[Control systems] Siemens security advisory (AV25-518)

Serial number: AV25-518
Date: August 15, 2025

On August 14, 2025, Siemens published advisories to address vulnerabilities in multiple products. Included were updates for the following products:

• Mendix SAML (Mendix 9.24 compatible) – versions prior to V3.6.21
• Mendix SAML (Mendix 10.12 compatible) – versions prior to V4.0.3
• Mendix SAML (Mendix 10.21 compatible) – versions prior to V4.1.2
• Desigo CC family – all versions
• SENTRON Powermanager – all versions

The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates.

• SSA-395458: Account Hijacking Vulnerability in Mendix SAML Module
• SSA-201595: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting the Desigo CC Product Family and SENTRON Powermanager
• Siemens Security Advisories