Siemens Sipass Integrated vulnerabilities

16 CVEs affecting Siemens Sipass Integrated, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-40774, published 2025-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2021-45046: Apache Log4j2 Deserialization of Untrusted Data Vulnerability, published 2021-12-14. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2023-05-01. EPSS: 100% chance of exploitation in the next 30 days. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC)…
CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-04. EPSS: 99.6% chance of exploitation in the next 30 days. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR…
CVE-2012-5409, published 2012-11-01. High severity, CVSS 10.0. EPSS: 15.8% chance of exploitation in the next 30 days. AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data…
CVE-2017-9939, published 2017-08-08. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with network access to the SiPass integrated server to bypass the authentication…
CVE-2021-44524, published 2021-12-14. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All…
CVE-2021-44523, published 2021-12-14. Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All…
CVE-2021-44522, published 2021-12-14. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All…
CVE-2017-9941, published 2017-08-08. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker in a Man-in-the-Middle position between the SiPass integrated server and SiPass…
CVE-2022-31810, published 2023-07-11. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability has been identified in SiPass integrated (All versions < V2.90.3.8). Affected server applications improperly check the size of data packets received for the configuration client…

Latest

CVE-2025-40774, published 2025-10-14. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. Decryption keys are accessible to users…
CVE-2025-40773, published 2025-10-14. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks…
CVE-2025-40772, published 2025-10-14. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-Site Scripting (XSS), allowing an attacker to inject…
CVE-2022-31812, published 2025-05-23. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds read past the end of an allocated buffer while checking the…