Known vulnerabilities in SIMATIC PCS neo

Vendor: Siemens
Software: SIMATIC PCS neo
Software CPE: cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:*
Website: https://www.siemens.com/
Total vulnerabilities: 28
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting SIMATIC PCS neo SIMATIC PCS neo is affected by 28 known vulnerabilities: 9 high, 12 medium, 7 low Critical High Medium Low

Vulnerabilities (28)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU115181 - Out-of-bounds read
CVE-2025-40798		 CWE-125 Medium
No
No
 - 12.09.2025 SB2025091225
#VU115178 - Out-of-bounds read
CVE-2025-40797		 CWE-125 Medium
No
No
 - 12.09.2025 SB2025091225
#VU115170 - Out-of-bounds read
CVE-2025-40796		 CWE-125 Medium
No
No
 - 12.09.2025 SB2025091225
#VU115169 - Stack-based buffer overflow
CVE-2025-40795		 CWE-121 High
No
No
 - 12.09.2025 SB2025091225
#VU109456 - Insufficient Session Expiration
CVE-2025-40566		 CWE-613 High
No
No
 4.1 Update 3, 5.0 Update 1 20.05.2025 SB2025052025
#VU109419 - Out-of-bounds read
CVE-2025-30176		 CWE-125 High
No
No
 - 19.05.2025 SB2025051943
#VU109418 - Out-of-bounds write
CVE-2025-30175		 CWE-787 High
No
No
 - 19.05.2025 SB2025051943
#VU109417 - Out-of-bounds read
CVE-2025-30174		 CWE-125 High
No
No
 - 19.05.2025 SB2025051943
#VU105437 - Insufficient Session Expiration
CVE-2024-45386		 CWE-613 High
No
No
 4.1 Update 2, 5.0 Update 1 07.03.2025 SB2025030706
#VU102502 - Heap-based Buffer Overflow
CVE-2024-49775		 CWE-122 High
No
No
 5.0 Update 1 09.01.2025 SB2025010960
#VU97161 - Heap-based Buffer Overflow
CVE-2024-33698		 CWE-122 High
No
No
 4.1 Update 2 11.09.2024 SB2024091139
#VU84382 - Improper input validation
CVE-2023-46285		 CWE-20 Medium
No
No
 4.1 13.12.2023 SB2023121329
#VU84378 - Memory corruption
CVE-2023-46284		 CWE-119 Medium
No
No
 4.1 13.12.2023 SB2023121329
#VU84375 - Memory corruption
CVE-2023-46283		 CWE-119 Medium
No
No
 4.1 13.12.2023 SB2023121329
#VU84371 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-46282		 CWE-79 Low
No
No
 4.1 13.12.2023 SB2023121329
#VU84369 - Overly Permissive Cross-domain Whitelist
CVE-2023-46281		 CWE-942 Medium
No
No
 4.1 13.12.2023 SB2023121329
#VU83180 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-46099		 CWE-79 Low
No
No
 4.1 15.11.2023 SB2023111527
#VU83179 - Overly Permissive Cross-domain Whitelist
CVE-2023-46098		 CWE-942 Medium
No
No
 4.1 15.11.2023 SB2023111527
#VU83172 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-46097		 CWE-89 Medium
No
No
 4.1 15.11.2023 SB2023111527
#VU83169 - Missing Authentication for Critical Function
CVE-2023-46096		 CWE-306 Low
No
No
 4.1 15.11.2023 SB2023111527


Showing elements 1 - 20 out of 28