
"40",
"41",
"42",
"43",
"45",
"47",
"48",
"49",
"50",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109814150/"
},
{
"category": "vendor_fix",
"details": "Update to V16.51 or later version",
"product_ids": [
"1"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.20.0 or later version",
"product_ids": [
"12"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.50 or later version",
"product_ids": [
"10"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109763384/"
},
{
"category": "vendor_fix",
"details": "Update to V2.70 or later version",
"product_ids": [
"3"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109743524/"
},
{
"category": "vendor_fix",
"details": "Update to V2.83 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109743592/"
},
{
"category": "vendor_fix",
"details": "Update to V4.22 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109986527/"
},
{
"category": "vendor_fix",
"details": "Update to V6.20 or later version",
"product_ids": [
"2"
]
},
{
"category": "vendor_fix",
"details": "Update to V9.68 or later version",
"product_ids": [
"18",
"44"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109742950/"
},
{
"category": "vendor_fix",
"details": "Update to V9.83 or later version",
"product_ids": [
"46"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109768428/"
},
{
"category": "vendor_fix",
"details": "Update to V8.90 or later V8.xx version",
"product_ids": [
"21",
"25",
"29",
"31",
"35",
"38",
"51"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"10",
"12",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59"
]
}
],
"threats": [
{
"category": "impact",
"details": "The product does not support the RADIUS protocol.",
"product_ids": [
"6",
"11",
"13",
"7",
"9"
]
},
{
"category": "impact",
"details": "The product includes a component which also supports the RADIUS protocol, but the product doesn't enable or support RADIUS.",
"product_ids": [
"8"
]
}
],
"title": "CVE-2024-3596"
}
]
}
```
## [ssa-723487](https://vulnerability.circl.lu/vuln/ssa-723487)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "This advisory documents the impact of CVE-2024-3596 (also dubbed \"Blastradius\"), a vulnerability in the RADIUS protocol, to SCALANCE, RUGGEDCOM and related products.\n\nThe vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., SCALANCE or RUGGEDCOM devices) and a RADIUS server (e.g., SINEC INS), to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an \"Access-Reject\" message into an \"Access-Accept\". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials).\n\nFurther details incl. external references can be found in the chapter \"Additional Information\".\nSiemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter \"Additional Information\".\nSiemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. See chapter \"Additional Information\" for details.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-723487: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-723487.html"
},
{
"category": "self",
"summary": "SSA-723487: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-723487.json"
}
],
"title": "SSA-723487: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-723487",
"initial_release_date": "2024-07-09T00:00:00.000Z",
"revision_history": [
{
"date": "2024-07-09T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2024-07-22T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Clarified that the fix for SCALANCE X-300 family (incl. X408 and SIPLUS NET variants) in V4.1.8 only covers RADIUS client mitigation C1, but not C2"
},
{
"date": "2024-11-12T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added fix for RUGGEDCOM CROSSBOW"
},
{
"date": "2024-12-10T00:00:00.000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added fix (and related important recommendations in chapter Additional Information) for RUGGEDCOM ROS V4.x devices; Added additional SINEC OS-based devices as affected products: RUGGEDCOM RST2428P and SCALANCE XC-300, XR-300, XC-400 families, and additional devices in the SCALANCE XR-500 family"
},
{
"date": "2025-01-14T00:00:00.000Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Added fix for SCALANCE W-700 IEEE 802.11ax family and for SCALANCE M-800 family (incl. S615, MUM-800 and RM1224)"
},
{
"date": "2025-03-11T00:00:00.000Z",
"legacy_version": "1.5",
"number": "6",
"summary": "Added fix for SCALANCE X-300 family (incl. X408 and SIPLUS NET variants)"
},
{
"date": "2025-06-10T00:00:00.000Z",
"legacy_version": "1.6",
"number": "7",
"summary": "Clarified that SINEC INS is only affected when the Relay feature is used; added fix for the RUGGEDCOM RST2428P, SCALANCE XC-300, SCALANCE XC-400 and SCALANCE XR-300 (6GK5334-xTSxx) families and for some of the devices in the SCALANCE XM-400/XR-500 and SCALANCE XCM-/XRM-/XCH-/XRH-300 families"
},
{
"date": "2025-07-08T00:00:00.000Z",
"legacy_version": "1.7",
"number": "8",
"summary": "Added fix for SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG family, for SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (MSPS V1.3), for RUGGEDCOM ROS V5.X family and for SINEC INS (relay feature); Clarified the applicability of the MSPS V1.3 and the SINEC OS V3.2 fix releases for product families that support both"
},
{
"date": "2025-12-09T00:00:00.000Z",
"legacy_version": "1.8",
"number": "9",
"summary": "Added fix for RUGGEDCOM ROX II family"
},
{
"date": "2026-05-12T00:00:00.000Z",
"legacy_version": "1.9",
"number": "10",
"summary": "Added fix for SCALANCE W-700 IEEE 802.11n family."
},
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "2.0",
"number": "11",
"summary": "Added fix for SCALANCE SC-600 Family"
}
],
"status": "interim",
"version": "11"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.6",
"product": {
"name": "RUGGEDCOM CROSSBOW",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM CROSSBOW"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM i800",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM i800"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM i800NC",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM i800NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM i801",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM i801"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM i801NC",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM i801NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM i802",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM i802"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM i802NC",
"product_id": "7"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM i802NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM i803",
"product_id": "8"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM i803"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM i803NC",
"product_id": "9"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM i803NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM M2100",
"product_id": "10"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM M2100"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM M2100NC",
"product_id": "11"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM M2100NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM M2200",
"product_id": "12"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM M2200"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM M2200NC",
"product_id": "13"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM M2200NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM M969",
"product_id": "14"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM M969"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM M969NC",
"product_id": "15"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM M969NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)",
"product_id": "16",
"product_identification_helper": {
"model_numbers": [
"6GK6108-4AM00-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)",
"product_id": "17",
"product_identification_helper": {
"model_numbers": [
"6GK6108-4AM00-2DA2"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RMC30",
"product_id": "18"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RMC30"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RMC30NC",
"product_id": "19"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RMC30NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RMC8388 V4.X",
"product_id": "20"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RMC8388 V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RMC8388 V5.X",
"product_id": "21"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RMC8388 V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RMC8388NC V4.X",
"product_id": "22"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RMC8388NC V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RMC8388NC V5.X",
"product_id": "23"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RMC8388NC V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX MX5000",
"product_id": "24"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX MX5000"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX MX5000RE",
"product_id": "25"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX MX5000RE"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX1400",
"product_id": "26"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX1400"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX1500",
"product_id": "27"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX1500"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX1501",
"product_id": "28"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX1501"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX1510",
"product_id": "29"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX1510"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX1511",
"product_id": "30"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX1511"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX1512",
"product_id": "31"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX1512"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX1524",
"product_id": "32"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX1524"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX1536",
"product_id": "33"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX1536"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.17.0",
"product": {
"name": "RUGGEDCOM ROX RX5000",
"product_id": "34"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM ROX RX5000"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RP110",
"product_id": "35"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RP110"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RP110NC",
"product_id": "36"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RP110NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS1600",
"product_id": "37"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS1600"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS1600F",
"product_id": "38"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS1600F"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS1600FNC",
"product_id": "39"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS1600FNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS1600NC",
"product_id": "40"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS1600NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS1600T",
"product_id": "41"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS1600T"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS1600TNC",
"product_id": "42"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS1600TNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS400",
"product_id": "43"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS400"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS400NC",
"product_id": "44"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS400NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS401",
"product_id": "45"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS401"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS401NC",
"product_id": "46"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS401NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS416",
"product_id": "47"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS416NC",
"product_id": "48"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS416NCv2 V4.X",
"product_id": "49"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416NCv2 V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RS416NCv2 V5.X",
"product_id": "50"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416NCv2 V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS416P",
"product_id": "51"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416P"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS416PNC",
"product_id": "52"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416PNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS416PNCv2 V4.X",
"product_id": "53"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416PNCv2 V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RS416PNCv2 V5.X",
"product_id": "54"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416PNCv2 V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS416Pv2 V4.X",
"product_id": "55"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416Pv2 V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RS416Pv2 V5.X",
"product_id": "56"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416Pv2 V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS416v2 V4.X",
"product_id": "57"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416v2 V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RS416v2 V5.X",
"product_id": "58"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS416v2 V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS8000",
"product_id": "59"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS8000"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS8000A",
"product_id": "60"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS8000A"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS8000ANC",
"product_id": "61"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS8000ANC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS8000H",
"product_id": "62"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS8000H"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS8000HNC",
"product_id": "63"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS8000HNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS8000NC",
"product_id": "64"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS8000NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS8000T",
"product_id": "65"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS8000T"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS8000TNC",
"product_id": "66"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS8000TNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900",
"product_id": "67"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900 (32M) V4.X",
"product_id": "68"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900 (32M) V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RS900 (32M) V5.X",
"product_id": "69"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900 (32M) V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900G",
"product_id": "70"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900G"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900G (32M) V4.X",
"product_id": "71"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900G (32M) V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RS900G (32M) V5.X",
"product_id": "72"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900G (32M) V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900GNC",
"product_id": "73"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900GNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900GNC(32M) V4.X",
"product_id": "74"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900GNC(32M) V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RS900GNC(32M) V5.X",
"product_id": "75"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900GNC(32M) V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900GP",
"product_id": "76"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900GP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900GPNC",
"product_id": "77"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900GPNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900L",
"product_id": "78"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900L"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900LNC",
"product_id": "79"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900LNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900M-GETS-C01",
"product_id": "80"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900M-GETS-C01"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900M-GETS-XX",
"product_id": "81"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900M-GETS-XX"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900M-STND-C01",
"product_id": "82"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900M-STND-C01"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900M-STND-XX",
"product_id": "83"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900M-STND-XX"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900MNC-GETS-C01",
"product_id": "84"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900MNC-GETS-C01"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900MNC-GETS-XX",
"product_id": "85"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900MNC-GETS-XX"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900MNC-STND-XX",
"product_id": "86"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900MNC-STND-XX"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900MNC-STND-XX-C01",
"product_id": "87"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900MNC-STND-XX-C01"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900NC",
"product_id": "88"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900NC(32M) V4.X",
"product_id": "89"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900NC(32M) V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RS900NC(32M) V5.X",
"product_id": "90"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900NC(32M) V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS900W",
"product_id": "91"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS900W"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS910",
"product_id": "92"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS910"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS910L",
"product_id": "93"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS910L"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS910LNC",
"product_id": "94"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS910LNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS910NC",
"product_id": "95"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS910NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS910W",
"product_id": "96"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS910W"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS920L",
"product_id": "97"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS920L"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS920LNC",
"product_id": "98"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS920LNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS920W",
"product_id": "99"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS920W"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS930L",
"product_id": "100"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS930L"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS930LNC",
"product_id": "101"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS930LNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS930W",
"product_id": "102"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS930W"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS940G",
"product_id": "103"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS940G"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS940GNC",
"product_id": "104"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS940GNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS969",
"product_id": "105"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS969"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RS969NC",
"product_id": "106"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RS969NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2100",
"product_id": "107"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2100 (32M) V4.X",
"product_id": "108"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100 (32M) V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2100 (32M) V5.X",
"product_id": "109"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100 (32M) V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2100NC",
"product_id": "110"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2100NC(32M) V4.X",
"product_id": "111"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100NC(32M) V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2100NC(32M) V5.X",
"product_id": "112"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100NC(32M) V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2100P",
"product_id": "113"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100P"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2100P (32M) V4.X",
"product_id": "114"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100P (32M) V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2100P (32M) V5.X",
"product_id": "115"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100P (32M) V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2100PNC",
"product_id": "116"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100PNC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2100PNC (32M) V4.X",
"product_id": "117"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100PNC (32M) V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2100PNC (32M) V5.X",
"product_id": "118"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2100PNC (32M) V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2200",
"product_id": "119"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2200"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2200NC",
"product_id": "120"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2200NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2288 V4.X",
"product_id": "121"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2288 V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2288 V5.X",
"product_id": "122"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2288 V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2288NC V4.X",
"product_id": "123"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2288NC V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2288NC V5.X",
"product_id": "124"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2288NC V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2300 V4.X",
"product_id": "125"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2300 V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2300 V5.X",
"product_id": "126"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2300 V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2300NC V4.X",
"product_id": "127"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2300NC V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2300NC V5.X",
"product_id": "128"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2300NC V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2300P V4.X",
"product_id": "129"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2300P V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2300P V5.X",
"product_id": "130"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2300P V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2300PNC V4.X",
"product_id": "131"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2300PNC V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2300PNC V5.X",
"product_id": "132"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2300PNC V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2488 V4.X",
"product_id": "133"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2488 V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2488 V5.X",
"product_id": "134"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2488 V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG2488NC V4.X",
"product_id": "135"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2488NC V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG2488NC V5.X",
"product_id": "136"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG2488NC V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG907R",
"product_id": "137"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG907R"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG908C",
"product_id": "138"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG908C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG909R",
"product_id": "139"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG909R"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG910C",
"product_id": "140"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG910C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG920P V4.X",
"product_id": "141"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG920P V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG920P V5.X",
"product_id": "142"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG920P V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.3.11",
"product": {
"name": "RUGGEDCOM RSG920PNC V4.X",
"product_id": "143"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG920PNC V4.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSG920PNC V5.X",
"product_id": "144"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSG920PNC V5.X"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSL910",
"product_id": "145"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSL910"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RSL910NC",
"product_id": "146"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RSL910NC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RST2228",
"product_id": "147"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RST2228"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RST2228P",
"product_id": "148"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RST2228P"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "RUGGEDCOM RST2428P (6GK6242-6PA00)",
"product_id": "149",
"product_identification_helper": {
"model_numbers": [
"6GK6242-6PA00"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RST2428P (6GK6242-6PA00)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RST916C",
"product_id": "150"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RST916C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.10.0",
"product": {
"name": "RUGGEDCOM RST916P",
"product_id": "151"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RST916P"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M804PB (6GK5804-0AP00-2AA2)",
"product_id": "152",
"product_identification_helper": {
"model_numbers": [
"6GK5804-0AP00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M804PB (6GK5804-0AP00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2)",
"product_id": "153",
"product_identification_helper": {
"model_numbers": [
"6GK5812-1AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2)",
"product_id": "154",
"product_identification_helper": {
"model_numbers": [
"6GK5812-1BA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2)",
"product_id": "155",
"product_identification_helper": {
"model_numbers": [
"6GK5816-1AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2)",
"product_id": "156",
"product_identification_helper": {
"model_numbers": [
"6GK5816-1BA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)",
"product_id": "157",
"product_identification_helper": {
"model_numbers": [
"6GK5826-2AB00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M874-2 (6GK5874-2AA00-2AA2)",
"product_id": "158",
"product_identification_helper": {
"model_numbers": [
"6GK5874-2AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-2 (6GK5874-2AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M874-3 (6GK5874-3AA00-2AA2)",
"product_id": "159",
"product_identification_helper": {
"model_numbers": [
"6GK5874-3AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-3 (6GK5874-3AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2)",
"product_id": "160",
"product_identification_helper": {
"model_numbers": [
"6GK5874-3AA00-2FA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M876-3 (6GK5876-3AA02-2BA2)",
"product_id": "161",
"product_identification_helper": {
"model_numbers": [
"6GK5876-3AA02-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-3 (6GK5876-3AA02-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)",
"product_id": "162",
"product_identification_helper": {
"model_numbers": [
"6GK5876-3AA02-2EA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M876-4 (6GK5876-4AA10-2BA2)",
"product_id": "163",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA10-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (6GK5876-4AA10-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)",
"product_id": "164",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA00-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)",
"product_id": "165",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA00-2DA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1)",
"product_id": "166",
"product_identification_helper": {
"model_numbers": [
"6GK5853-2EA10-2AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1)",
"product_id": "167",
"product_identification_helper": {
"model_numbers": [
"6GK5853-2EA10-2BA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)",
"product_id": "168",
"product_identification_helper": {
"model_numbers": [
"6GK5853-2EA00-2DA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1)",
"product_id": "169",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA10-3AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1)",
"product_id": "170",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA10-3BA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1)",
"product_id": "171",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3FA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)",
"product_id": "172",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3DA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)",
"product_id": "173",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2)",
"product_id": "174",
"product_identification_helper": {
"model_numbers": [
"6GK5615-0AA01-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<8.2",
"product": {
"name": "SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)",
"product_id": "175",
"product_identification_helper": {
"model_numbers": [
"6GK5615-0AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC622-2C (6GK5622-2GS00-2AC2)",
"product_id": "176",
"product_identification_helper": {
"model_numbers": [
"6GK5622-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC622-2C (6GK5622-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC626-2C (6GK5626-2GS00-2AC2)",
"product_id": "177",
"product_identification_helper": {
"model_numbers": [
"6GK5626-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC626-2C (6GK5626-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC632-2C (6GK5632-2GS00-2AC2)",
"product_id": "178",
"product_identification_helper": {
"model_numbers": [
"6GK5632-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC632-2C (6GK5632-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC636-2C (6GK5636-2GS00-2AC2)",
"product_id": "179",
"product_identification_helper": {
"model_numbers": [
"6GK5636-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC636-2C (6GK5636-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC642-2C (6GK5642-2GS00-2AC2)",
"product_id": "180",
"product_identification_helper": {
"model_numbers": [
"6GK5642-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC642-2C (6GK5642-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE SC646-2C (6GK5646-2GS00-2AC2)",
"product_id": "181",
"product_identification_helper": {
"model_numbers": [
"6GK5646-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE SC646-2C (6GK5646-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0)",
"product_id": "182",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1GY01-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0)",
"product_id": "183",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1GY01-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0)",
"product_id": "184",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1GY01-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0)",
"product_id": "185",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GY01-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0)",
"product_id": "186",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GY01-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE W1788-2IA M12 (6GK5788-2HY01-0AA0)",
"product_id": "187",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2HY01-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W1788-2IA M12 (6GK5788-2HY01-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0)",
"product_id": "188",
"product_identification_helper": {
"model_numbers": [
"6GK5721-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0)",
"product_id": "189",
"product_identification_helper": {
"model_numbers": [
"6GK5721-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0)",
"product_id": "190",
"product_identification_helper": {
"model_numbers": [
"6GK5722-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0)",
"product_id": "191",
"product_identification_helper": {
"model_numbers": [
"6GK5722-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0)",
"product_id": "192",
"product_identification_helper": {
"model_numbers": [
"6GK5722-1FC00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0)",
"product_id": "193",
"product_identification_helper": {
"model_numbers": [
"6GK5734-1FX00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6)",
"product_id": "194",
"product_identification_helper": {
"model_numbers": [
"6GK5734-1FX00-0AA6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0)",
"product_id": "195",
"product_identification_helper": {
"model_numbers": [
"6GK5734-1FX00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6)",
"product_id": "196",
"product_identification_helper": {
"model_numbers": [
"6GK5734-1FX00-0AB6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0)",
"product_id": "197",
"product_identification_helper": {
"model_numbers": [
"6GK5738-1GY00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0)",
"product_id": "198",
"product_identification_helper": {
"model_numbers": [
"6GK5738-1GY00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0)",
"product_id": "199",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1GD00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0)",
"product_id": "200",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1GD00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0)",
"product_id": "201",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0)",
"product_id": "202",
"product_identification_helper": {
"model_numbers": [
"6GK5748-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0)",
"product_id": "203",
"product_identification_helper": {
"model_numbers": [
"6GK5761-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0)",
"product_id": "204",
"product_identification_helper": {
"model_numbers": [
"6GK5761-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0)",
"product_id": "205",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FY00-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0)",
"product_id": "206",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FY00-0TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0)",
"product_id": "207",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6)",
"product_id": "208",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AA6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0)",
"product_id": "209",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0)",
"product_id": "210",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6)",
"product_id": "211",
"product_identification_helper": {
"model_numbers": [
"6GK5774-1FX00-0AB6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0)",
"product_id": "212",
"product_identification_helper": {
"model_numbers": [
"6GK5778-1GY00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0)",
"product_id": "213",
"product_identification_helper": {
"model_numbers": [
"6GK5778-1GY00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0)",
"product_id": "214",
"product_identification_helper": {
"model_numbers": [
"6GK5778-1GY00-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0)",
"product_id": "215",
"product_identification_helper": {
"model_numbers": [
"6GK5778-1GY00-0TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0)",
"product_id": "216",
"product_identification_helper": {
"model_numbers": [
"6GK5786-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AB0)",
"product_id": "217",
"product_identification_helper": {
"model_numbers": [
"6GK5786-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AA0)",
"product_id": "218",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AB0)",
"product_id": "219",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AC0)",
"product_id": "220",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FC00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 SFP (6GK5786-2FE00-0AA0)",
"product_id": "221",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FE00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 SFP (6GK5786-2FE00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2 SFP (6GK5786-2FE00-0AB0)",
"product_id": "222",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2FE00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2 SFP (6GK5786-2FE00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AA0)",
"product_id": "223",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2HC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AB0)",
"product_id": "224",
"product_identification_helper": {
"model_numbers": [
"6GK5786-2HC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-1 M12 (6GK5788-1GD00-0AA0)",
"product_id": "225",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1GD00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-1 M12 (6GK5788-1GD00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-1 M12 (6GK5788-1GD00-0AB0)",
"product_id": "226",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1GD00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-1 M12 (6GK5788-1GD00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AA0)",
"product_id": "227",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AB0)",
"product_id": "228",
"product_identification_helper": {
"model_numbers": [
"6GK5788-1FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 (6GK5788-2GD00-0AA0)",
"product_id": "229",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 (6GK5788-2GD00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 (6GK5788-2GD00-0AB0)",
"product_id": "230",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 (6GK5788-2GD00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TA0)",
"product_id": "231",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TB0)",
"product_id": "232",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TC0)",
"product_id": "233",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2GD00-0TC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AA0)",
"product_id": "234",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2FC00-0AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AB0)",
"product_id": "235",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2FC00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.6.0",
"product": {
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AC0)",
"product_id": "236",
"product_identification_helper": {
"model_numbers": [
"6GK5788-2FC00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)",
"product_id": "237",
"product_identification_helper": {
"model_numbers": [
"6GK5762-1AJ00-6AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)",
"product_id": "238",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-7DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0)",
"product_id": "239",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-7DC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0)",
"product_id": "240",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-7DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM766-1 (6GK5766-1GE00-7DA0)",
"product_id": "241",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (6GK5766-1GE00-7DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0)",
"product_id": "242",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)",
"product_id": "243",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0)",
"product_id": "244",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0)",
"product_id": "245",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)",
"product_id": "246",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0)",
"product_id": "247",
"product_identification_helper": {
"model_numbers": [
"6GK5762-1AJ00-1AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0)",
"product_id": "248",
"product_identification_helper": {
"model_numbers": [
"6GK5762-1AJ00-2AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)",
"product_id": "249",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)",
"product_id": "250",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0)",
"product_id": "251",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3AB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0)",
"product_id": "252",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUM766-1 (6GK5766-1GE00-3DA0)",
"product_id": "253",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (6GK5766-1GE00-3DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0)",
"product_id": "254",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DC0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.0.0",
"product": {
"name": "SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)",
"product_id": "255",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X302-7 EEC (230V, coated) (6GK5302-7GD00-3GA3)",
"product_id": "256",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-3GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (230V, coated) (6GK5302-7GD00-3GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X302-7 EEC (230V) (6GK5302-7GD00-3EA3)",
"product_id": "257",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-3EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (230V) (6GK5302-7GD00-3EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X302-7 EEC (24V, coated) (6GK5302-7GD00-1GA3)",
"product_id": "258",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-1GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (24V, coated) (6GK5302-7GD00-1GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X302-7 EEC (24V) (6GK5302-7GD00-1EA3)",
"product_id": "259",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-1EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (24V) (6GK5302-7GD00-1EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X302-7 EEC (2x 230V, coated) (6GK5302-7GD00-4GA3)",
"product_id": "260",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-4GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (2x 230V, coated) (6GK5302-7GD00-4GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X302-7 EEC (2x 230V) (6GK5302-7GD00-4EA3)",
"product_id": "261",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-4EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (2x 230V) (6GK5302-7GD00-4EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X302-7 EEC (2x 24V, coated) (6GK5302-7GD00-2GA3)",
"product_id": "262",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-2GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (2x 24V, coated) (6GK5302-7GD00-2GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X302-7 EEC (2x 24V) (6GK5302-7GD00-2EA3)",
"product_id": "263",
"product_identification_helper": {
"model_numbers": [
"6GK5302-7GD00-2EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X302-7 EEC (2x 24V) (6GK5302-7GD00-2EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X304-2FE (6GK5304-2BD00-2AA3)",
"product_id": "264",
"product_identification_helper": {
"model_numbers": [
"6GK5304-2BD00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X304-2FE (6GK5304-2BD00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X306-1LD FE (6GK5306-1BF00-2AA3)",
"product_id": "265",
"product_identification_helper": {
"model_numbers": [
"6GK5306-1BF00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X306-1LD FE (6GK5306-1BF00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-2 EEC (230V, coated) (6GK5307-2FD00-3GA3)",
"product_id": "266",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-3GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (230V, coated) (6GK5307-2FD00-3GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-2 EEC (230V) (6GK5307-2FD00-3EA3)",
"product_id": "267",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-3EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (230V) (6GK5307-2FD00-3EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-2 EEC (24V, coated) (6GK5307-2FD00-1GA3)",
"product_id": "268",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-1GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (24V, coated) (6GK5307-2FD00-1GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-2 EEC (24V) (6GK5307-2FD00-1EA3)",
"product_id": "269",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-1EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (24V) (6GK5307-2FD00-1EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-2 EEC (2x 230V, coated) (6GK5307-2FD00-4GA3)",
"product_id": "270",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-4GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (2x 230V, coated) (6GK5307-2FD00-4GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-2 EEC (2x 230V) (6GK5307-2FD00-4EA3)",
"product_id": "271",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-4EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (2x 230V) (6GK5307-2FD00-4EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-2 EEC (2x 24V, coated) (6GK5307-2FD00-2GA3)",
"product_id": "272",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-2GA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (2x 24V, coated) (6GK5307-2FD00-2GA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-2 EEC (2x 24V) (6GK5307-2FD00-2EA3)",
"product_id": "273",
"product_identification_helper": {
"model_numbers": [
"6GK5307-2FD00-2EA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-2 EEC (2x 24V) (6GK5307-2FD00-2EA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-3 (6GK5307-3BL00-2AA3)",
"product_id": "274",
"product_identification_helper": {
"model_numbers": [
"6GK5307-3BL00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-3 (6GK5307-3BL00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-3 (6GK5307-3BL10-2AA3)",
"product_id": "275",
"product_identification_helper": {
"model_numbers": [
"6GK5307-3BL10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-3 (6GK5307-3BL10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-3LD (6GK5307-3BM00-2AA3)",
"product_id": "276",
"product_identification_helper": {
"model_numbers": [
"6GK5307-3BM00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-3LD (6GK5307-3BM00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X307-3LD (6GK5307-3BM10-2AA3)",
"product_id": "277",
"product_identification_helper": {
"model_numbers": [
"6GK5307-3BM10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X307-3LD (6GK5307-3BM10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2 (6GK5308-2FL00-2AA3)",
"product_id": "278",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FL00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2 (6GK5308-2FL00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2 (6GK5308-2FL10-2AA3)",
"product_id": "279",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FL10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2 (6GK5308-2FL10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2LD (6GK5308-2FM00-2AA3)",
"product_id": "280",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FM00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LD (6GK5308-2FM00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2LD (6GK5308-2FM10-2AA3)",
"product_id": "281",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FM10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LD (6GK5308-2FM10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2LH (6GK5308-2FN00-2AA3)",
"product_id": "282",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FN00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LH (6GK5308-2FN00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2LH (6GK5308-2FN10-2AA3)",
"product_id": "283",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FN10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LH (6GK5308-2FN10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2LH+ (6GK5308-2FP00-2AA3)",
"product_id": "284",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FP00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LH+ (6GK5308-2FP00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2LH+ (6GK5308-2FP10-2AA3)",
"product_id": "285",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2FP10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2LH+ (6GK5308-2FP10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2M (6GK5308-2GG00-2AA2)",
"product_id": "286",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2GG00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M (6GK5308-2GG00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2M (6GK5308-2GG10-2AA2)",
"product_id": "287",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2GG10-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M (6GK5308-2GG10-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2M PoE (6GK5308-2QG00-2AA2)",
"product_id": "288",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2QG00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M PoE (6GK5308-2QG00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2M PoE (6GK5308-2QG10-2AA2)",
"product_id": "289",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2QG10-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M PoE (6GK5308-2QG10-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2M TS (6GK5308-2GG00-2CA2)",
"product_id": "290",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2GG00-2CA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M TS (6GK5308-2GG00-2CA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X308-2M TS (6GK5308-2GG10-2CA2)",
"product_id": "291",
"product_identification_helper": {
"model_numbers": [
"6GK5308-2GG10-2CA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X308-2M TS (6GK5308-2GG10-2CA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X310 (6GK5310-0FA00-2AA3)",
"product_id": "292",
"product_identification_helper": {
"model_numbers": [
"6GK5310-0FA00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X310 (6GK5310-0FA00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X310 (6GK5310-0FA10-2AA3)",
"product_id": "293",
"product_identification_helper": {
"model_numbers": [
"6GK5310-0FA10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X310 (6GK5310-0FA10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X310FE (6GK5310-0BA00-2AA3)",
"product_id": "294",
"product_identification_helper": {
"model_numbers": [
"6GK5310-0BA00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X310FE (6GK5310-0BA00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X310FE (6GK5310-0BA10-2AA3)",
"product_id": "295",
"product_identification_helper": {
"model_numbers": [
"6GK5310-0BA10-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X310FE (6GK5310-0BA10-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X320-1 FE (6GK5320-1BD00-2AA3)",
"product_id": "296",
"product_identification_helper": {
"model_numbers": [
"6GK5320-1BD00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X320-1 FE (6GK5320-1BD00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X320-1-2LD FE (6GK5320-3BF00-2AA3)",
"product_id": "297",
"product_identification_helper": {
"model_numbers": [
"6GK5320-3BF00-2AA3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X320-1-2LD FE (6GK5320-3BF00-2AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE X408-2 (6GK5408-2FD00-2AA2)",
"product_id": "298",
"product_identification_helper": {
"model_numbers": [
"6GK5408-2FD00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE X408-2 (6GK5408-2FD00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)",
"product_id": "299",
"product_identification_helper": {
"model_numbers": [
"6GK5205-3BB00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)",
"product_id": "300",
"product_identification_helper": {
"model_numbers": [
"6GK5205-3BB00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)",
"product_id": "301",
"product_identification_helper": {
"model_numbers": [
"6GK5205-3BD00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)",
"product_id": "302",
"product_identification_helper": {
"model_numbers": [
"6GK5205-3BD00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)",
"product_id": "303",
"product_identification_helper": {
"model_numbers": [
"6GK5205-3BF00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)",
"product_id": "304",
"product_identification_helper": {
"model_numbers": [
"6GK5205-3BF00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB206-2 (SC) (6GK5206-2BD00-2TB2)",
"product_id": "305",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BD00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB206-2 (SC) (6GK5206-2BD00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB206-2 (ST/BFOC) (6GK5206-2BF00-2TB2)",
"product_id": "306",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BF00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB206-2 (ST/BFOC) (6GK5206-2BF00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB206-2 LD (6GK5206-2BF00-2AB2)",
"product_id": "307",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BF00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB206-2 LD (6GK5206-2BF00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB206-2 SC (6GK5206-2BD00-2AB2)",
"product_id": "308",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BD00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB206-2 SC (6GK5206-2BD00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB206-2 ST (6GK5206-2BB00-2AB2)",
"product_id": "309",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BB00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB206-2 ST (6GK5206-2BB00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB206-2LD (6GK5206-2BB00-2TB2)",
"product_id": "310",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BB00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB206-2LD (6GK5206-2BB00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)",
"product_id": "311",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0BA00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)",
"product_id": "312",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0BA00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)",
"product_id": "313",
"product_identification_helper": {
"model_numbers": [
"6GK5213-3BD00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)",
"product_id": "314",
"product_identification_helper": {
"model_numbers": [
"6GK5213-3BD00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)",
"product_id": "315",
"product_identification_helper": {
"model_numbers": [
"6GK5213-3BB00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)",
"product_id": "316",
"product_identification_helper": {
"model_numbers": [
"6GK5213-3BB00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)",
"product_id": "317",
"product_identification_helper": {
"model_numbers": [
"6GK5213-3BF00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)",
"product_id": "318",
"product_identification_helper": {
"model_numbers": [
"6GK5213-3BF00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)",
"product_id": "319",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0BA00-2TB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)",
"product_id": "320",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0BA00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)",
"product_id": "321",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BD00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)",
"product_id": "322",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BB00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)",
"product_id": "323",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2RS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)",
"product_id": "324",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2RS00-5AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)",
"product_id": "325",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2RS00-5FC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)",
"product_id": "326",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)",
"product_id": "327",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2BS00-2FC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)",
"product_id": "328",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)",
"product_id": "329",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2GS00-2TC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)",
"product_id": "330",
"product_identification_helper": {
"model_numbers": [
"6GK5206-2GS00-2FC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)",
"product_id": "331",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0BA00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC208 (6GK5208-0BA00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)",
"product_id": "332",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0BA00-2FC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC208EEC (6GK5208-0BA00-2FC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)",
"product_id": "333",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0GA00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC208G (6GK5208-0GA00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)",
"product_id": "334",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0GA00-2TC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)",
"product_id": "335",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0GA00-2FC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC208G EEC (6GK5208-0GA00-2FC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)",
"product_id": "336",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0RA00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC208G PoE (6GK5208-0RA00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)",
"product_id": "337",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0RA00-5AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)",
"product_id": "338",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0BA00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC216 (6GK5216-0BA00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)",
"product_id": "339",
"product_identification_helper": {
"model_numbers": [
"6GK5216-3RS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)",
"product_id": "340",
"product_identification_helper": {
"model_numbers": [
"6GK5216-3RS00-5AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)",
"product_id": "341",
"product_identification_helper": {
"model_numbers": [
"6GK5216-4BS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC216-4C (6GK5216-4BS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)",
"product_id": "342",
"product_identification_helper": {
"model_numbers": [
"6GK5216-4GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC216-4C G (6GK5216-4GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)",
"product_id": "343",
"product_identification_helper": {
"model_numbers": [
"6GK5216-4GS00-2TC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)",
"product_id": "344",
"product_identification_helper": {
"model_numbers": [
"6GK5216-4GS00-2FC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)",
"product_id": "345",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0BA00-2FC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC216EEC (6GK5216-0BA00-2FC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)",
"product_id": "346",
"product_identification_helper": {
"model_numbers": [
"6GK5224-0BA00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC224 (6GK5224-0BA00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)",
"product_id": "347",
"product_identification_helper": {
"model_numbers": [
"6GK5224-4GS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC224-4C G (6GK5224-4GS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)",
"product_id": "348",
"product_identification_helper": {
"model_numbers": [
"6GK5224-4GS00-2TC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC224-4C G (EIP Def.) (6GK5224-4GS00-2TC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)",
"product_id": "349",
"product_identification_helper": {
"model_numbers": [
"6GK5224-4GS00-2FC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC224-4C G EEC (6GK5224-4GS00-2FC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XC316-8 (6GK5324-8TS00-2AC2)",
"product_id": "350",
"product_identification_helper": {
"model_numbers": [
"6GK5324-8TS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC316-8 (6GK5324-8TS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XC324-4 (6GK5328-4TS00-2AC2)",
"product_id": "351",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4TS00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC324-4 (6GK5328-4TS00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2)",
"product_id": "352",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4TS00-2EC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XC332 (6GK5332-0GA00-2AC2)",
"product_id": "353",
"product_identification_helper": {
"model_numbers": [
"6GK5332-0GA00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC332 (6GK5332-0GA00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XC416-8 (6GK5424-8TR00-2AC2)",
"product_id": "354",
"product_identification_helper": {
"model_numbers": [
"6GK5424-8TR00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC416-8 (6GK5424-8TR00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XC424-4 (6GK5428-4TR00-2AC2)",
"product_id": "355",
"product_identification_helper": {
"model_numbers": [
"6GK5428-4TR00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC424-4 (6GK5428-4TR00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XC432 (6GK5432-0GR00-2AC2)",
"product_id": "356",
"product_identification_helper": {
"model_numbers": [
"6GK5432-0GR00-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XC432 (6GK5432-0GR00-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XCH328 (6GK5328-4TS01-2EC2)",
"product_id": "357",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4TS01-2EC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XCH328 (6GK5328-4TS01-2EC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XCM324 (6GK5324-8TS01-2AC2)",
"product_id": "358",
"product_identification_helper": {
"model_numbers": [
"6GK5324-8TS01-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XCM324 (6GK5324-8TS01-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XCM328 (6GK5328-4TS01-2AC2)",
"product_id": "359",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4TS01-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XCM328 (6GK5328-4TS01-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XCM332 (6GK5332-0GA01-2AC2)",
"product_id": "360",
"product_identification_helper": {
"model_numbers": [
"6GK5332-0GA01-2AC2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XCM332 (6GK5332-0GA01-2AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)",
"product_id": "361",
"product_identification_helper": {
"model_numbers": [
"6GK5204-0BA00-2GF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF204 (6GK5204-0BA00-2GF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)",
"product_id": "362",
"product_identification_helper": {
"model_numbers": [
"6GK5204-0BA00-2YF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF204 DNA (6GK5204-0BA00-2YF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)",
"product_id": "363",
"product_identification_helper": {
"model_numbers": [
"6GK5204-2AA00-2GF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF204-2BA (6GK5204-2AA00-2GF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)",
"product_id": "364",
"product_identification_helper": {
"model_numbers": [
"6GK5204-2AA00-2YF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF204-2BA DNA (6GK5204-2AA00-2YF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XF204G (6GK5204-0GA00-1UF2)",
"product_id": "365",
"product_identification_helper": {
"model_numbers": [
"6GK5204-0GA00-1UF2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XF204G (6GK5204-0GA00-1UF2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM408-4C (6GK5408-4GP00-2AM2)",
"product_id": "366",
"product_identification_helper": {
"model_numbers": [
"6GK5408-4GP00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM408-4C (6GK5408-4GP00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2)",
"product_id": "367",
"product_identification_helper": {
"model_numbers": [
"6GK5408-4GQ00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM408-8C (6GK5408-8GS00-2AM2)",
"product_id": "368",
"product_identification_helper": {
"model_numbers": [
"6GK5408-8GS00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM408-8C (6GK5408-8GS00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2)",
"product_id": "369",
"product_identification_helper": {
"model_numbers": [
"6GK5408-8GR00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM416-4C (6GK5416-4GS00-2AM2)",
"product_id": "370",
"product_identification_helper": {
"model_numbers": [
"6GK5416-4GS00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM416-4C (6GK5416-4GS00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2)",
"product_id": "371",
"product_identification_helper": {
"model_numbers": [
"6GK5416-4GR00-2AM2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)",
"product_id": "372",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0HA00-2AS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208 (6GK5208-0HA00-2AS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208 (6GK5208-0HA10-2AS6)",
"product_id": "373",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0HA10-2AS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208 (6GK5208-0HA10-2AS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)",
"product_id": "374",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0HA00-2TS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208 (Ethernet/IP) (6GK5208-0HA00-2TS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)",
"product_id": "375",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0HA00-2ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208EEC (6GK5208-0HA00-2ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208EEC (6GK5208-0HA10-2ES6)",
"product_id": "376",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0HA10-2ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208EEC (6GK5208-0HA10-2ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208G (6GK5208-0XA00-2AS6)",
"product_id": "377",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0XA00-2AS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208G (6GK5208-0XA00-2AS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208G EEC (6GK5208-0XA00-2ES6)",
"product_id": "378",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0XA00-2ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208G EEC (6GK5208-0XA00-2ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208G PoE EEC (6GK5208-0YA00-5ES6)",
"product_id": "379",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0YA00-5ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208G PoE EEC (6GK5208-0YA00-5ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208G PP (6GK5208-0JA00-2AS6)",
"product_id": "380",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0JA00-2AS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208G PP (6GK5208-0JA00-2AS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)",
"product_id": "381",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0UA00-5ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208PoE EEC (6GK5208-0UA00-5ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP208PoE EEC (6GK5208-0UA10-5ES6)",
"product_id": "382",
"product_identification_helper": {
"model_numbers": [
"6GK5208-0UA10-5ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP208PoE EEC (6GK5208-0UA10-5ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)",
"product_id": "383",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0HA00-2AS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216 (6GK5216-0HA00-2AS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)",
"product_id": "384",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0HA00-2TS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216 (Ethernet/IP) (6GK5216-0HA00-2TS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216 (V2) (6GK5216-0HA10-2AS6)",
"product_id": "385",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0HA10-2AS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216 (V2) (6GK5216-0HA10-2AS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)",
"product_id": "386",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0HA00-2ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216EEC (6GK5216-0HA00-2ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216EEC (V2) (6GK5216-0HA10-2ES6)",
"product_id": "387",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0HA10-2ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216EEC (V2) (6GK5216-0HA10-2ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216G (6GK5216-0XA00-2AS6)",
"product_id": "388",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0XA00-2AS6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216G (6GK5216-0XA00-2AS6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216G EEC (6GK5216-0XA00-2ES6)",
"product_id": "389",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0XA00-2ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216G EEC (6GK5216-0XA00-2ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216G PoE EEC (6GK5216-0YA00-5ES6)",
"product_id": "390",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0YA00-5ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216G PoE EEC (6GK5216-0YA00-5ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)",
"product_id": "391",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0UA00-5ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216POE EEC (6GK5216-0UA00-5ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XP216PoE EEC (V2) (6GK5216-0UA10-5ES6)",
"product_id": "392",
"product_identification_helper": {
"model_numbers": [
"6GK5216-0UA10-5ES6"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XP216PoE EEC (V2) (6GK5216-0UA10-5ES6)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR302-32 (6GK5334-5TS00-2AR3)",
"product_id": "393",
"product_identification_helper": {
"model_numbers": [
"6GK5334-5TS00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR302-32 (6GK5334-5TS00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR302-32 (6GK5334-5TS00-3AR3)",
"product_id": "394",
"product_identification_helper": {
"model_numbers": [
"6GK5334-5TS00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR302-32 (6GK5334-5TS00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR302-32 (6GK5334-5TS00-4AR3)",
"product_id": "395",
"product_identification_helper": {
"model_numbers": [
"6GK5334-5TS00-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR302-32 (6GK5334-5TS00-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR322-12 (6GK5334-3TS00-2AR3)",
"product_id": "396",
"product_identification_helper": {
"model_numbers": [
"6GK5334-3TS00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR322-12 (6GK5334-3TS00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR322-12 (6GK5334-3TS00-3AR3)",
"product_id": "397",
"product_identification_helper": {
"model_numbers": [
"6GK5334-3TS00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR322-12 (6GK5334-3TS00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR322-12 (6GK5334-3TS00-4AR3)",
"product_id": "398",
"product_identification_helper": {
"model_numbers": [
"6GK5334-3TS00-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR322-12 (6GK5334-3TS00-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M (230V, ports on front) (6GK5324-0GG00-3AR2)",
"product_id": "399",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (230V, ports on front) (6GK5324-0GG00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M (230V, ports on front) (6GK5324-0GG10-3AR2)",
"product_id": "400",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (230V, ports on front) (6GK5324-0GG10-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M (230V, ports on rear) (6GK5324-0GG00-3HR2)",
"product_id": "401",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-3HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (230V, ports on rear) (6GK5324-0GG00-3HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M (230V, ports on rear) (6GK5324-0GG10-3HR2)",
"product_id": "402",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-3HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (230V, ports on rear) (6GK5324-0GG10-3HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M (24V, ports on front) (6GK5324-0GG00-1AR2)",
"product_id": "403",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-1AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (24V, ports on front) (6GK5324-0GG00-1AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M (24V, ports on front) (6GK5324-0GG10-1AR2)",
"product_id": "404",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-1AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (24V, ports on front) (6GK5324-0GG10-1AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M (24V, ports on rear) (6GK5324-0GG00-1HR2)",
"product_id": "405",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-1HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (24V, ports on rear) (6GK5324-0GG00-1HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M (24V, ports on rear) (6GK5324-0GG10-1HR2)",
"product_id": "406",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-1HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M (24V, ports on rear) (6GK5324-0GG10-1HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M TS (24V) (6GK5324-0GG00-1CR2)",
"product_id": "407",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG00-1CR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M TS (24V) (6GK5324-0GG00-1CR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-12M TS (24V) (6GK5324-0GG10-1CR2)",
"product_id": "408",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0GG10-1CR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-12M TS (24V) (6GK5324-0GG10-1CR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front) (6GK5324-4GG00-3ER2)",
"product_id": "409",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-3ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front) (6GK5324-4GG00-3ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front) (6GK5324-4GG10-3ER2)",
"product_id": "410",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-3ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front) (6GK5324-4GG10-3ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG00-3JR2)",
"product_id": "411",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-3JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG00-3JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG10-3JR2)",
"product_id": "412",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-3JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG10-3JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (24V, ports on front) (6GK5324-4GG00-1ER2)",
"product_id": "413",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-1ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (24V, ports on front) (6GK5324-4GG00-1ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (24V, ports on front) (6GK5324-4GG10-1ER2)",
"product_id": "414",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-1ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (24V, ports on front) (6GK5324-4GG10-1ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (24V, ports on rear) (6GK5324-4GG00-1JR2)",
"product_id": "415",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-1JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (24V, ports on rear) (6GK5324-4GG00-1JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (24V, ports on rear) (6GK5324-4GG10-1JR2)",
"product_id": "416",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-1JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (24V, ports on rear) (6GK5324-4GG10-1JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front) (6GK5324-4GG00-4ER2)",
"product_id": "417",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-4ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front) (6GK5324-4GG00-4ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front) (6GK5324-4GG10-4ER2)",
"product_id": "418",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-4ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front) (6GK5324-4GG10-4ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG00-4JR2)",
"product_id": "419",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-4JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG00-4JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG10-4JR2)",
"product_id": "420",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-4JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear) (6GK5324-4GG10-4JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on front) (6GK5324-4GG00-2ER2)",
"product_id": "421",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-2ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on front) (6GK5324-4GG00-2ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on front) (6GK5324-4GG10-2ER2)",
"product_id": "422",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-2ER2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on front) (6GK5324-4GG10-2ER2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on rear) (6GK5324-4GG00-2JR2)",
"product_id": "423",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG00-2JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on rear) (6GK5324-4GG00-2JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on rear) (6GK5324-4GG10-2JR2)",
"product_id": "424",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4GG10-2JR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M EEC (2x 24V, ports on rear) (6GK5324-4GG10-2JR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE (230V, ports on front) (6GK5324-4QG00-3AR2)",
"product_id": "425",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (230V, ports on front) (6GK5324-4QG00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE (230V, ports on front) (6GK5324-4QG10-3AR2)",
"product_id": "426",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (230V, ports on front) (6GK5324-4QG10-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE (230V, ports on rear) (6GK5324-4QG00-3HR2)",
"product_id": "427",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-3HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (230V, ports on rear) (6GK5324-4QG00-3HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE (230V, ports on rear) (6GK5324-4QG10-3HR2)",
"product_id": "428",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-3HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (230V, ports on rear) (6GK5324-4QG10-3HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE (24V, ports on front) (6GK5324-4QG00-1AR2)",
"product_id": "429",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-1AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (24V, ports on front) (6GK5324-4QG00-1AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE (24V, ports on front) (6GK5324-4QG10-1AR2)",
"product_id": "430",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-1AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (24V, ports on front) (6GK5324-4QG10-1AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE (24V, ports on rear) (6GK5324-4QG00-1HR2)",
"product_id": "431",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-1HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (24V, ports on rear) (6GK5324-4QG00-1HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE (24V, ports on rear) (6GK5324-4QG10-1HR2)",
"product_id": "432",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-1HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE (24V, ports on rear) (6GK5324-4QG10-1HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE TS (24V, ports on front) (6GK5324-4QG00-1CR2)",
"product_id": "433",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG00-1CR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE TS (24V, ports on front) (6GK5324-4QG00-1CR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SCALANCE XR324-4M PoE TS (24V, ports on front) (6GK5324-4QG10-1CR2)",
"product_id": "434",
"product_identification_helper": {
"model_numbers": [
"6GK5324-4QG10-1CR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324-4M PoE TS (24V, ports on front) (6GK5324-4QG10-1CR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)",
"product_id": "435",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0BA00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324WG (24 x FE, AC 230V) (6GK5324-0BA00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)",
"product_id": "436",
"product_identification_helper": {
"model_numbers": [
"6GK5324-0BA00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR324WG (24 X FE, DC 24V) (6GK5324-0BA00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)",
"product_id": "437",
"product_identification_helper": {
"model_numbers": [
"6GK5326-2QS00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR326-2C PoE WG (6GK5326-2QS00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)",
"product_id": "438",
"product_identification_helper": {
"model_numbers": [
"6GK5326-2QS00-3RR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR326-2C PoE WG (without UL) (6GK5326-2QS00-3RR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR326-8 (6GK5334-2TS00-2AR3)",
"product_id": "439",
"product_identification_helper": {
"model_numbers": [
"6GK5334-2TS00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR326-8 (6GK5334-2TS00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR326-8 (6GK5334-2TS00-3AR3)",
"product_id": "440",
"product_identification_helper": {
"model_numbers": [
"6GK5334-2TS00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR326-8 (6GK5334-2TS00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR326-8 (6GK5334-2TS00-4AR3)",
"product_id": "441",
"product_identification_helper": {
"model_numbers": [
"6GK5334-2TS00-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR326-8 (6GK5334-2TS00-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3)",
"product_id": "442",
"product_identification_helper": {
"model_numbers": [
"6GK5334-2TS00-2ER3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)",
"product_id": "443",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4FS00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR328-4C WG (24XFE, 4XGE, 24V) (6GK5328-4FS00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)",
"product_id": "444",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4FS00-2RR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V) (6GK5328-4FS00-2RR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)",
"product_id": "445",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4FS00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)",
"product_id": "446",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4FS00-3RR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR328-4C WG (24xFE,4xGE,AC230V) (6GK5328-4FS00-3RR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)",
"product_id": "447",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4SS00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR328-4C WG (28xGE, AC 230V) (6GK5328-4SS00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)",
"product_id": "448",
"product_identification_helper": {
"model_numbers": [
"6GK5328-4SS00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR328-4C WG (28xGE, DC 24V) (6GK5328-4SS00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR502-32 (6GK5534-5TR00-2AR3)",
"product_id": "449",
"product_identification_helper": {
"model_numbers": [
"6GK5534-5TR00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR502-32 (6GK5534-5TR00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR502-32 (6GK5534-5TR00-3AR3)",
"product_id": "450",
"product_identification_helper": {
"model_numbers": [
"6GK5534-5TR00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR502-32 (6GK5534-5TR00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR502-32 (6GK5534-5TR00-4AR3)",
"product_id": "451",
"product_identification_helper": {
"model_numbers": [
"6GK5534-5TR00-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR502-32 (6GK5534-5TR00-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR522-12 (6GK5534-3TR00-2AR3)",
"product_id": "452",
"product_identification_helper": {
"model_numbers": [
"6GK5534-3TR00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR522-12 (6GK5534-3TR00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR522-12 (6GK5534-3TR00-3AR3)",
"product_id": "453",
"product_identification_helper": {
"model_numbers": [
"6GK5534-3TR00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR522-12 (6GK5534-3TR00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR522-12 (6GK5534-3TR00-4AR3)",
"product_id": "454",
"product_identification_helper": {
"model_numbers": [
"6GK5534-3TR00-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR522-12 (6GK5534-3TR00-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2)",
"product_id": "455",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GS00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2)",
"product_id": "456",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GR00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2)",
"product_id": "457",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GS00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2)",
"product_id": "458",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GR00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2)",
"product_id": "459",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GS00-4AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2)",
"product_id": "460",
"product_identification_helper": {
"model_numbers": [
"6GK5524-8GR00-4AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR524-8WG (6GK5532-2SR00-2AR3)",
"product_id": "461",
"product_identification_helper": {
"model_numbers": [
"6GK5532-2SR00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8WG (6GK5532-2SR00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR524-8WG (6GK5532-2SR00-2RR3)",
"product_id": "462",
"product_identification_helper": {
"model_numbers": [
"6GK5532-2SR00-2RR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8WG (6GK5532-2SR00-2RR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR524-8WG (6GK5532-2SR00-3AR3)",
"product_id": "463",
"product_identification_helper": {
"model_numbers": [
"6GK5532-2SR00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8WG (6GK5532-2SR00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR524-8WG (6GK5532-2SR00-3RR3)",
"product_id": "464",
"product_identification_helper": {
"model_numbers": [
"6GK5532-2SR00-3RR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR524-8WG (6GK5532-2SR00-3RR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR526-8 (6GK5534-2TR00-2AR3)",
"product_id": "465",
"product_identification_helper": {
"model_numbers": [
"6GK5534-2TR00-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8 (6GK5534-2TR00-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR526-8 (6GK5534-2TR00-3AR3)",
"product_id": "466",
"product_identification_helper": {
"model_numbers": [
"6GK5534-2TR00-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8 (6GK5534-2TR00-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SCALANCE XR526-8 (6GK5534-2TR00-4AR3)",
"product_id": "467",
"product_identification_helper": {
"model_numbers": [
"6GK5534-2TR00-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8 (6GK5534-2TR00-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2)",
"product_id": "468",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GS00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2)",
"product_id": "469",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GR00-3AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2)",
"product_id": "470",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GS00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2)",
"product_id": "471",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GR00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2)",
"product_id": "472",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GS00-4AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2)",
"product_id": "473",
"product_identification_helper": {
"model_numbers": [
"6GK5526-8GR00-4AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR528-6M (6GK5528-0AA00-2AR2)",
"product_id": "474",
"product_identification_helper": {
"model_numbers": [
"6GK5528-0AA00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR528-6M (6GK5528-0AA00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2)",
"product_id": "475",
"product_identification_helper": {
"model_numbers": [
"6GK5528-0AR00-2HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2)",
"product_id": "476",
"product_identification_helper": {
"model_numbers": [
"6GK5528-0AA00-2HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2)",
"product_id": "477",
"product_identification_helper": {
"model_numbers": [
"6GK5528-0AR00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR552-12M (6GK5552-0AA00-2AR2)",
"product_id": "478",
"product_identification_helper": {
"model_numbers": [
"6GK5552-0AA00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR552-12M (6GK5552-0AA00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2)",
"product_id": "479",
"product_identification_helper": {
"model_numbers": [
"6GK5552-0AR00-2AR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2)",
"product_id": "480",
"product_identification_helper": {
"model_numbers": [
"6GK5552-0AA00-2HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2)",
"product_id": "481",
"product_identification_helper": {
"model_numbers": [
"6GK5552-0AR00-2HR2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3)",
"product_id": "482",
"product_identification_helper": {
"model_numbers": [
"6GK5334-2TS01-2ER3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3)",
"product_id": "483",
"product_identification_helper": {
"model_numbers": [
"6GK5334-3TS01-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3)",
"product_id": "484",
"product_identification_helper": {
"model_numbers": [
"6GK5334-2TS01-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3)",
"product_id": "485",
"product_identification_helper": {
"model_numbers": [
"6GK5334-5TS01-3AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3)",
"product_id": "486",
"product_identification_helper": {
"model_numbers": [
"6GK5334-3TS01-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3)",
"product_id": "487",
"product_identification_helper": {
"model_numbers": [
"6GK5334-2TS01-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3)",
"product_id": "488",
"product_identification_helper": {
"model_numbers": [
"6GK5334-5TS01-2AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3)",
"product_id": "489",
"product_identification_helper": {
"model_numbers": [
"6GK5334-3TS01-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3)",
"product_id": "490",
"product_identification_helper": {
"model_numbers": [
"6GK5334-2TS01-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<3.2",
"product": {
"name": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3)",
"product_id": "491",
"product_identification_helper": {
"model_numbers": [
"6GK5334-5TS01-4AR3"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.0.2.4",
"product": {
"name": "SINEC INS",
"product_id": "492"
}
}
],
"category": "product_name",
"name": "SINEC INS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.1.9",
"product": {
"name": "SIPLUS NET SCALANCE X308-2 (6AG1308-2FL10-4AA3)",
"product_id": "493",
"product_identification_helper": {
"model_numbers": [
"6AG1308-2FL10-4AA3"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS NET SCALANCE X308-2 (6AG1308-2FL10-4AA3)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)",
"product_id": "494",
"product_identification_helper": {
"model_numbers": [
"6AG1206-2BB00-7AC2"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS NET SCALANCE XC206-2 (6AG1206-2BB00-7AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)",
"product_id": "495",
"product_identification_helper": {
"model_numbers": [
"6AG1206-2BS00-7AC2"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS NET SCALANCE XC206-2SFP (6AG1206-2BS00-7AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)",
"product_id": "496",
"product_identification_helper": {
"model_numbers": [
"6AG1208-0BA00-7AC2"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS NET SCALANCE XC208 (6AG1208-0BA00-7AC2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.6",
"product": {
"name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)",
"product_id": "497",
"product_identification_helper": {
"model_numbers": [
"6AG1216-4BS00-7AC2"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS NET SCALANCE XC216-4C (6AG1216-4BS00-7AC2)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-3596",
"cwe": {
"id": "CWE-924",
"name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel"
},
"notes": [
{
"category": "summary",
"text": "RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify responses Access-Reject or Access-Accept using a chosen-prefix collision attack against MD5 Response Authenticator signature.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175",
"176",
"177",
"178",
"179",
"180",
"181",
"182",
"183",
"184",
"185",
"186",
"187",
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"233",
"234",
"235",
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"245",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"271",
"272",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"282",
"283",
"284",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295",
"296",
"297",
"298",
"299",
"300",
"301",
"302",
"303",
"304",
"305",
"306",
"307",
"308",
"309",
"310",
"311",
"312",
"313",
"314",
"315",
"316",
"317",
"318",
"319",
"320",
"321",
"322",
"323",
"324",
"325",
"326",
"327",
"328",
"329",
"330",
"331",
"332",
"333",
"334",
"335",
"336",
"337",
"338",
"339",
"340",
"341",
"342",
"343",
"344",
"345",
"346",
"347",
"348",
"349",
"350",
"351",
"352",
"353",
"354",
"355",
"356",
"357",
"358",
"359",
"360",
"361",
"362",
"363",
"364",
"365",
"366",
"367",
"368",
"369",
"370",
"371",
"372",
"373",
"374",
"375",
"376",
"377",
"378",
"379",
"380",
"381",
"382",
"383",
"384",
"385",
"386",
"387",
"388",
"389",
"390",
"391",
"392",
"393",
"394",
"395",
"396",
"397",
"398",
"399",
"400",
"401",
"402",
"403",
"404",
"405",
"406",
"407",
"408",
"409",
"410",
"411",
"412",
"413",
"414",
"415",
"416",
"417",
"418",
"419",
"420",
"421",
"422",
"423",
"424",
"425",
"426",
"427",
"428",
"429",
"430",
"431",
"432",
"433",
"434",
"435",
"436",
"437",
"438",
"439",
"440",
"441",
"442",
"443",
"444",
"445",
"446",
"447",
"448",
"449",
"450",
"451",
"452",
"453",
"454",
"455",
"456",
"457",
"458",
"459",
"460",
"461",
"462",
"463",
"464",
"465",
"466",
"467",
"468",
"469",
"470",
"471",
"472",
"473",
"474",
"475",
"476",
"477",
"478",
"479",
"480",
"481",
"482",
"483",
"484",
"485",
"486",
"487",
"488",
"489",
"490",
"491",
"492",
"493",
"494",
"495",
"496",
"497"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175",
"176",
"177",
"178",
"179",
"180",
"181",
"182",
"183",
"184",
"185",
"186",
"187",
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"233",
"234",
"235",
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"245",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"271",
"272",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"282",
"283",
"284",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295",
"296",
"297",
"298",
"299",
"300",
"301",
"302",
"303",
"304",
"305",
"306",
"307",
"308",
"309",
"310",
"311",
"312",
"313",
"314",
"315",
"316",
"317",
"318",
"319",
"320",
"321",
"322",
"323",
"324",
"325",
"326",
"327",
"328",
"329",
"330",
"331",
"332",
"333",
"334",
"335",
"336",
"337",
"338",
"339",
"340",
"341",
"342",
"343",
"344",
"345",
"346",
"347",
"348",
"349",
"350",
"351",
"352",
"353",
"354",
"355",
"356",
"357",
"358",
"359",
"360",
"361",
"362",
"363",
"364",
"365",
"366",
"367",
"368",
"369",
"370",
"371",
"372",
"373",
"374",
"375",
"376",
"377",
"378",
"379",
"380",
"381",
"382",
"383",
"384",
"385",
"386",
"387",
"388",
"389",
"390",
"391",
"392",
"393",
"394",
"395",
"396",
"397",
"398",
"399",
"400",
"401",
"402",
"403",
"404",
"405",
"406",
"407",
"408",
"409",
"410",
"411",
"412",
"413",
"414",
"415",
"416",
"417",
"418",
"419",
"420",
"421",
"422",
"423",
"424",
"425",
"426",
"427",
"428",
"429",
"430",
"431",
"432",
"433",
"434",
"435",
"436",
"437",
"438",
"439",
"440",
"441",
"442",
"443",
"444",
"445",
"446",
"447",
"448",
"449",
"450",
"451",
"452",
"453",
"454",
"455",
"456",
"457",
"458",
"459",
"460",
"461",
"462",
"463",
"464",
"465",
"466",
"467",
"468",
"469",
"470",
"471",
"472",
"473",
"474",
"475",
"476",
"477",
"478",
"479",
"480",
"481",
"482",
"483",
"484",
"485",
"486",
"487",
"488",
"489",
"490",
"491",
"492",
"493",
"494",
"495",
"496",
"497"
]
},
{
"category": "mitigation",
"details": "Restrict access to the networks where RADIUS messages are exchanged (e.g., send RADIUS traffic via management network or a dedicated VLAN)",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175",
"176",
"177",
"178",
"179",
"180",
"181",
"182",
"183",
"184",
"185",
"186",
"187",
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"233",
"234",
"235",
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"245",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"271",
"272",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"282",
"283",
"284",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295",
"296",
"297",
"298",
"299",
"300",
"301",
"302",
"303",
"304",
"305",
"306",
"307",
"308",
"309",
"310",
"311",
"312",
"313",
"314",
"315",
"316",
"317",
"318",
"319",
"320",
"321",
"322",
"323",
"324",
"325",
"326",
"327",
"328",
"329",
"330",
"331",
"332",
"333",
"334",
"335",
"336",
"337",
"338",
"339",
"340",
"341",
"342",
"343",
"344",
"345",
"346",
"347",
"348",
"349",
"350",
"351",
"352",
"353",
"354",
"355",
"356",
"357",
"358",
"359",
"360",
"361",
"362",
"363",
"364",
"365",
"366",
"367",
"368",
"369",
"370",
"371",
"372",
"373",
"374",
"375",
"376",
"377",
"378",
"379",
"380",
"381",
"382",
"383",
"384",
"385",
"386",
"387",
"388",
"389",
"390",
"391",
"392",
"393",
"394",
"395",
"396",
"397",
"398",
"399",
"400",
"401",
"402",
"403",
"404",
"405",
"406",
"407",
"408",
"409",
"410",
"411",
"412",
"413",
"414",
"415",
"416",
"417",
"418",
"419",
"420",
"421",
"422",
"423",
"424",
"425",
"426",
"427",
"428",
"429",
"430",
"431",
"432",
"433",
"434",
"435",
"436",
"437",
"438",
"439",
"440",
"441",
"442",
"443",
"444",
"445",
"446",
"447",
"448",
"449",
"450",
"451",
"452",
"453",
"454",
"455",
"456",
"457",
"458",
"459",
"460",
"461",
"462",
"463",
"464",
"465",
"466",
"467",
"468",
"469",
"470",
"471",
"472",
"473",
"474",
"475",
"476",
"477",
"478",
"479",
"480",
"481",
"482",
"483",
"484",
"485",
"486",
"487",
"488",
"489",
"490",
"491",
"492",
"493",
"494",
"495",
"496",
"497"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"182",
"183",
"184",
"185",
"186",
"187"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"366",
"367",
"368",
"369",
"370",
"371",
"455",
"456",
"457",
"458",
"459",
"460",
"468",
"469",
"470",
"471",
"472",
"473",
"474",
"475",
"476",
"477",
"478",
"479",
"480",
"481"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.0 SP2 Update 4 or later version",
"product_ids": [
"492"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109999722/"
},
{
"category": "vendor_fix",
"details": "Update to V1.3 or later version",
"product_ids": [
"350",
"351",
"352",
"353",
"354",
"355",
"356",
"393",
"394",
"395",
"396",
"397",
"398",
"439",
"440",
"441",
"442",
"449",
"450",
"451",
"452",
"453",
"454",
"461",
"462",
"463",
"464",
"465",
"466",
"467"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109977441/"
},
{
"category": "vendor_fix",
"details": "Update to V2.17.0 or later version",
"product_ids": [
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109997648/"
},
{
"category": "vendor_fix",
"details": "Update to V3.0.0 or later version",
"product_ids": [
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"245",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109977720/"
},
{
"category": "vendor_fix",
"details": "Update to V3.2 or later version",
"product_ids": [
"149",
"357",
"358",
"359",
"482",
"483",
"484",
"485",
"486",
"487",
"488",
"489",
"490",
"491"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109988839/"
},
{
"category": "vendor_fix",
"details": "Update to V3.2 or later version",
"product_ids": [
"360"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109988839/"
},
{
"category": "vendor_fix",
"details": "Update to V3.2 or later version",
"product_ids": [
"176",
"177",
"178",
"179",
"180",
"181"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110001886/"
},
{
"category": "vendor_fix",
"details": "Update to V4.1.9 or later version",
"product_ids": [
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"271",
"272",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"282",
"283",
"284",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295",
"296",
"297",
"298",
"399",
"400",
"401",
"402",
"403",
"404",
"405",
"406",
"407",
"408",
"409",
"410",
"411",
"412",
"413",
"414",
"415",
"416",
"417",
"418",
"419",
"420",
"421",
"422",
"423",
"424",
"425",
"426",
"427",
"428",
"429",
"430",
"431",
"432",
"433",
"434",
"493"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109982245/"
},
{
"category": "vendor_fix",
"details": "Update to V4.3.11 or later version",
"product_ids": [
"2",
"3",
"4",
"6",
"8",
"10",
"12",
"14",
"18",
"20",
"22",
"35",
"37",
"38",
"41",
"43",
"45",
"47",
"55",
"57",
"59",
"60",
"62",
"65",
"67",
"68",
"70",
"71",
"76",
"78",
"91",
"92",
"93",
"96",
"97",
"99",
"100",
"102",
"103",
"105",
"107",
"108",
"111",
"113",
"114",
"119",
"121",
"125",
"129",
"133",
"141"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109977251/"
},
{
"category": "vendor_fix",
"details": "Update to V4.3.11 or later version",
"product_ids": [
"5",
"7",
"9",
"11",
"13",
"15",
"19",
"36",
"39",
"40",
"42",
"44",
"46",
"48",
"49",
"51",
"52",
"53",
"61",
"63",
"64",
"66",
"73",
"74",
"77",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"94",
"95",
"98",
"101",
"104",
"106",
"110",
"116",
"117",
"120",
"123",
"127",
"131",
"135",
"143"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109977251/"
},
{
"category": "vendor_fix",
"details": "Update to V4.6 or later version",
"product_ids": [
"299",
"300",
"301",
"302",
"303",
"304",
"305",
"306",
"307",
"308",
"309",
"310",
"311",
"312",
"313",
"314",
"315",
"316",
"317",
"318",
"319",
"320",
"321",
"322",
"323",
"324",
"325",
"326",
"327",
"328",
"329",
"330",
"331",
"332",
"333",
"334",
"335",
"336",
"337",
"338",
"339",
"340",
"341",
"342",
"343",
"344",
"345",
"346",
"347",
"348",
"349",
"361",
"362",
"363",
"364",
"365",
"372",
"373",
"374",
"375",
"376",
"377",
"378",
"379",
"380",
"381",
"382",
"383",
"384",
"385",
"386",
"387",
"388",
"389",
"390",
"391",
"392",
"435",
"436",
"437",
"438",
"443",
"444",
"445",
"446",
"447",
"448",
"494",
"495",
"496",
"497"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109977185/"
},
{
"category": "vendor_fix",
"details": "Update to V5.10.0 or later version",
"product_ids": [
"21",
"56",
"58",
"69",
"72",
"109",
"115",
"122",
"126",
"130",
"134",
"137",
"138",
"139",
"140",
"142",
"145",
"147",
"148",
"150",
"151"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109989952/"
},
{
"category": "vendor_fix",
"details": "Update to V5.10.0 or later version",
"product_ids": [
"23",
"50",
"54",
"75",
"90",
"112",
"118",
"124",
"128",
"132",
"136",
"144",
"146"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109989952/"
},
{
"category": "vendor_fix",
"details": "Update to V5.6 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109976555/"
},
{
"category": "vendor_fix",
"details": "Update to V6.6.0 or later version",
"product_ids": [
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"233",
"234",
"235",
"236"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109996102/"
},
{
"category": "vendor_fix",
"details": "Update to V8.2 or later version",
"product_ids": [
"16",
"17",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109976047/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61",
"62",
"63",
"64",
"65",
"66",
"67",
"68",
"69",
"70",
"71",
"72",
"73",
"74",
"75",
"76",
"77",
"78",
"79",
"80",
"81",
"82",
"83",
"84",
"85",
"86",
"87",
"88",
"89",
"90",
"91",
"92",
"93",
"94",
"95",
"96",
"97",
"98",
"99",
"100",
"101",
"102",
"103",
"104",
"105",
"106",
"107",
"108",
"109",
"110",
"111",
"112",
"113",
"114",
"115",
"116",
"117",
"118",
"119",
"120",
"121",
"122",
"123",
"124",
"125",
"126",
"127",
"128",
"129",
"130",
"131",
"132",
"133",
"134",
"135",
"136",
"137",
"138",
"139",
"140",
"141",
"142",
"143",
"144",
"145",
"146",
"147",
"148",
"149",
"150",
"151",
"152",
"153",
"154",
"155",
"156",
"157",
"158",
"159",
"160",
"161",
"162",
"163",
"164",
"165",
"166",
"167",
"168",
"169",
"170",
"171",
"172",
"173",
"174",
"175",
"176",
"177",
"178",
"179",
"180",
"181",
"182",
"183",
"184",
"185",
"186",
"187",
"188",
"189",
"190",
"191",
"192",
"193",
"194",
"195",
"196",
"197",
"198",
"199",
"200",
"201",
"202",
"203",
"204",
"205",
"206",
"207",
"208",
"209",
"210",
"211",
"212",
"213",
"214",
"215",
"216",
"217",
"218",
"219",
"220",
"221",
"222",
"223",
"224",
"225",
"226",
"227",
"228",
"229",
"230",
"231",
"232",
"233",
"234",
"235",
"236",
"237",
"238",
"239",
"240",
"241",
"242",
"243",
"244",
"245",
"246",
"247",
"248",
"249",
"250",
"251",
"252",
"253",
"254",
"255",
"256",
"257",
"258",
"259",
"260",
"261",
"262",
"263",
"264",
"265",
"266",
"267",
"268",
"269",
"270",
"271",
"272",
"273",
"274",
"275",
"276",
"277",
"278",
"279",
"280",
"281",
"282",
"283",
"284",
"285",
"286",
"287",
"288",
"289",
"290",
"291",
"292",
"293",
"294",
"295",
"296",
"297",
"298",
"299",
"300",
"301",
"302",
"303",
"304",
"305",
"306",
"307",
"308",
"309",
"310",
"311",
"312",
"313",
"314",
"315",
"316",
"317",
"318",
"319",
"320",
"321",
"322",
"323",
"324",
"325",
"326",
"327",
"328",
"329",
"330",
"331",
"332",
"333",
"334",
"335",
"336",
"337",
"338",
"339",
"340",
"341",
"342",
"343",
"344",
"345",
"346",
"347",
"348",
"349",
"350",
"351",
"352",
"353",
"354",
"355",
"356",
"357",
"358",
"359",
"360",
"361",
"362",
"363",
"364",
"365",
"366",
"367",
"368",
"369",
"370",
"371",
"372",
"373",
"374",
"375",
"376",
"377",
"378",
"379",
"380",
"381",
"382",
"383",
"384",
"385",
"386",
"387",
"388",
"389",
"390",
"391",
"392",
"393",
"394",
"395",
"396",
"397",
"398",
"399",
"400",
"401",
"402",
"403",
"404",
"405",
"406",
"407",
"408",
"409",
"410",
"411",
"412",
"413",
"414",
"415",
"416",
"417",
"418",
"419",
"420",
"421",
"422",
"423",
"424",
"425",
"426",
"427",
"428",
"429",
"430",
"431",
"432",
"433",
"434",
"435",
"436",
"437",
"438",
"439",
"440",
"441",
"442",
"443",
"444",
"445",
"446",
"447",
"448",
"449",
"450",
"451",
"452",
"453",
"454",
"455",
"456",
"457",
"458",
"459",
"460",
"461",
"462",
"463",
"464",
"465",
"466",
"467",
"468",
"469",
"470",
"471",
"472",
"473",
"474",
"475",
"476",
"477",
"478",
"479",
"480",
"481",
"482",
"483",
"484",
"485",
"486",
"487",
"488",
"489",
"490",
"491",
"492",
"493",
"494",
"495",
"496",
"497"
]
}
],
"title": "CVE-2024-3596"
}
]
}
```
## [ssa-722410](https://vulnerability.circl.lu/vuln/ssa-722410)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Siemens' User Management Component (UMC) is affected by multiple vulnerabilities that could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition.\n\nSiemens has released a new version for User Management Component (UMC) and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-722410: Multiple Vulnerabilities in User Management Component (UMC) - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-722410.html"
},
{
"category": "self",
"summary": "SSA-722410: Multiple Vulnerabilities in User Management Component (UMC) - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-722410.json"
}
],
"title": "SSA-722410: Multiple Vulnerabilities in User Management Component (UMC)",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-722410",
"initial_release_date": "2025-09-09T00:00:00.000Z",
"revision_history": [
{
"date": "2025-09-09T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2025-10-14T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added SIMATIC PCS neo V6.0 as affected"
},
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added fix for SIMATIC PCS neo V6.0"
}
],
"status": "interim",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC PCS neo V4.1",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS neo V4.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC PCS neo V5.0",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS neo V5.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.0.1.1",
"product": {
"name": "SIMATIC PCS neo V6.0",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS neo V6.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<2.15.1.3",
"product": {
"name": "User Management Component (UMC)",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "User Management Component (UMC)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-40795",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "Affected products contain a stack-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4"
]
},
"remediations": [
{
"category": "mitigation",
"details": "In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).",
"product_ids": [
"1",
"2",
"3",
"4"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"2"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.15.1.3 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109991261/"
},
{
"category": "vendor_fix",
"details": "Update to V6.0 SP1 Update 1 or later version",
"product_ids": [
"3"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110000357/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4"
]
}
],
"title": "CVE-2025-40795"
},
{
"cve": "CVE-2025-40796",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4"
]
},
"remediations": [
{
"category": "mitigation",
"details": "In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).",
"product_ids": [
"1",
"2",
"3",
"4"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"2"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.15.1.3 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109991261/"
},
{
"category": "vendor_fix",
"details": "Update to V6.0 SP1 Update 1 or later version",
"product_ids": [
"3"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110000357/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4"
]
}
],
"title": "CVE-2025-40796"
},
{
"cve": "CVE-2025-40797",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4"
]
},
"remediations": [
{
"category": "mitigation",
"details": "In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).",
"product_ids": [
"1",
"2",
"3",
"4"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"2"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.15.1.3 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109991261/"
},
{
"category": "vendor_fix",
"details": "Update to V6.0 SP1 Update 1 or later version",
"product_ids": [
"3"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110000357/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4"
]
}
],
"title": "CVE-2025-40797"
},
{
"cve": "CVE-2025-40798",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4"
]
},
"remediations": [
{
"category": "mitigation",
"details": "In non-networked scenarios/deployments block TCP ports 4002 and 4004 on machines with UMC installed. If the deployment is not using the 'RT Server' type of UMC machine, port 4004 can be blocked everywhere without impacting network functionality for all other UMC machine-types (Server, Ring-Server, Agent).",
"product_ids": [
"1",
"2",
"3",
"4"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"2"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.15.1.3 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109991261/"
},
{
"category": "vendor_fix",
"details": "Update to V6.0 SP1 Update 1 or later version",
"product_ids": [
"3"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110000357/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4"
]
}
],
"title": "CVE-2025-40798"
}
]
}
```
## [ssa-693808](https://vulnerability.circl.lu/vuln/ssa-693808)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Affected products do not properly restrict access permissions to a local Windows Named Pipe and do not properly sanitize user-controllable input sent to that Named Pipe. This could allow a local authenticated attacker to cause a type confusion and execute arbitrary code within the affected application and its privileges.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-693808.html"
},
{
"category": "self",
"summary": "SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-693808.json"
}
],
"title": "SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-693808",
"initial_release_date": "2025-08-12T00:00:00.000Z",
"revision_history": [
{
"date": "2025-08-12T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2025-10-14T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added no fix expected for PCS neo V5.0, added fix for TIA Portal V20"
},
{
"date": "2025-12-09T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added fix for Totally Integrated Automation Portal (TIA Portal) V17"
},
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added fix for SIMATIC PCS NEO V6.0"
}
],
"status": "interim",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC PCS neo V4.1",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS neo V4.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC PCS neo V5.0",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS neo V5.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.0.1.1",
"product": {
"name": "SIMATIC PCS neo V6.0",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "SIMATIC PCS neo V6.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC S7-PLCSIM V17",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-PLCSIM V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<17.0.9",
"product": {
"name": "SIMATIC STEP 7 V17",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "SIMATIC STEP 7 V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC STEP 7 V18",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "SIMATIC STEP 7 V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<19.0.4",
"product": {
"name": "SIMATIC STEP 7 V19",
"product_id": "7"
}
}
],
"category": "product_name",
"name": "SIMATIC STEP 7 V19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<20.0.4",
"product": {
"name": "SIMATIC STEP 7 V20",
"product_id": "8"
}
}
],
"category": "product_name",
"name": "SIMATIC STEP 7 V20"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<17.0.9",
"product": {
"name": "SIMATIC WinCC V17",
"product_id": "9"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC V18",
"product_id": "10"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<19.0.4",
"product": {
"name": "SIMATIC WinCC V19",
"product_id": "11"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<20.0.4",
"product": {
"name": "SIMATIC WinCC V20",
"product_id": "12"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC V20"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMOCODE ES V17",
"product_id": "13"
}
}
],
"category": "product_name",
"name": "SIMOCODE ES V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMOCODE ES V18",
"product_id": "14"
}
}
],
"category": "product_name",
"name": "SIMOCODE ES V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMOCODE ES V19",
"product_id": "15"
}
}
],
"category": "product_name",
"name": "SIMOCODE ES V19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMOCODE ES V20",
"product_id": "16"
}
}
],
"category": "product_name",
"name": "SIMOCODE ES V20"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMOTION SCOUT TIA V5.4",
"product_id": "17"
}
}
],
"category": "product_name",
"name": "SIMOTION SCOUT TIA V5.4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMOTION SCOUT TIA V5.5",
"product_id": "18"
}
}
],
"category": "product_name",
"name": "SIMOTION SCOUT TIA V5.5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.6.1.7",
"product": {
"name": "SIMOTION SCOUT TIA V5.6",
"product_id": "19"
}
}
],
"category": "product_name",
"name": "SIMOTION SCOUT TIA V5.6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMOTION SCOUT TIA V5.7",
"product_id": "20"
}
}
],
"category": "product_name",
"name": "SIMOTION SCOUT TIA V5.7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS Startdrive V17",
"product_id": "21"
}
}
],
"category": "product_name",
"name": "SINAMICS Startdrive V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS Startdrive V18",
"product_id": "22"
}
}
],
"category": "product_name",
"name": "SINAMICS Startdrive V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS Startdrive V19",
"product_id": "23"
}
}
],
"category": "product_name",
"name": "SINAMICS Startdrive V19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SINAMICS Startdrive V20",
"product_id": "24"
}
}
],
"category": "product_name",
"name": "SINAMICS Startdrive V20"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIRIUS Safety ES V17 (TIA Portal)",
"product_id": "25"
}
}
],
"category": "product_name",
"name": "SIRIUS Safety ES V17 (TIA Portal)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIRIUS Safety ES V18 (TIA Portal)",
"product_id": "26"
}
}
],
"category": "product_name",
"name": "SIRIUS Safety ES V18 (TIA Portal)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIRIUS Safety ES V19 (TIA Portal)",
"product_id": "27"
}
}
],
"category": "product_name",
"name": "SIRIUS Safety ES V19 (TIA Portal)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIRIUS Safety ES V20 (TIA Portal)",
"product_id": "28"
}
}
],
"category": "product_name",
"name": "SIRIUS Safety ES V20 (TIA Portal)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIRIUS Soft Starter ES V17 (TIA Portal)",
"product_id": "29"
}
}
],
"category": "product_name",
"name": "SIRIUS Soft Starter ES V17 (TIA Portal)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIRIUS Soft Starter ES V18 (TIA Portal)",
"product_id": "30"
}
}
],
"category": "product_name",
"name": "SIRIUS Soft Starter ES V18 (TIA Portal)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIRIUS Soft Starter ES V19 (TIA Portal)",
"product_id": "31"
}
}
],
"category": "product_name",
"name": "SIRIUS Soft Starter ES V19 (TIA Portal)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIRIUS Soft Starter ES V20 (TIA Portal)",
"product_id": "32"
}
}
],
"category": "product_name",
"name": "SIRIUS Soft Starter ES V20 (TIA Portal)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "TIA Portal Cloud V17",
"product_id": "33"
}
}
],
"category": "product_name",
"name": "TIA Portal Cloud V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "TIA Portal Cloud V18",
"product_id": "34"
}
}
],
"category": "product_name",
"name": "TIA Portal Cloud V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.2.1.1",
"product": {
"name": "TIA Portal Cloud V19",
"product_id": "35"
}
}
],
"category": "product_name",
"name": "TIA Portal Cloud V19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<5.2.2.2",
"product": {
"name": "TIA Portal Cloud V20",
"product_id": "36"
}
}
],
"category": "product_name",
"name": "TIA Portal Cloud V20"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<20.0.4",
"product": {
"name": "TIA Portal Test Suite V20",
"product_id": "37"
}
}
],
"category": "product_name",
"name": "TIA Portal Test Suite V20"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-54678",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "summary",
"text": "Affected products do not properly sanitize Interprocess Communication input received through a Windows Named Pipe accessible to all local users. This could allow an authenticated local attacker to cause a type confusion and execute arbitrary code within the affected application.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37"
]
},
"remediations": [
{
"category": "mitigation",
"details": "On Desktop systems: Execute affected software on Windows hosts where only a single user is configured",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37"
]
},
{
"category": "mitigation",
"details": "On Server systems: Reduce the access on operating system level to administrators only",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"2",
"4"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"6",
"10",
"13",
"15",
"16",
"20",
"23",
"24",
"25",
"27",
"28",
"29",
"31",
"32",
"33",
"34"
]
},
{
"category": "vendor_fix",
"details": "Update to V17 Update 9 or later version",
"product_ids": [
"5",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109784441/"
},
{
"category": "vendor_fix",
"details": "Update to V19 Update 4 or later version",
"product_ids": [
"7",
"11"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109925643/"
},
{
"category": "vendor_fix",
"details": "Update to V20 Update 4 or later version",
"product_ids": [
"8",
"12",
"37"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109963851/"
},
{
"category": "vendor_fix",
"details": "Update to V5.6 SP1 HF7 or later version",
"product_ids": [
"19"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109989067/"
},
{
"category": "vendor_fix",
"details": "Update to V6.0 SP1 Update 1 or later version",
"product_ids": [
"3"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110000357/"
},
{
"category": "vendor_fix",
"details": "https://support.industry.siemens.com/cs/ww/en/view/109817218/",
"product_ids": [
"14",
"18",
"22",
"26",
"30"
]
},
{
"category": "vendor_fix",
"details": "https://support.industry.siemens.com/cs/ww/en/view/109784441/",
"product_ids": [
"17",
"21"
]
},
{
"category": "vendor_fix",
"details": "Fixed with V5.2.1.1, no user action required",
"product_ids": [
"35"
]
},
{
"category": "vendor_fix",
"details": "Fixed with V5.2.2.2, no user action required",
"product_ids": [
"36"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37"
]
}
],
"title": "CVE-2024-54678"
}
]
}
```
## [ssa-674753](https://vulnerability.circl.lu/vuln/ssa-674753)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Siemens ET 200 devices contain a denial-of-service vulnerability that could be triggered by sending a valid S7 protocol Disconnect Request (COTP DR TPDU), causing the device to become unresponsive and require a power cycle to recover.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-674753: Denial-of-Service Vulnerability in ET 200 Devices - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-674753.html"
},
{
"category": "self",
"summary": "SSA-674753: Denial-of-Service Vulnerability in ET 200 Devices - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-674753.json"
}
],
"title": "SSA-674753: Denial-of-Service Vulnerability in ET 200 Devices",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-674753",
"initial_release_date": "2026-01-13T00:00:00.000Z",
"revision_history": [
{
"date": "2026-01-13T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2026-02-10T00:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added Researcher to Acknowledgements"
},
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added fix for SIMATIC ET 200SP IM 155-6 PN/2 HF"
}
],
"status": "interim",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0)",
"product_id": "1",
"product_identification_helper": {
"model_numbers": [
"6ES7157-1AB00-0AB0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0",
"product": {
"name": "SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0)",
"product_id": "2",
"product_identification_helper": {
"model_numbers": [
"6ES7155-5AA00-0AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0)",
"product_id": "3",
"product_identification_helper": {
"model_numbers": [
"6ES7155-6MU00-0CN0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<1.3",
"product": {
"name": "SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.0.1",
"product": {
"name": "SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0)",
"product_id": "5",
"product_identification_helper": {
"model_numbers": [
"6ES7155-6AU00-0HM0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0|<4.2.5",
"product": {
"name": "SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0)",
"product_id": "6",
"product_identification_helper": {
"model_numbers": [
"6ES7155-6AU01-0CN0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.2.2",
"product": {
"name": "SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0)",
"product_id": "7",
"product_identification_helper": {
"model_numbers": [
"6ES7155-6AU30-0CN0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0)",
"product_id": "8",
"product_identification_helper": {
"model_numbers": [
"6ES7158-3MU10-0XA0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.0.0",
"product": {
"name": "SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0)",
"product_id": "9",
"product_identification_helper": {
"model_numbers": [
"6ES7158-3AD10-0XA0"
]
}
}
}
],
"category": "product_name",
"name": "SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0",
"product": {
"name": "SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0)",
"product_id": "10",
"product_identification_helper": {
"model_numbers": [
"6AG1155-5AA00-2AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0",
"product": {
"name": "SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0)",
"product_id": "11",
"product_identification_helper": {
"model_numbers": [
"6AG1155-5AA00-7AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0",
"product": {
"name": "SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0)",
"product_id": "12",
"product_identification_helper": {
"model_numbers": [
"6AG2155-5AA00-1AC0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0|<4.2.5",
"product": {
"name": "SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0)",
"product_id": "13",
"product_identification_helper": {
"model_numbers": [
"6AG1155-6AU01-2CN0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0|<4.2.5",
"product": {
"name": "SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0)",
"product_id": "14",
"product_identification_helper": {
"model_numbers": [
"6AG1155-6AU01-7CN0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0|<4.2.5",
"product": {
"name": "SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0)",
"product_id": "15",
"product_identification_helper": {
"model_numbers": [
"6AG2155-6AU01-1CN0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/>=4.2.0|<4.2.5",
"product": {
"name": "SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0)",
"product_id": "16",
"product_identification_helper": {
"model_numbers": [
"6AG2155-6AU01-4CN0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<6.0.0",
"product": {
"name": "SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0)",
"product_id": "17",
"product_identification_helper": {
"model_numbers": [
"6AG2158-3AD10-4XA0"
]
}
}
}
],
"category": "product_name",
"name": "SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-40944",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "summary",
"text": "Affected devices do not properly handle S7 protocol session disconnect requests. When receiving a valid S7 protocol Disconnect Request (COTP DR TPDU) on TCP port 102, the devices enter an improper session state.\r\n\r\nThis could allow an attacker to cause the device to become unresponsive, leading to a denial-of-service condition that requires a power cycle to restore normal operation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Filter the port 102 of the devices to only accepted connections to/from the IP addresses of machines that are trusted e.g. with an external firewall.",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17"
]
},
{
"category": "mitigation",
"details": "Restrict access to the network where S7 communication messages are exchanged.",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"2",
"3",
"8",
"10",
"11",
"12"
]
},
{
"category": "vendor_fix",
"details": "Update to V1.3 or later version",
"product_ids": [
"4"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109987451/"
},
{
"category": "vendor_fix",
"details": "Update to V4.2.2 or later version",
"product_ids": [
"7"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109769419/"
},
{
"category": "vendor_fix",
"details": "Update to V4.2.5 or later version",
"product_ids": [
"6",
"13",
"14",
"15",
"16"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109769765/"
},
{
"category": "vendor_fix",
"details": "Update to V6.0.0 or later version",
"product_ids": [
"9",
"17"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109760973/"
},
{
"category": "vendor_fix",
"details": "Update to V6.0.1 or later version",
"product_ids": [
"5"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109816000/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17"
]
}
],
"title": "CVE-2025-40944"
}
]
}
```
## [ssa-139483](https://vulnerability.circl.lu/vuln/ssa-139483)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SIPROTEC 5 is vulnerable to arbitrary file uploads by authenticated users using the DIGSI 5 protocol.\nThis could allow an attacker to upload malicious configuration files, potentially causing a permanent denial of service condition.\n\nAs a mitigation measure, users of the CP050 and CP150 device models are advised to upgrade to version 9.90 or later. For CP300 device models, devices 7ST85 and 7ST86 are advised to upgrade to version 10.00 or later, while the remaining models should upgrade to version 9.90 or later. These versions introduce an allow-list feature that restricts arbitrary file uploads and reduces the risk associated with this vulnerability.\n\nSiemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\nhttps://www.siemens.com/gridsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-139483: File Upload Vulnerability in SIPROTEC 5 Using DIGSI5 Protocol - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-139483.html"
},
{
"category": "self",
"summary": "SSA-139483: File Upload Vulnerability in SIPROTEC 5 Using DIGSI5 Protocol - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-139483.json"
}
],
"title": "SSA-139483: File Upload Vulnerability in SIPROTEC 5 Using DIGSI5 Protocol",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-139483",
"initial_release_date": "2026-06-09T00:00:00.000Z",
"revision_history": [
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 6MD84 (CP300)",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD84 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 6MD85 (CP200)",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD85 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 6MD85 (CP300)",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 6MD86 (CP200)",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD86 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 6MD86 (CP300)",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 6MD89 (CP300)",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MD89 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 6MU85 (CP300)",
"product_id": "7"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 6MU85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7KE85 (CP200)",
"product_id": "8"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7KE85 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7KE85 (CP300)",
"product_id": "9"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7KE85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SA82 (CP100)",
"product_id": "10"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SA82 (CP150)",
"product_id": "11"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SA86 (CP200)",
"product_id": "12"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA86 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SA86 (CP300)",
"product_id": "13"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SA87 (CP200)",
"product_id": "14"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA87 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SA87 (CP300)",
"product_id": "15"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SA87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SD82 (CP100)",
"product_id": "16"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SD82 (CP150)",
"product_id": "17"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SD86 (CP200)",
"product_id": "18"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD86 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SD86 (CP300)",
"product_id": "19"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SD87 (CP200)",
"product_id": "20"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD87 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SD87 (CP300)",
"product_id": "21"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SD87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SJ81 (CP100)",
"product_id": "22"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ81 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SJ81 (CP150)",
"product_id": "23"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ81 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SJ82 (CP100)",
"product_id": "24"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SJ82 (CP150)",
"product_id": "25"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SJ85 (CP200)",
"product_id": "26"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ85 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SJ85 (CP300)",
"product_id": "27"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SJ86 (CP200)",
"product_id": "28"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ86 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SJ86 (CP300)",
"product_id": "29"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SJ86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SK82 (CP100)",
"product_id": "30"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SK82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SK82 (CP150)",
"product_id": "31"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SK82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SK85 (CP200)",
"product_id": "32"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SK85 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SK85 (CP300)",
"product_id": "33"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SK85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SL82 (CP100)",
"product_id": "34"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SL82 (CP150)",
"product_id": "35"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SL86 (CP200)",
"product_id": "36"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL86 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SL86 (CP300)",
"product_id": "37"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SL87 (CP200)",
"product_id": "38"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL87 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SL87 (CP300)",
"product_id": "39"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SL87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SS85 (CP200)",
"product_id": "40"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SS85 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SS85 (CP300)",
"product_id": "41"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SS85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7ST85 (CP200)",
"product_id": "42"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7ST85 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7ST85 (CP300)",
"product_id": "43"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7ST85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7ST86 (CP300)",
"product_id": "44"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7ST86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SX82 (CP150)",
"product_id": "45"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SX82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SX85 (CP300)",
"product_id": "46"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SX85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7SY82 (CP150)",
"product_id": "47"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7SY82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UM85 (CP300)",
"product_id": "48"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UM85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UT82 (CP100)",
"product_id": "49"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT82 (CP100)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UT82 (CP150)",
"product_id": "50"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT82 (CP150)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UT85 (CP200)",
"product_id": "51"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT85 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UT85 (CP300)",
"product_id": "52"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UT86 (CP200)",
"product_id": "53"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT86 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UT86 (CP300)",
"product_id": "54"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT86 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UT87 (CP200)",
"product_id": "55"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT87 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7UT87 (CP300)",
"product_id": "56"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7UT87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7VE85 (CP300)",
"product_id": "57"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7VE85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7VK87 (CP200)",
"product_id": "58"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7VK87 (CP200)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7VK87 (CP300)",
"product_id": "59"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7VK87 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 7VU85 (CP300)",
"product_id": "60"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 7VU85 (CP300)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIPROTEC 5 Compact 7SX800 (CP050)",
"product_id": "61"
}
}
],
"category": "product_name",
"name": "SIPROTEC 5 Compact 7SX800 (CP050)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-40808",
"cwe": {
"id": "CWE-434",
"name": "Unrestricted Upload of File with Dangerous Type"
},
"notes": [
{
"category": "summary",
"text": "The affected application allows authenticated users to upload arbitrary files using DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, that could cause denial of service condition and potentially lead to code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61"
]
},
"remediations": [
{
"category": "mitigation",
"details": "
\nUsers are advised to upgrade to V9.90 or later, which introduces an allow-list feature that restricts arbitrary file uploads",
"product_ids": [
"1",
"3",
"5",
"6",
"7",
"9",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27",
"29",
"31",
"33",
"35",
"37",
"39",
"41",
"45",
"46",
"47",
"48",
"50",
"52",
"54",
"56",
"57",
"59",
"60",
"61"
]
},
{
"category": "mitigation",
"details": "Apply password protection to all DIGSI connections to ensure secure communication",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61"
]
},
{
"category": "mitigation",
"details": "For DIGSI access provision your own certificates signed by your customer PKI as described in https://support.industry.siemens.com/cs/document/109768375",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61"
]
},
{
"category": "mitigation",
"details": "For the available devices [CP050, CP100, CP150 and CP300] , activate role based access control (RBAC) in the device (supported in SIPROTEC 5 firmware versions V7.80 and higher)",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61"
]
},
{
"category": "mitigation",
"details": "Users are advised to upgrade to V10.00 or later, which introduces an allow-list feature that restricts arbitrary file uploads",
"product_ids": [
"43",
"44"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"2",
"4",
"8",
"10",
"12",
"14",
"16",
"18",
"20",
"22",
"24",
"26",
"28",
"30",
"32",
"34",
"36",
"38",
"40",
"42",
"49",
"51",
"53",
"55",
"58"
]
},
{
"category": "none_available",
"details": "Currently no fix is available",
"product_ids": [
"1",
"3",
"5",
"6",
"7",
"9",
"11",
"13",
"15",
"17",
"19",
"21",
"23",
"25",
"27",
"29",
"31",
"33",
"35",
"37",
"39",
"41",
"43",
"44",
"45",
"46",
"47",
"48",
"50",
"52",
"54",
"56",
"57",
"59",
"60",
"61"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20",
"21",
"22",
"23",
"24",
"25",
"26",
"27",
"28",
"29",
"30",
"31",
"32",
"33",
"34",
"35",
"36",
"37",
"38",
"39",
"40",
"41",
"42",
"43",
"44",
"45",
"46",
"47",
"48",
"49",
"50",
"51",
"52",
"53",
"54",
"55",
"56",
"57",
"58",
"59",
"60",
"61"
]
}
],
"title": "CVE-2025-40808"
}
]
}
```
## [ssa-063511](https://vulnerability.circl.lu/vuln/ssa-063511)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "WinCC Certificate Manager insufficiently protects key material that could allow an attacker to extract sensitive information.\n\nSiemens has released a new version for SIMATIC WinCC Unified PC Runtime V21 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-063511: Insufficient protection of key material in WinCC Certificate Manager - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-063511.html"
},
{
"category": "self",
"summary": "SSA-063511: Insufficient protection of key material in WinCC Certificate Manager - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-063511.json"
}
],
"title": "SSA-063511: Insufficient protection of key material in WinCC Certificate Manager",
"tracking": {
"current_release_date": "2026-06-09T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-063511",
"initial_release_date": "2026-06-09T00:00:00.000Z",
"revision_history": [
{
"date": "2026-06-09T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC Unified PC Runtime V16",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Unified PC Runtime V16"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC Unified PC Runtime V17",
"product_id": "2"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Unified PC Runtime V17"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC Unified PC Runtime V18",
"product_id": "3"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Unified PC Runtime V18"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC Unified PC Runtime V19",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Unified PC Runtime V19"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "SIMATIC WinCC Unified PC Runtime V20",
"product_id": "5"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Unified PC Runtime V20"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<21.0.2",
"product": {
"name": "SIMATIC WinCC Unified PC Runtime V21",
"product_id": "6"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC Unified PC Runtime V21"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-24349",
"cwe": {
"id": "CWE-313",
"name": "Cleartext Storage in a File or on Disk"
},
"notes": [
{
"category": "summary",
"text": "Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6"
]
},
"remediations": [
{
"category": "mitigation",
"details": "The affected product may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with the affected product.",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6"
]
},
{
"category": "no_fix_planned",
"details": "Currently no fix is planned",
"product_ids": [
"1",
"2",
"3",
"4",
"5"
]
},
{
"category": "vendor_fix",
"details": "Update to V21 Update 2 or later version",
"product_ids": [
"6"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109991140/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6"
]
}
],
"title": "CVE-2026-24349"
}
]
}
```
## [ssa-253495](https://vulnerability.circl.lu/vuln/ssa-253495)
```json
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SINEC OS before V4.0 contains multiple vulnerabilities.\n\nSiemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"category": "self",
"summary": "SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-253495.json"
}
],
"title": "SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0",
"tracking": {
"current_release_date": "2026-06-02T00:00:00.000Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-253495",
"initial_release_date": "2026-06-02T00:00:00.000Z",
"revision_history": [
{
"date": "2026-06-02T00:00:00.000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/<4.0",
"product": {
"name": "RUGGEDCOM RST2428P (6GK6242-6PA00)",
"product_id": "1",
"product_identification_helper": {
"model_numbers": [
"6GK6242-6PA00"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RST2428P (6GK6242-6PA00)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-1352",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-1352"
},
{
"cve": "CVE-2025-1376",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-1376"
},
{
"cve": "CVE-2025-6052",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-6052"
},
{
"cve": "CVE-2025-6141",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-6141"
},
{
"cve": "CVE-2025-6170",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-6170"
},
{
"cve": "CVE-2025-7039",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-7039"
},
{
"cve": "CVE-2025-8732",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that \"[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all.\"",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-8732"
},
{
"cve": "CVE-2025-9086",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "1. A cookie is set using the `secure` keyword for `https://target` \n 2. curl is redirected to or otherwise made to speak with `http://target` (same \n hostname, but using clear text HTTP) using the same cookie set \n 3. The same cookie name is set - but with just a slash as path (`path=\\\"/\\\",`).\n Since this site is not secure, the cookie *should* just be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-9086"
},
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-9230"
},
{
"cve": "CVE-2025-9231",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"notes": [
{
"category": "summary",
"text": "Issue summary: A timing side-channel which could potentially allow remote\nrecovery of the private key exists in the SM2 algorithm implementation on 64 bit\nARM platforms.\n\nImpact summary: A timing side-channel in SM2 signature computations on 64 bit\nARM platforms could allow recovering the private key by an attacker..\n\nWhile remote key recovery over a network was not attempted by the reporter,\ntiming measurements revealed a timing signal which may allow such an attack.\n\nOpenSSL does not directly support certificates with SM2 keys in TLS, and so\nthis CVE is not relevant in most TLS contexts. However, given that it is\npossible to add support for such certificates via a custom provider, coupled\nwith the fact that in such a custom provider context the private key may be\nrecoverable via remote timing measurements, we consider this to be a Moderate\nseverity issue.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as SM2 is not an approved algorithm.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-9231"
},
{
"cve": "CVE-2025-9232",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-9232"
},
{
"cve": "CVE-2025-10966",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-10966"
},
{
"cve": "CVE-2025-13465",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
},
"notes": [
{
"category": "summary",
"text": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\r\n\r\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\r\n\r\nThis issue is patched on 4.17.23",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-13465"
},
{
"cve": "CVE-2025-13601",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-13601"
},
{
"cve": "CVE-2025-39913",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.\n\nsyzbot reported the splat below. [0]\n\nThe repro does the following:\n\n 1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes)\n 2. Attach the prog to a SOCKMAP\n 3. Add a socket to the SOCKMAP\n 4. Activate fault injection\n 5. Send data less than cork_bytes\n\nAt 5., the data is carried over to the next sendmsg() as it is\nsmaller than the cork_bytes specified by bpf_msg_cork_bytes().\n\nThen, tcp_bpf_send_verdict() tries to allocate psock->cork to hold\nthe data, but this fails silently due to fault injection + __GFP_NOWARN.\n\nIf the allocation fails, we need to revert the sk->sk_forward_alloc\nchange done by sk_msg_alloc().\n\nLet's call sk_msg_free() when tcp_bpf_send_verdict fails to allocate\npsock->cork.\n\nThe \"*copied\" also needs to be updated such that a proper error can\nbe returned to the caller, sendmsg. It fails to allocate psock->cork.\nNothing has been corked so far, so this patch simply sets \"*copied\"\nto 0.\n\n[0]:\nWARNING: net/ipv4/af_inet.c:156 at inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156, CPU#1: syz-executor/5983\nModules linked in:\nCPU: 1 UID: 0 PID: 5983 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156\nCode: 0f 0b 90 e9 62 fe ff ff e8 7a db b5 f7 90 0f 0b 90 e9 95 fe ff ff e8 6c db b5 f7 90 0f 0b 90 e9 bb fe ff ff e8 5e db b5 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc\nRSP: 0018:ffffc90000a08b48 EFLAGS: 00010246\nRAX: ffffffff8a09d0b2 RBX: dffffc0000000000 RCX: ffff888024a23c80\nRDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000\nRBP: 0000000000000fff R08: ffff88807e07c627 R09: 1ffff1100fc0f8c4\nR10: dffffc0000000000 R11: ffffed100fc0f8c5 R12: ffff88807e07c380\nR13: dffffc0000000000 R14: ffff88807e07c60c R15: 1ffff1100fc0f872\nFS: 00005555604c4500(0000) GS:ffff888125af1000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005555604df5c8 CR3: 0000000032b06000 CR4: 00000000003526f0\nCall Trace:\n \n __sk_destruct+0x86/0x660 net/core/sock.c:2339\n rcu_do_batch kernel/rcu/tree.c:2605 [inline]\n rcu_core+0xca8/0x1770 kernel/rcu/tree.c:2861\n handle_softirqs+0x286/0x870 kernel/softirq.c:579\n __do_softirq kernel/softirq.c:613 [inline]\n invoke_softirq kernel/softirq.c:453 [inline]\n __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680\n irq_exit_rcu+0x9/0x30 kernel/softirq.c:696\n instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]\n sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052\n ",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-39913"
},
{
"cve": "CVE-2025-40214",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\naf_unix: Initialise scc_index in unix_add_edge().\r\n\r\nQuang Le reported that the AF_UNIX GC could garbage-collect a\r\nreceive queue of an alive in-flight socket, with a nice repro.\r\n\r\nThe repro consists of three stages.\r\n\r\n 1)\r\n 1-a. Create a single cyclic reference with many sockets\r\n 1-b. close() all sockets\r\n 1-c. Trigger GC\r\n\r\n 2)\r\n 2-a. Pass sk-A to an embryo sk-B\r\n 2-b. Pass sk-X to sk-X\r\n 2-c. Trigger GC\r\n\r\n 3)\r\n 3-a. accept() the embryo sk-B\r\n 3-b. Pass sk-B to sk-C\r\n 3-c. close() the in-flight sk-A\r\n 3-d. Trigger GC\r\n\r\nAs of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,\r\nand unix_walk_scc() groups them into two different SCCs:\r\n\r\n unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)\r\n unix_sk(sk-X)->vertex->scc_index = 3\r\n\r\nOnce GC completes, unix_graph_grouped is set to true.\r\nAlso, unix_graph_maybe_cyclic is set to true due to sk-X's\r\ncyclic self-reference, which makes close() trigger GC.\r\n\r\nAt 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and\r\nlinks it to unix_unvisited_vertices.\r\n\r\nunix_update_graph() is called at 3-a. and 3-b., but neither\r\nunix_graph_grouped nor unix_graph_maybe_cyclic is changed\r\nbecause both sk-B's listener and sk-C are not in-flight.\r\n\r\n3-c decrements sk-A's file refcnt to 1.\r\n\r\nSince unix_graph_grouped is true at 3-d, unix_walk_scc_fast()\r\nis finally called and iterates 3 sockets sk-A, sk-B, and sk-X:\r\n\r\n sk-A -> sk-B (-> sk-C)\r\n sk-X -> sk-X\r\n\r\nThis is totally fine. All of them are not yet close()d and\r\nshould be grouped into different SCCs.\r\n\r\nHowever, unix_vertex_dead() misjudges that sk-A and sk-B are\r\nin the same SCC and sk-A is dead.\r\n\r\n unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong!\r\n &&\r\n sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree\r\n ^-- 1 in-flight count for sk-B\r\n -> sk-A is dead !?\r\n\r\nThe problem is that unix_add_edge() does not initialise scc_index.\r\n\r\nStage 1) is used for heap spraying, making a newly allocated\r\nvertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START)\r\nset by unix_walk_scc() at 1-c.\r\n\r\nLet's track the max SCC index from the previous unix_walk_scc()\r\ncall and assign the max + 1 to a new vertex's scc_index.\r\n\r\nThis way, we can continue to avoid Tarjan's algorithm while\r\npreventing misjudgments.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40214"
},
{
"cve": "CVE-2025-40248",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvsock: Ignore signal/timeout on connect() if already established\r\n\r\nDuring connect(), acting on a signal/timeout by disconnecting an already\r\nestablished socket leads to several issues:\r\n\r\n1. connect() invoking vsock_transport_cancel_pkt() ->\r\n virtio_transport_purge_skbs() may race with sendmsg() invoking\r\n virtio_transport_get_credit(). This results in a permanently elevated\r\n `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.\r\n\r\n2. connect() resetting a connected socket's state may race with socket\r\n being placed in a sockmap. A disconnected socket remaining in a sockmap\r\n breaks sockmap's assumptions. And gives rise to WARNs.\r\n\r\n3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a\r\n transport change/drop after TCP_ESTABLISHED. Which poses a problem for\r\n any simultaneous sendmsg() or connect() and may result in a\r\n use-after-free/null-ptr-deref.\r\n\r\nDo not disconnect socket on signal/timeout. Keep the logic for unconnected\r\nsockets: they don't linger, can't be placed in a sockmap, are rejected by\r\nsendmsg().",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40248"
},
{
"cve": "CVE-2025-40250",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/mlx5: Clean up only new IRQ glue on request_irq() failure\r\n\r\nThe mlx5_irq_alloc() function can inadvertently free the entire rmap\r\nand end up in a crash[1] when the other threads tries to access this,\r\nwhen request_irq() fails due to exhausted IRQ vectors. This commit\r\nmodifies the cleanup to remove only the specific IRQ mapping that was\r\njust added.\r\n\r\nThis prevents removal of other valid mappings and ensures precise\r\ncleanup of the failed IRQ allocation's associated glue object.\r\n\r\nNote: This error is observed when both fwctl and rds configs are enabled.\r\n\r\n[1]\r\nmlx5_core 0000:05:00.0: Successfully registered panic handler for port 1\r\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\r\nrequest irq. err = -28\r\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\r\ntrying to test write-combining support\r\nmlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1\r\nmlx5_core 0000:06:00.0: Successfully registered panic handler for port 1\r\nmlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\r\nrequest irq. err = -28\r\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\r\ntrying to test write-combining support\r\nmlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1\r\nmlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\r\nrequest irq. err = -28\r\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\r\nrequest irq. err = -28\r\ngeneral protection fault, probably for non-canonical address\r\n0xe277a58fde16f291: 0000 [#1] SMP NOPTI\r\n\r\nRIP: 0010:free_irq_cpu_rmap+0x23/0x7d\r\nCall Trace:\r\n \r\n ? show_trace_log_lvl+0x1d6/0x2f9\r\n ? show_trace_log_lvl+0x1d6/0x2f9\r\n ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\r\n ? __die_body.cold+0x8/0xa\r\n ? die_addr+0x39/0x53\r\n ? exc_general_protection+0x1c4/0x3e9\r\n ? dev_vprintk_emit+0x5f/0x90\r\n ? asm_exc_general_protection+0x22/0x27\r\n ? free_irq_cpu_rmap+0x23/0x7d\r\n mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\r\n irq_pool_request_vector+0x7d/0x90 [mlx5_core]\r\n mlx5_irq_request+0x2e/0xe0 [mlx5_core]\r\n mlx5_irq_request_vector+0xad/0xf7 [mlx5_core]\r\n comp_irq_request_pci+0x64/0xf0 [mlx5_core]\r\n create_comp_eq+0x71/0x385 [mlx5_core]\r\n ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core]\r\n mlx5_comp_eqn_get+0x72/0x90 [mlx5_core]\r\n ? xas_load+0x8/0x91\r\n mlx5_comp_irqn_get+0x40/0x90 [mlx5_core]\r\n mlx5e_open_channel+0x7d/0x3c7 [mlx5_core]\r\n mlx5e_open_channels+0xad/0x250 [mlx5_core]\r\n mlx5e_open_locked+0x3e/0x110 [mlx5_core]\r\n mlx5e_open+0x23/0x70 [mlx5_core]\r\n __dev_open+0xf1/0x1a5\r\n __dev_change_flags+0x1e1/0x249\r\n dev_change_flags+0x21/0x5c\r\n do_setlink+0x28b/0xcc4\r\n ? __nla_parse+0x22/0x3d\r\n ? inet6_validate_link_af+0x6b/0x108\r\n ? cpumask_next+0x1f/0x35\r\n ? __snmp6_fill_stats64.constprop.0+0x66/0x107\r\n ? __nla_validate_parse+0x48/0x1e6\r\n __rtnl_newlink+0x5ff/0xa57\r\n ? kmem_cache_alloc_trace+0x164/0x2ce\r\n rtnl_newlink+0x44/0x6e\r\n rtnetlink_rcv_msg+0x2bb/0x362\r\n ? __netlink_sendskb+0x4c/0x6c\r\n ? netlink_unicast+0x28f/0x2ce\r\n ? rtnl_calcit.isra.0+0x150/0x146\r\n netlink_rcv_skb+0x5f/0x112\r\n netlink_unicast+0x213/0x2ce\r\n netlink_sendmsg+0x24f/0x4d9\r\n __sock_sendmsg+0x65/0x6a\r\n ____sys_sendmsg+0x28f/0x2c9\r\n ? import_iovec+0x17/0x2b\r\n ___sys_sendmsg+0x97/0xe0\r\n __sys_sendmsg+0x81/0xd8\r\n do_syscall_64+0x35/0x87\r\n entry_SYSCALL_64_after_hwframe+0x6e/0x0\r\nRIP: 0033:0x7fc328603727\r\nCode: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed\r\nff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00\r\nf0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48\r\nRSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\r\nRAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727\r\nRDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d\r\nRBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000\r\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\r\nR13: 00000000000\r\n---truncated---",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40250"
},
{
"cve": "CVE-2025-40251",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndevlink: rate: Unset parent pointer in devl_rate_nodes_destroy\r\n\r\nThe function devl_rate_nodes_destroy is documented to \"Unset parent for\r\nall rate objects\". However, it was only calling the driver-specific\r\n`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing\r\nthe parent's refcount, without actually setting the\r\n`devlink_rate->parent` pointer to NULL.\r\n\r\nThis leaves a dangling pointer in the `devlink_rate` struct, which cause\r\nrefcount error in netdevsim[1] and mlx5[2]. In addition, this is\r\ninconsistent with the behavior of `devlink_nl_rate_parent_node_set`,\r\nwhere the parent pointer is correctly cleared.\r\n\r\nThis patch fixes the issue by explicitly setting `devlink_rate->parent`\r\nto NULL after notifying the driver, thus fulfilling the function's\r\ndocumented behavior for all rate objects.\r\n\r\n[1]\r\nrepro steps:\r\necho 1 > /sys/bus/netdevsim/new_device\r\ndevlink dev eswitch set netdevsim/netdevsim1 mode switchdev\r\necho 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs\r\ndevlink port function rate add netdevsim/netdevsim1/test_node\r\ndevlink port function rate set netdevsim/netdevsim1/128 parent test_node\r\necho 1 > /sys/bus/netdevsim/del_device\r\n\r\ndmesg:\r\nrefcount_t: decrement hit 0; leaking memory.\r\nWARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\r\nCPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE\r\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\r\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\r\nCall Trace:\r\n \r\n devl_rate_leaf_destroy+0x8d/0x90\r\n __nsim_dev_port_del+0x6c/0x70 [netdevsim]\r\n nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]\r\n nsim_drv_remove+0x2b/0xb0 [netdevsim]\r\n device_release_driver_internal+0x194/0x1f0\r\n bus_remove_device+0xc6/0x130\r\n device_del+0x159/0x3c0\r\n device_unregister+0x1a/0x60\r\n del_device_store+0x111/0x170 [netdevsim]\r\n kernfs_fop_write_iter+0x12e/0x1e0\r\n vfs_write+0x215/0x3d0\r\n ksys_write+0x5f/0xd0\r\n do_syscall_64+0x55/0x10f0\r\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\r\n\r\n[2]\r\ndevlink dev eswitch set pci/0000:08:00.0 mode switchdev\r\ndevlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000\r\ndevlink port function rate add pci/0000:08:00.0/group1\r\ndevlink port function rate set pci/0000:08:00.0/32768 parent group1\r\nmodprobe -r mlx5_ib mlx5_fwctl mlx5_core\r\n\r\ndmesg:\r\nrefcount_t: decrement hit 0; leaking memory.\r\nWARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\r\nCPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE\r\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\r\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\r\nCall Trace:\r\n \r\n devl_rate_leaf_destroy+0x8d/0x90\r\n mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core]\r\n mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core]\r\n mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core]\r\n mlx5_sf_esw_event+0xc4/0x120 [mlx5_core]\r\n notifier_call_chain+0x33/0xa0\r\n blocking_notifier_call_chain+0x3b/0x50\r\n mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core]\r\n mlx5_eswitch_disable+0x63/0x90 [mlx5_core]\r\n mlx5_unload+0x1d/0x170 [mlx5_core]\r\n mlx5_uninit_one+0xa2/0x130 [mlx5_core]\r\n remove_one+0x78/0xd0 [mlx5_core]\r\n pci_device_remove+0x39/0xa0\r\n device_release_driver_internal+0x194/0x1f0\r\n unbind_store+0x99/0xa0\r\n kernfs_fop_write_iter+0x12e/0x1e0\r\n vfs_write+0x215/0x3d0\r\n ksys_write+0x5f/0xd0\r\n do_syscall_64+0x53/0x1f0\r\n entry_SYSCALL_64_after_hwframe+0x4b/0x53",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40251"
},
{
"cve": "CVE-2025-40252",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\r\n\r\nThe loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate\r\nover 'cqe->len_list[]' using only a zero-length terminator as\r\nthe stopping condition. If the terminator was missing or\r\nmalformed, the loop could run past the end of the fixed-size array.\r\n\r\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\r\na potential out-of-bounds access.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40252"
},
{
"cve": "CVE-2025-40254",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: openvswitch: remove never-working support for setting nsh fields\r\n\r\nThe validation of the set(nsh(...)) action is completely wrong.\r\nIt runs through the nsh_key_put_from_nlattr() function that is the\r\nsame function that validates NSH keys for the flow match and the\r\npush_nsh() action. However, the set(nsh(...)) has a very different\r\nmemory layout. Nested attributes in there are doubled in size in\r\ncase of the masked set(). That makes proper validation impossible.\r\n\r\nThere is also confusion in the code between the 'masked' flag, that\r\nsays that the nested attributes are doubled in size containing both\r\nthe value and the mask, and the 'is_mask' that says that the value\r\nwe're parsing is the mask. This is causing kernel crash on trying to\r\nwrite into mask part of the match with SW_FLOW_KEY_PUT() during\r\nvalidation, while validate_nsh() doesn't allocate any memory for it:\r\n\r\n BUG: kernel NULL pointer dereference, address: 0000000000000018\r\n #PF: supervisor read access in kernel mode\r\n #PF: error_code(0x0000) - not-present page\r\n PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0\r\n Oops: Oops: 0000 [#1] SMP NOPTI\r\n CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)\r\n RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]\r\n Call Trace:\r\n \r\n validate_nsh+0x60/0x90 [openvswitch]\r\n validate_set.constprop.0+0x270/0x3c0 [openvswitch]\r\n __ovs_nla_copy_actions+0x477/0x860 [openvswitch]\r\n ovs_nla_copy_actions+0x8d/0x100 [openvswitch]\r\n ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]\r\n genl_family_rcv_msg_doit+0xdb/0x130\r\n genl_family_rcv_msg+0x14b/0x220\r\n genl_rcv_msg+0x47/0xa0\r\n netlink_rcv_skb+0x53/0x100\r\n genl_rcv+0x24/0x40\r\n netlink_unicast+0x280/0x3b0\r\n netlink_sendmsg+0x1f7/0x430\r\n ____sys_sendmsg+0x36b/0x3a0\r\n ___sys_sendmsg+0x87/0xd0\r\n __sys_sendmsg+0x6d/0xd0\r\n do_syscall_64+0x7b/0x2c0\r\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\r\n\r\nThe third issue with this process is that while trying to convert\r\nthe non-masked set into masked one, validate_set() copies and doubles\r\nthe size of the OVS_KEY_ATTR_NSH as if it didn't have any nested\r\nattributes. It should be copying each nested attribute and doubling\r\nthem in size independently. And the process must be properly reversed\r\nduring the conversion back from masked to a non-masked variant during\r\nthe flow dump.\r\n\r\nIn the end, the only two outcomes of trying to use this action are\r\neither validation failure or a kernel crash. And if somehow someone\r\nmanages to install a flow with such an action, it will most definitely\r\nnot do what it is supposed to, since all the keys and the masks are\r\nmixed up.\r\n\r\nFixing all the issues is a complex task as it requires re-writing\r\nmost of the validation code.\r\n\r\nGiven that and the fact that this functionality never worked since\r\nintroduction, let's just remove it altogether. It's better to\r\nre-introduce it later with a proper implementation instead of trying\r\nto fix it in stable releases.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40254"
},
{
"cve": "CVE-2025-40257",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: fix a race in mptcp_pm_del_add_timer()\r\n\r\nmptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer)\r\nwhile another might have free entry already, as reported by syzbot.\r\n\r\nAdd RCU protection to fix this issue.\r\n\r\nAlso change confusing add_timer variable with stop_timer boolean.\r\n\r\nsyzbot report:\r\n\r\nBUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616\r\nRead of size 4 at addr ffff8880311e4150 by task kworker/1:1/44\r\n\r\nCPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\r\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\r\nWorkqueue: events mptcp_worker\r\nCall Trace:\r\n \r\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\r\n print_address_description mm/kasan/report.c:378 [inline]\r\n print_report+0xca/0x240 mm/kasan/report.c:482\r\n kasan_report+0x118/0x150 mm/kasan/report.c:595\r\n __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616\r\n sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631\r\n mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362\r\n mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174\r\n tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361\r\n tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441\r\n tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931\r\n tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374\r\n ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205\r\n ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239\r\n NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\r\n NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\r\n __netif_receive_skb_one_core net/core/dev.c:6079 [inline]\r\n __netif_receive_skb+0x143/0x380 net/core/dev.c:6192\r\n process_backlog+0x31e/0x900 net/core/dev.c:6544\r\n __napi_poll+0xb6/0x540 net/core/dev.c:7594\r\n napi_poll net/core/dev.c:7657 [inline]\r\n net_rx_action+0x5f7/0xda0 net/core/dev.c:7784\r\n handle_softirqs+0x22f/0x710 kernel/softirq.c:622\r\n __do_softirq kernel/softirq.c:656 [inline]\r\n __local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302\r\n mptcp_pm_send_ack net/mptcp/pm.c:210 [inline]\r\n mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1\r\n mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002\r\n mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762\r\n process_one_work kernel/workqueue.c:3263 [inline]\r\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346\r\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427\r\n kthread+0x711/0x8a0 kernel/kthread.c:463\r\n ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\r\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\r\n \r\n\r\nAllocated by task 44:\r\n kasan_save_stack mm/kasan/common.c:56 [inline]\r\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:77\r\n poison_kmalloc_redzone mm/kasan/common.c:400 [inline]\r\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417\r\n kasan_kmalloc include/linux/kasan.h:262 [inline]\r\n __kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748\r\n kmalloc_noprof include/linux/slab.h:957 [inline]\r\n mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385\r\n mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355\r\n mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline]\r\n __mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529\r\n mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008\r\n mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762\r\n process_one_work kernel/workqueue.c:3263 [inline]\r\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346\r\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427\r\n kthread+0x711/0x8a0 kernel/kthread.c:463\r\n ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\r\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\r\n\r\nFreed by task 6630:\r\n kasan_save_stack mm/kasan/common.c:56 [inline]\r\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:77\r\n __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587\r\n kasan_save_free_info mm/kasan/kasan.h:406 [inline]\r\n poison_slab_object m\r\n---truncated---",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40257"
},
{
"cve": "CVE-2025-40258",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: fix race condition in mptcp_schedule_work()\r\n\r\nsyzbot reported use-after-free in mptcp_schedule_work() [1]\r\n\r\nIssue here is that mptcp_schedule_work() schedules a work,\r\nthen gets a refcount on sk->sk_refcnt if the work was scheduled.\r\nThis refcount will be released by mptcp_worker().\r\n\r\n[A] if (schedule_work(...)) {\r\n[B] sock_hold(sk);\r\n return true;\r\n }\r\n\r\nProblem is that mptcp_worker() can run immediately and complete before [B]\r\n\r\nWe need instead :\r\n\r\n sock_hold(sk);\r\n if (schedule_work(...))\r\n return true;\r\n sock_put(sk);\r\n\r\n[1]\r\nrefcount_t: addition on 0; use-after-free.\r\n WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25\r\nCall Trace:\r\n \r\n __refcount_add include/linux/refcount.h:-1 [inline]\r\n __refcount_inc include/linux/refcount.h:366 [inline]\r\n refcount_inc include/linux/refcount.h:383 [inline]\r\n sock_hold include/net/sock.h:816 [inline]\r\n mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943\r\n mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316\r\n call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747\r\n expire_timers kernel/time/timer.c:1798 [inline]\r\n __run_timers kernel/time/timer.c:2372 [inline]\r\n __run_timer_base+0x648/0x970 kernel/time/timer.c:2384\r\n run_timer_base kernel/time/timer.c:2393 [inline]\r\n run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403\r\n handle_softirqs+0x22f/0x710 kernel/softirq.c:622\r\n __do_softirq kernel/softirq.c:656 [inline]\r\n run_ktimerd+0xcf/0x190 kernel/softirq.c:1138\r\n smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160\r\n kthread+0x711/0x8a0 kernel/kthread.c:463\r\n ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\r\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40258"
},
{
"cve": "CVE-2025-40261",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()\r\n\r\nnvme_fc_delete_assocation() waits for pending I/O to complete before\r\nreturning, and an error can cause ->ioerr_work to be queued after\r\ncancel_work_sync() had been called. Move the call to cancel_work_sync() to\r\nbe after nvme_fc_delete_association() to ensure ->ioerr_work is not running\r\nwhen the nvme_fc_ctrl object is freed. Otherwise the following can occur:\r\n\r\n[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL\r\n[ 1135.917705] ------------[ cut here ]------------\r\n[ 1135.922336] kernel BUG at lib/list_debug.c:52!\r\n[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI\r\n[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)\r\n[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025\r\n[ 1135.950969] Workqueue: 0x0 (nvme-wq)\r\n[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f\r\n[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b\r\n[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046\r\n[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000\r\n[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0\r\n[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08\r\n[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100\r\n[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0\r\n[ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000\r\n[ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\r\n[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0\r\n[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\r\n[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\r\n[ 1136.055910] PKRU: 55555554\r\n[ 1136.058623] Call Trace:\r\n[ 1136.061074] \r\n[ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0\r\n[ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0\r\n[ 1136.071898] ? move_linked_works+0x4a/0xa0\r\n[ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f\r\n[ 1136.081744] ? __die_body.cold+0x8/0x12\r\n[ 1136.085584] ? die+0x2e/0x50\r\n[ 1136.088469] ? do_trap+0xca/0x110\r\n[ 1136.091789] ? do_error_trap+0x65/0x80\r\n[ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f\r\n[ 1136.101289] ? exc_invalid_op+0x50/0x70\r\n[ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f\r\n[ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20\r\n[ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f\r\n[ 1136.120806] move_linked_works+0x4a/0xa0\r\n[ 1136.124733] worker_thread+0x216/0x3a0\r\n[ 1136.128485] ? __pfx_worker_thread+0x10/0x10\r\n[ 1136.132758] kthread+0xfa/0x240\r\n[ 1136.135904] ? __pfx_kthread+0x10/0x10\r\n[ 1136.139657] ret_from_fork+0x31/0x50\r\n[ 1136.143236] ? __pfx_kthread+0x10/0x10\r\n[ 1136.146988] ret_from_fork_asm+0x1a/0x30\r\n[ 1136.150915] ",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40261"
},
{
"cve": "CVE-2025-40262",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nInput: imx_sc_key - fix memory corruption on unload\r\n\r\nThis is supposed to be \"priv\" but we accidentally pass \"&priv\" which is\r\nan address in the stack and so it will lead to memory corruption when\r\nthe imx_sc_key_action() function is called. Remove the &.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40262"
},
{
"cve": "CVE-2025-40263",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nInput: cros_ec_keyb - fix an invalid memory access\r\n\r\nIf cros_ec_keyb_register_matrix() isn't called (due to\r\n`buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains\r\nNULL. An invalid memory access is observed in cros_ec_keyb_process()\r\nwhen receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work()\r\nin such case.\r\n\r\n Unable to handle kernel read from unreadable memory at virtual address 0000000000000028\r\n ...\r\n x3 : 0000000000000000 x2 : 0000000000000000\r\n x1 : 0000000000000000 x0 : 0000000000000000\r\n Call trace:\r\n input_event\r\n cros_ec_keyb_work\r\n blocking_notifier_call_chain\r\n ec_irq_thread\r\n\r\nIt's still unknown about why the kernel receives such malformed event,\r\nin any cases, the kernel shouldn't access `ckdev->idev` and friends if\r\nthe driver doesn't intend to initialize them.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40263"
},
{
"cve": "CVE-2025-40264",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbe2net: pass wrb_params in case of OS2BMC\r\n\r\nbe_insert_vlan_in_pkt() is called with the wrb_params argument being NULL\r\nat be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL\r\npointer when processing a workaround for specific packet, as commit\r\nbc0c3405abbb (\"be2net: fix a Tx stall bug caused by a specific ipv6\r\npacket\") states.\r\n\r\nThe correct way would be to pass the wrb_params from be_xmit().",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40264"
},
{
"cve": "CVE-2025-40271",
"cwe": {
"id": "CWE-625",
"name": "Permissive Regular Expression"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc: fix uaf in proc_readdir_de()\n\nPde is erased from subdir rbtree through rb_erase(), but not set the node\nto EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE()\nset the erased node to EMPTY, then pde_subdir_next() will return NULL to\navoid uaf access.\n\nWe found an uaf issue while using stress-ng testing, need to run testcase\ngetdent and tun in the same time. The steps of the issue is as follows:\n\n1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current\n pde is tun3;\n\n2) in the [time windows] unregister netdevice tun3 and tun2, and erase\n them from rbtree. erase tun3 first, and then erase tun2. the\n pde(tun2) will be released to slab;\n\n3) continue to getdent process, then pde_subdir_next() will return\n pde(tun2) which is released, it will case uaf access.\n\nCPU 0 | CPU 1\n-------------------------------------------------------------------------\ntraverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2\nsys_getdents64() |\n iterate_dir() |\n proc_readdir() |\n proc_readdir_de() | snmp6_unregister_dev()\n pde_get(de); | proc_remove()\n read_unlock(&proc_subdir_lock); | remove_proc_subtree()\n | write_lock(&proc_subdir_lock);\n [time window] | rb_erase(&root->subdir_node, &parent->subdir);\n | write_unlock(&proc_subdir_lock);\n read_lock(&proc_subdir_lock); |\n next = pde_subdir_next(de); |\n pde_put(de); |\n de = next; //UAF |\n\nrbtree of dev_snmp6\n |\n pde(tun3)\n / \\\n NULL pde(tun2)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40271"
},
{
"cve": "CVE-2025-40278",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak\n\nFix a KMSAN kernel-infoleak detected by the syzbot .\n\n[net?] KMSAN: kernel-infoleak in __skb_datagram_iter\n\nIn tcf_ife_dump(), the variable 'opt' was partially initialized using a\ndesignatied initializer. While the padding bytes are reamined\nuninitialized. nla_put() copies the entire structure into a\nnetlink message, these uninitialized bytes leaked to userspace.\n\nInitialize the structure with memset before assigning its fields\nto ensure all members and padding are cleared prior to beign copied.\n\nThis change silences the KMSAN report and prevents potential information\nleaks from the kernel memory.\n\nThis fix has been tested and validated by syzbot. This patch closes the\nbug reported at the following syzkaller link and ensures no infoleak.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40278"
},
{
"cve": "CVE-2025-40280",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free in tipc_mon_reinit_self().\n\nsyzbot reported use-after-free of tipc_net(net)->monitors[]\nin tipc_mon_reinit_self(). [0]\n\nThe array is protected by RTNL, but tipc_mon_reinit_self()\niterates over it without RTNL.\n\ntipc_mon_reinit_self() is called from tipc_net_finalize(),\nwhich is always under RTNL except for tipc_net_finalize_work().\n\nLet's hold RTNL in tipc_net_finalize_work().\n\n[0]:\nBUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\nBUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\nRead of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989\n\nCPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025\nWorkqueue: events tipc_net_finalize_work\nCall Trace:\n \n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568\n kasan_check_byte include/linux/kasan.h:399 [inline]\n lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\n rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]\n rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]\n rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244\n rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243\n write_lock_bh include/linux/rwlock_rt.h:99 [inline]\n tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718\n tipc_net_finalize+0x115/0x190 net/tipc/net.c:140\n process_one_work kernel/workqueue.c:3236 [inline]\n process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400\n kthread+0x70e/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \n\nAllocated by task 6089:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657\n tipc_enable_bearer net/tipc/bearer.c:357 [inline]\n __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047\n __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]\n tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393\n tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]\n tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321\n genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:729\n ____sys_sendmsg+0x508/0x820 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/\n---truncated---",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40280"
},
{
"cve": "CVE-2025-40281",
"cwe": {
"id": "CWE-1335",
"name": "Incorrect Bitwise Shift of Integer"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto\n\nsyzbot reported a possible shift-out-of-bounds [1]\n\nBlamed commit added rto_alpha_max and rto_beta_max set to 1000.\n\nIt is unclear if some sctp users are setting very large rto_alpha\nand/or rto_beta.\n\nIn order to prevent user regression, perform the test at run time.\n\nAlso add READ_ONCE() annotations as sysctl values can change under us.\n\n[1]\n\nUBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41\nshift exponent 64 is too large for 32-bit type 'unsigned int'\nCPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\nCall Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120\n ubsan_epilogue lib/ubsan.c:233 [inline]\n __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494\n sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509\n sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502\n sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338\n sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline]\n sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40281"
},
{
"cve": "CVE-2025-40345",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: storage: sddr55: Reject out-of-bound new_pba\r\n\r\nDiscovered by Atuin - Automated Vulnerability Discovery Engine.\r\n\r\nnew_pba comes from the status packet returned after each write.\r\nA bogus device could report values beyond the block count derived\r\nfrom info->capacity, letting the driver walk off the end of\r\npba_to_lba[] and corrupt heap memory.\r\n\r\nReject PBAs that exceed the computed block count and fail the\r\ntransfer so we avoid touching out-of-range mapping entries.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-40345"
},
{
"cve": "CVE-2025-46394",
"cwe": {
"id": "CWE-451",
"name": "User Interface (UI) Misrepresentation of Critical Information"
},
"notes": [
{
"category": "summary",
"text": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-46394"
},
{
"cve": "CVE-2025-49794",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-49794"
},
{
"cve": "CVE-2025-49795",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-49795"
},
{
"cve": "CVE-2025-49796",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-49796"
},
{
"cve": "CVE-2025-60876",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-60876"
},
{
"cve": "CVE-2025-66035",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"notes": [
{
"category": "summary",
"text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-66035"
},
{
"cve": "CVE-2025-66382",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "summary",
"text": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-66382"
},
{
"cve": "CVE-2025-66412",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "summary",
"text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-66412"
},
{
"cve": "CVE-2025-69720",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-69720"
},
{
"cve": "CVE-2025-71185",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: ti: dma-crossbar: fix device leak on am335x route allocation\r\n\r\nMake sure to drop the reference taken when looking up the crossbar\r\nplatform device during am335x route allocation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-71185"
},
{
"cve": "CVE-2025-71186",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: stm32: dmamux: fix device leak on route allocation\r\n\r\nMake sure to drop the reference taken when looking up the DMA mux\r\nplatform device during route allocation.\r\n\r\nNote that holding a reference to a device does not prevent its driver\r\ndata from going away so there is no point in keeping the reference.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-71186"
},
{
"cve": "CVE-2025-71188",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: lpc18xx-dmamux: fix device leak on route allocation\r\n\r\nMake sure to drop the reference taken when looking up the DMA mux\r\nplatform device during route allocation.\r\n\r\nNote that holding a reference to a device does not prevent its driver\r\ndata from going away so there is no point in keeping the reference.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-71188"
},
{
"cve": "CVE-2025-71189",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: dw: dmamux: fix OF node leak on route allocation failure\r\n\r\nMake sure to drop the reference taken to the DMA master OF node also on\r\nlate route allocation failures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-71189"
},
{
"cve": "CVE-2025-71190",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: bcm-sba-raid: fix device leak on probe\r\n\r\nMake sure to drop the reference taken when looking up the mailbox device\r\nduring probe on probe failures and on driver unbind.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-71190"
},
{
"cve": "CVE-2025-71191",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: at_hdmac: fix device leak on of_dma_xlate()\r\n\r\nMake sure to drop the reference taken when looking up the DMA platform\r\ndevice during of_dma_xlate() when releasing channel resources.\r\n\r\nNote that commit 3832b78b3ec2 (\"dmaengine: at_hdmac: add missing\r\nput_device() call in at_dma_xlate()\") fixed the leak in a couple of\r\nerror paths but the reference is still leaking on successful allocation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2025-71191"
},
{
"cve": "CVE-2026-1484",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-1484"
},
{
"cve": "CVE-2026-1489",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-1489"
},
{
"cve": "CVE-2026-3784",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"notes": [
{
"category": "summary",
"text": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/110002573/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2026-3784"
},
{
"cve": "CVE-2026-22610",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
},
"notes": [
{
"category": "summary",
"text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG