Softing
50 CVEs across 33 Softing products. Browse Softing vulnerabilities, severities, and proof-of-concept exploits.
Softing products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-7339 | Medium | 6.5 | 2026-03-27 | Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers. This issue affects pnGate: through 1.30 epGat… |
CVE-2024-14028 | Medium | 6.5 | 2026-03-27 | Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects: smartLink HW-DP: through 1.31 smartLi… |
CVE-2025-13406 | | 2026-03-17 | NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT (Webserver modules) allows HTTP DoS.This issue affects smartLink S… | |
CVE-2025-10685 | | 2026-03-16 | Heap-based buffer overflow vulnerability in Softing Industrial Automation GmbH smartLink SW-PN and smartLink SW-HT (Webserver modules) allows overflow buffers… | |
CVE-2025-10461 | | 2026-03-16 | Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker (filesystem modules) allows file access… | |
CVE-2025-7390 | Critical | 9.1 | 2025-08-21 | A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communicati… |
CVE-2023-39482 | Medium | 6.5 | 2024-05-03 | Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2023-39481 | High | 8.8 | 2024-05-03 | Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2023-39480 | Medium | 6.5 | 2024-05-03 | Softing Secure Integration Server FileDirectory OPC UA Object Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbit… |
CVE-2023-39479 | High | 8.8 | 2024-05-03 | Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability. This vulnerability allows remote attackers to create directories on affected… |
CVE-2023-39478 | High | 8.8 | 2024-05-03 | Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2023-38125 | High | 8.8 | 2024-05-03 | Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2023-27336 | High | 7.5 | 2024-05-03 | Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a de… |
CVE-2023-27335 | Critical | 9.6 | 2024-05-03 | Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2023-27334 | High | 7.5 | 2024-05-03 | Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a deni… |
CVE-2024-0860 | High | 8.0 | 2024-03-14 | The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft… |
CVE-2023-37571 | Medium | 6.1 | 2024-01-30 | Softing TH SCOPE through 3.70 allows XSS. |
CVE-2023-38126 | High | 7.2 | 2023-12-19 | Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2023-41151 | High | 7.5 | 2023-12-14 | An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wa… |
CVE-2023-37572 | High | 7.5 | 2023-12-05 | Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery… |
CVE-2022-48193 | Medium | 5.9 | 2023-11-06 | Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL). |
CVE-2022-48192 | High | 7.2 | 2023-11-06 | Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the c… |
CVE-2022-45920 | High | 7.5 | 2023-01-26 | In Softing uaToolkit Embedded before 1.41, a malformed CreateMonitoredItems request may cause a memory leak. |
CVE-2022-44018 | High | 7.5 | 2023-01-26 | In Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-of-bounds memory acc… |
CVE-2022-39823 | High | 7.5 | 2022-10-20 | An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on continuation points may… |
CVE-2022-37453 | High | 7.5 | 2022-10-20 | An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and matrix bounds in st… |
CVE-2022-2547 | High | 7.5 | 2022-08-17 | A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2338 | Medium | 5.7 | 2022-08-17 | Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is… |
CVE-2022-2337 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2336 | Critical | 9.8 | 2022-08-17 | Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admi… |
CVE-2022-2335 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2334 | High | 7.2 | 2022-08-17 | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbit… |
CVE-2022-1748 | High | 7.5 | 2022-08-17 | Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affected by a NULL pointer dereference vulne… |
CVE-2022-1373 | High | 7.2 | 2022-08-17 | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files… |
CVE-2022-1069 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2021-32994 | High | 7.5 | 2022-04-04 | Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, whi… |
CVE-2021-42577 | High | 7.5 | 2022-03-11 | An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL pointer dereference. |
CVE-2021-42262 | Medium | 6.5 | 2022-03-11 | An issue was discovered in Softing OPC UA C++ SDK before 5.70. An invalid XML element in the type dictionary makes the OPC/UA client crash due to an out-of-mem… |
CVE-2021-40873 | High | 7.5 | 2021-11-10 | An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66, and uaToolkit Embedded before 1.40. Remote attackers to cause a denial of… |
CVE-2021-40872 | High | 7.5 | 2021-11-10 | An issue was discovered in Softing Industrial Automation uaToolkit Embedded before 1.40. Remote attackers to cause a denial of service (DoS) or login as an ano… |
CVE-2021-40871 | High | 7.5 | 2021-11-10 | An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66. Remote attackers to cause a denial of service (DoS) by sending crafted mes… |
CVE-2021-29661 | Medium | 5.4 | 2021-04-02 | Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload in… |
CVE-2021-29660 | High | 8.8 | 2021-04-02 | A Cross-Site Request Forgery (CSRF) vulnerability in en/cfg_setpwd.html in Softing AG OPC Toolbox through 4.10.1.13035 allows attackers to reset the administra… |
CVE-2020-14524 | Critical | 9.8 | 2020-08-25 | Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based buffer overflow, whi… |
CVE-2020-14522 | High | 7.5 | 2020-08-25 | Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption… |
CVE-2019-15051 | High | 8.8 | 2019-10-10 | An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to command injection via a maliciously craft… |
CVE-2019-11528 | High | 7.5 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable. |
CVE-2019-11527 | High | 8.8 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter. |
CVE-2019-11526 | Critical | 9.8 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the… |
CVE-2014-6616 | | 2015-08-31 | Cross-site scripting (XSS) vulnerability in Softing FG-100 PROFIBUS Single Channel (FG-100-PB) with firmware FG-x00-PB_V2.02.0.00 allows remote attackers to in… |