Ssa 044112

cert-portal.siemens.com • September 2, 2026

The TCP/IP stack and related services (FTP, TFTP) of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contain several vulnerabilities, also known as “NUCLEUS:13” and as documented below.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens’ operational guidelines for Industrial Security (Download: ), and to follow the recommendations in the product manuals.

An additional classification has been performed using the CWE classification, a community-developed list of common software security weaknesses. This serves as a common language and as a baseline for weakness identification, mitigation, and prevention efforts. A detailed list of CWE classes can be found at: .

Yuval Halaban, Uriel Malin, and Tal Zohar from Medigate for coordinated disclosure

Daniel dos Santos, Amine Amri, and Stanislav Dashevskyi from Forescout Technologies for coordinated disclosure

For more details regarding the NUCLEUS:13 vulnerabilities in the Nucleus TCP/IP stack refer to the Forescout Publication “NUCLEUS:13” at

Nucleus ReadyStart V3: Several vulnerabilities were already fixed in versions before V2017.02.4:

V2012.08 and later already fix CVE-2021-31881

V2013.08.1 and later already fix CVE-2021-31886

V2014.12 and later already fix CVE-2021-31345

V2017.02.1 and later already fix CVE-2021-31882, CVE-2021-31883, CVE-2021-31884, CVE-2021-31887, CVE-2021-31888

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Powered Exploitation of PLCs Raises Concerns in Cybersecurity Researchers at Forescout’s Vedere Labs successfully used AI to port a remote code execution (RCE) exploit from the WAGO 750-852 PLC to the WAGO 750-831 PLC, targeting CVE-2021-31886. The experiment required significant human oversight, taking over eight hours and costing approximately $535 in API usage. The AI confirmed the vulnerability through live probing and static analysis, but initial attempts to create a functional exploit faced challenges, leading to a switch in AI models. Once operational, the AI produced multiple payloads quickly, but an attempt to enhance the exploit resulted in bricking the PLC. The findings highlight the potential for AI to automate parts of the exploit development process, raising alarms about the accessibility of such attacks against critical infrastructure. The experiment follows recent attacks on PLCs in the water sector, emphasizing the urgency of addressing these vulnerabilities. 11 sources 52

Extracted Entities

Ssa 044112

The full story

Extracted Entities

Companies (2)

CVEs (8)

Platforms (1)

Vulnerabilities (1)