Critical 9.8HealthcarePublished Jun 1, 2022

CVE-2022-29875A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (Al…

Updated under an hour ago (Oct 27, 2026, 9:20 AM ET)

Does this affect you?

It affects Siemens Biograph Horizon PET/CT Systems and 39 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 1.87%, higher than 79% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Siemens Biograph Horizon PET/CT Systems

Exploited in the last 30 days

A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (All VC20 versions < VC20D), NAEOTOM Alpha (All VA40 versions < VA40 SP2), SOMATOM X.cite (All versions < VA30 SP5 or VA40 SP2), SOMATOM X.creed (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.All (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Now (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Open Pro (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Sim (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Top (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Up (All versions < VA30 SP5 or VA40 SP2), Symbia E/S (All VB22 versions < VB22A-UD03), Symbia Evo (All VB22 versions < VB22A-UD03), Symbia Intevo (All VB22 versions < VB22A-UD03), Symbia T (All VB22 versions < VB22A-UD03), Symbia.net (All VB22 versions < VB22A-UD03), syngo.via VB10 (All versions), syngo.via VB20 (All versions), syngo.via VB30 (All versions), syngo.via VB40 (All versions < VB40B HF06), syngo.via VB50 (All versions), syngo.via VB60 (All versions < VB60B HF02). The application deserialises untrusted data without sufficient validations that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system if ports 32912/tcp or 32914/tcp are reachable.

CVSS: 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-502
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 1.87% (percentile 79)
Assigned by: siemens
NVD analysis: Modified
Record last updated: Aug 3, 2024
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Siemens Biograph Horizon PET/CT Systems siemens:biograph_horizon_pet_ct_systems (from the name)	All VJ30 versions < VJ30C-UD01	CNA record
Siemens MAGNETOM Family siemens:magnetom_family (from the name)	NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A	CNA record
Siemens MAMMOMAT Revelation siemens:mammomat_revelation (from the name)	All VC20 versions < VC20D	CNA record
Siemens NAEOTOM Alpha siemens:naeotom_alpha (from the name)	All VA40 versions < VA40 SP2	CNA record
Siemens SOMATOM X.cite siemens:somatom_x.cite (from the name)	All versions < VA30 SP5 or VA40 SP2	CNA record
Siemens SOMATOM X.creed siemens:somatom_x.creed (from the name)	All versions < VA30 SP5 or VA40 SP2	CNA record
Siemens SOMATOM go.All siemens:somatom_go.all (from the name)	All versions < VA30 SP5 or VA40 SP2	CNA record
Siemens SOMATOM go.Now siemens:somatom_go.now (from the name)	All versions < VA30 SP5 or VA40 SP2	CNA record
Siemens SOMATOM go.Open Pro siemens:somatom_go.open_pro (from the name)	All versions < VA30 SP5 or VA40 SP2	CNA record
Siemens SOMATOM go.Sim siemens:somatom_go.sim (from the name)	All versions < VA30 SP5 or VA40 SP2	CNA record
1–10 of 41

References

References

https://www.siemens-healthineers.com/support-documentation/cybersecurity/shsa-455016	x-refsource-misc, mitigation, vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.