Vulnerability-Lookup

SSA-827383

Vulnerability from csaf_siemens - Published: 2026-05-12 00:00 - Updated: 2026-05-12 00:00

Summary

SSA-827383: Multiple Vulnerabilities in Teamcenter

Notes

Summary: Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released new versions for the affected products and recommends to update to the latest versions.

General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use: The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

CVE-2024-4367

5.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Teamcenter V2312 Siemens / Teamcenter V2312		vers:intdot/<2312.0009	Vendor Fix fix
Teamcenter V2406 Siemens / Teamcenter V2406		vers:intdot/<2406.0006	Vendor Fix fix

Known not affected 1 product

Product	Identifier	Version	Remediation
Teamcenter V2512 Siemens / Teamcenter V2512		vers:all/*

Threats

Impact Vulnerable component not present

CVE-2026-33862

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Known affected 4 products

Product	Version	Remediation
Teamcenter V2312 Siemens / Teamcenter V2312	vers:intdot/<2312.0014	Vendor Fix fix
Teamcenter V2406 Siemens / Teamcenter V2406	vers:intdot/<2406.0012	Vendor Fix fix
Teamcenter V2412 Siemens / Teamcenter V2412	vers:intdot/<2412.0009	Vendor Fix fix
Teamcenter V2506 Siemens / Teamcenter V2506	vers:intdot/<2506.0005	Vendor Fix fix

Known not affected 1 product

Product	Identifier	Version	Remediation
Teamcenter V2512 Siemens / Teamcenter V2512		vers:all/*

Threats

Impact Vulnerable component not present

CVE-2026-33893

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-798 - Use of Hard-coded Credentials

Affected products

Known affected 4 products

Product	Version	Remediation
Teamcenter V2312 Siemens / Teamcenter V2312	vers:intdot/<2312.0014	Vendor Fix fix
Teamcenter V2406 Siemens / Teamcenter V2406	vers:intdot/<2406.0012	Vendor Fix fix
Teamcenter V2412 Siemens / Teamcenter V2412	vers:intdot/<2412.0009	Vendor Fix fix
Teamcenter V2506 Siemens / Teamcenter V2506	vers:intdot/<2506.0005	Vendor Fix fix

Known not affected 1 product

Product	Identifier	Version	Remediation
Teamcenter V2512 Siemens / Teamcenter V2512		vers:all/*

Threats

Impact Vulnerable component not present

References

2 references

URL	Category
https://cert-portal.siemens.com/productcert/html/…	self
https://cert-portal.siemens.com/productcert/csaf/…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-827383: Multiple Vulnerabilities in Teamcenter - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-827383.html"
      },
      {
        "category": "self",
        "summary": "SSA-827383: Multiple Vulnerabilities in Teamcenter - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-827383.json"
      }
    ],
    "title": "SSA-827383: Multiple Vulnerabilities in Teamcenter",
    "tracking": {
      "current_release_date": "2026-05-12T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-827383",
      "initial_release_date": "2026-05-12T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-12T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2312.0014",
                "product": {
                  "name": "Teamcenter V2312",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2312.0009",
                "product": {
                  "name": "Teamcenter V2312",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V2312"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2406.0012",
                "product": {
                  "name": "Teamcenter V2406",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2406.0006",
                "product": {
                  "name": "Teamcenter V2406",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V2406"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2412.0009",
                "product": {
                  "name": "Teamcenter V2412",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V2412"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c2506.0005",
                "product": {
                  "name": "Teamcenter V2506",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V2506"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Teamcenter V2512",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V2512"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-4367",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "7"
          ]
        }
      ],
      "notes": [
        {
          "category": "summary",
          "text": "A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox \u003c 126, Firefox ESR \u003c 115.11, and Thunderbird \u003c 115.11.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "2",
          "4"
        ],
        "known_not_affected": [
          "7"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2312.0009 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2406.0006 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "2",
            "4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Vulnerable component not present",
          "product_ids": [
            "7"
          ]
        }
      ],
      "title": "CVE-2024-4367"
    },
    {
      "cve": "CVE-2026-33862",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "7"
          ]
        }
      ],
      "notes": [
        {
          "category": "summary",
          "text": "The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "3",
          "5",
          "6"
        ],
        "known_not_affected": [
          "7"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2312.0014 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2406.0012 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2412.0009 or later version",
          "product_ids": [
            "5"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2506.0005 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "5",
            "6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Vulnerable component not present",
          "product_ids": [
            "7"
          ]
        }
      ],
      "title": "CVE-2026-33862"
    },
    {
      "cve": "CVE-2026-33893",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "7"
          ]
        }
      ],
      "notes": [
        {
          "category": "summary",
          "text": "The affected application contains hardcoded key which is used for obfuscation stored directly into the application.\r\nThis could allow an attacker to obtain these keys and misuse them to gain unauthorized access.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "3",
          "5",
          "6"
        ],
        "known_not_affected": [
          "7"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2312.0014 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2406.0012 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2412.0009 or later version",
          "product_ids": [
            "5"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2506.0005 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://support.sw.siemens.com/product/282219420/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "5",
            "6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Vulnerable component not present",
          "product_ids": [
            "7"
          ]
        }
      ],
      "title": "CVE-2026-33893"
    }
  ]
}

CVE-2024-4367 (GCVE-0-2024-4367)

Vulnerability from cvelistv5 – Published: 2024-05-14 17:21 – Updated: 2026-05-12 11:30

Summary

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Severity ?

5.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

Arbitrary JavaScript execution in PDF.js

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://lists.debian.org/debian-lts-announce/2024…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

3 products

Vendor	Product	Version
Mozilla	Firefox	Affected: unspecified , < 126 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 115.11 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 115.11 (custom)

Credits

Thomas Rinsma of Codean Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thunderbird",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "115.11",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "126",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "115.11",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-4367",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T04:55:26.634778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-754",
                "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T14:44:59.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-24T18:19:17.818Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Aug/30"
          },
          {
            "url": "https://github.com/mozilla/pdf.js/releases/tag/v4.2.67"
          },
          {
            "url": "https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/"
          },
          {
            "url": "https://github.com/gogs/gogs/issues/7928"
          },
          {
            "url": "https://www.exploit-db.com/exploits/52273"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1893645"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2024-21/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2024-22/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2024-23/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "Teamcenter V2312",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2312.0009",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Teamcenter V2406",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2406.0006",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Teamcenter V2512",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:30:41.220Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-827383.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "126",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Thomas Rinsma of Codean Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox \u003c 126, Firefox ESR \u003c 115.11, and Thunderbird \u003c 115.11."
            }
          ],
          "value": "A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox \u003c 126, Firefox ESR \u003c 115.11, and Thunderbird \u003c 115.11."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Arbitrary JavaScript execution in PDF.js",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T16:07:35.289Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1893645"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-21/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-22/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-23/"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-4367",
    "datePublished": "2024-05-14T17:21:23.486Z",
    "dateReserved": "2024-04-30T19:08:43.037Z",
    "dateUpdated": "2026-05-12T11:30:41.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33893 (GCVE-0-2026-33893)

Vulnerability from cvelistv5 – Published: 2026-05-12 08:21 – Updated: 2026-05-12 13:25

Summary

A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcenter V2412 (All versions < V2412.0009), Teamcenter V2506 (All versions < V2506.0005), Teamcenter V2512 (All versions). The affected application contains hardcoded key which is used for obfuscation stored directly into the application. This could allow an attacker to obtain these keys and misuse them to gain unauthorized access.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

siemens

References

1 reference

URL	Tags
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Siemens	Teamcenter V2312	Affected: 0 , < V2312.0014 (custom)
Siemens	Teamcenter V2406	Affected: 0 , < V2406.0012 (custom)
Siemens	Teamcenter V2412	Affected: 0 , < V2412.0009 (custom)
Siemens	Teamcenter V2506	Affected: 0 , < V2506.0005 (custom)
Siemens	Teamcenter V2512	Unaffected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T13:25:24.360747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T13:25:42.831Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2312",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2312.0014",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2406",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2406.0012",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2412",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2412.0009",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2506",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2506.0005",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2512",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter V2406 (All versions \u003c V2406.0012), Teamcenter V2412 (All versions \u003c V2412.0009), Teamcenter V2506 (All versions \u003c V2506.0005), Teamcenter V2512 (All versions). The affected application contains hardcoded key which is used for obfuscation stored directly into the application.\r\nThis could allow an attacker to obtain these keys and misuse them to gain unauthorized access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798: Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T08:21:15.796Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-827383.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2026-33893",
    "datePublished": "2026-05-12T08:21:15.796Z",
    "dateReserved": "2026-03-24T15:32:19.391Z",
    "dateUpdated": "2026-05-12T13:25:42.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33862 (GCVE-0-2026-33862)

Vulnerability from cvelistv5 – Published: 2026-05-12 08:21 – Updated: 2026-05-13 01:48

Summary

A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcenter V2412 (All versions < V2412.0009), Teamcenter V2506 (All versions < V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.

Severity ?

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

siemens

References

1 reference

URL	Tags
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Siemens	Teamcenter V2312	Affected: 0 , < V2312.0014 (custom)
Siemens	Teamcenter V2406	Affected: 0 , < V2406.0012 (custom)
Siemens	Teamcenter V2412	Affected: 0 , < V2412.0009 (custom)
Siemens	Teamcenter V2506	Affected: 0 , < V2506.0005 (custom)
Siemens	Teamcenter V2512	Unaffected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T01:41:31.594862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T01:48:31.646Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2312",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2312.0014",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2406",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2406.0012",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2412",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2412.0009",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2506",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V2506.0005",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Teamcenter V2512",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter V2406 (All versions \u003c V2406.0012), Teamcenter V2412 (All versions \u003c V2412.0009), Teamcenter V2506 (All versions \u003c V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T08:21:14.646Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-827383.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2026-33862",
    "datePublished": "2026-05-12T08:21:14.646Z",
    "dateReserved": "2026-03-24T12:34:25.562Z",
    "dateUpdated": "2026-05-13T01:48:31.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SSA-827383

CVE-2024-4367 (GCVE-0-2024-4367)

CVE-2026-33893 (GCVE-0-2026-33893)

CVE-2026-33862 (GCVE-0-2026-33862)

Tags

Sightings

Nomenclature