Siemens CADRA multiple zlib and Chrome vulnerabilities
Siemens CADRA versions below V2511 are affected by multiple zlib and Chromium V8 vulnerabilities; update to V2511 or later to remediate.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 11 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-10585 and CVE-2025-13223 as exploited in the wild.
Siemens CADRA is affected by a set of legacy and recent vulnerabilities spanning zlib compression library flaws and Google Chrome V8 type confusion issues. The zlib vulnerabilities (CVE-2005-2096, CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2017-14919, CVE-2018-25032, CVE-2022-37434, CVE-2023-45853, CVE-2026-22184) range from denial-of-service to buffer overflow and heap corruption conditions, with some requiring specific application-level triggers. The more recent Chromium V8 issues (CVE-2025-10585, CVE-2025-13223) present type confusion leading to heap corruption via crafted HTML and are currently unpatched. CADRA versions prior to V2511 are known affected; V2511 or later addresses the zlib issues. For the two unfixed Chrome vulnerabilities, Siemens recommends blocking access to untrusted or external web content. Organizations running CADRA in critical infrastructure environments (chemical, energy, communications) should prioritize updates and network segmentation.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-06
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs