Sample Machine SBOM & Vulnerability Report
Softwsp | Sample Packaging Line PX-200 | Report date 2026-10-19
SAMPLE REPORT — hypothetical machine; vulnerabilities are real public data as of 2026-10-19. The machine “Sample Packaging Line PX-200”, its bill of materials and its installed firmware versions are invented for illustration. The components are real, commonly used industrial products, and every advisory cited below is a real public advisory that was read at its source on 2026-10-19. Nothing in this document describes a real customer or a real installation.
1. Cover note
What this is. A Machine SBOM & Vulnerability Report lists the digital components inside a machine (the Software Bill of Materials, SBOM), matches each component and firmware version against public vulnerability sources, and ranks what is worth acting on first. It is written for a machine builder who must show customers and, from 2027, market surveillance authorities, that the machine’s software is known, tracked and maintained.
What this sample shows. One report for a fictional packaging line with six digital components, eight public advisories, a priority list, an indicative mapping to the regulations a machine builder will be asked about, and a plan.
Sources used. CISA ICS advisories, Siemens ProductCERT advisories (SSA), the NIST National Vulnerability Database (NVD), and the CISA Known Exploited Vulnerabilities (KEV) catalog (catalog version 2026.10.16). Links are given with each finding.
2. Executive summary
Result in plain language. The PX-200 contains six networked components. For all six, at least one published vulnerability matches the firmware version assumed in the bill of materials. Two of these (both in the Windows 10 IoT industrial PC) are listed in the CISA Known Exploited Vulnerabilities catalog, which means CISA has evidence of exploitation in the wild for them. These two are fixed by a routine Windows update and should be handled first.
Several other findings are not fixed by a patch, either because the vendor has retired the product line (Cognex In-Sight Explorer-based cameras) or because the remedy is a firmware update plus a project migration (Siemens S7-1200). For those, network design (segmentation, no direct internet exposure, restricted remote access) is the practical control.
What this does not say. It does not say the machine is compromised, and it does not say a given vulnerability is reachable on the real machine. Reachability depends on how the machine is networked at the customer site; this report is built from the bill of materials only (see section 8).
Risk overview
| # | Component | Advisory | Highest CVSS | In CISA KEV | Fix available | Priority |
|---|---|---|---|---|---|---|
| 1 | Industrial PC, Windows 10 IoT Enterprise LTSC 2021 | CVE-2025-33073, CVE-2025-24990 | 8.8 (CVE-2025-33073) | Yes (both) | Yes, Windows cumulative update | P1 |
| 2 | Siemens SIMATIC S7-1200 CPU 1214C, V4.2.3 | SSA-568427, SSA-434534 | 9.3 (SSA-568427) | No | Yes, V4.5.0 or later plus TIA Portal project migration | P2 |
| 3 | Weintek cMT3072 HMI | ICSA-23-285-12 | 9.8 | No | Yes, OS update | P2 |
| 4 | Siemens SINAMICS S200 servo drive (affected serial range) | SSA-787280 | 9.8 | No | No firmware fix; Siemens countermeasures only | P2 |
| 5 | Teltonika RUT950 router, RutOS 00.07.03 | ICSA-23-131-08 | 9.0 (advisory) / 8.0 (device CVEs) | No | Yes, update to current firmware | P2 |
| 6 | Cognex In-Sight 7000 series camera, 6.5.1 | ICSA-25-261-06 | 8.8 | No | No; legacy line, migration recommended | P3 |
Priority logic: P1 = listed in CISA KEV; P2 = no KEV listing, CVSS 8.0 or higher, remote or adjacent-network reachable; P3 = remaining findings, mitigated mainly by architecture. Within a priority, higher CVSS first.
3. Component inventory (SBOM)
Hypothetical machine: Sample Packaging Line PX-200. Firmware versions are chosen to fall inside the ranges affected by the advisories in section 4.
| ID | Component | Vendor | Model | Firmware / OS (assumed) | Identifier (CPE, where NVD lists one) |
|---|---|---|---|---|---|
| C1 | Machine PLC | Siemens | SIMATIC S7-1200 CPU 1214C | V4.2.3 | cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1214c:-:*:*:*:*:*:*:* (firmware CPE: see NVD entry of the CVE) |
| C2 | Operator HMI | Weintek | cMT3072 | OS 20210115 | cpe:2.3:o:weintek:cmt3072_firmware:*:*:*:*:*:*:*:* and cpe:2.3:h:weintek:cmt3072:-:*:*:*:*:*:*:* |
| C3 | Servo drive | Siemens | SINAMICS S200 (FS 02, serial prefix SZVS8) | as delivered | No product-level CPE confirmed; identified by serial range in SSA-787280 |
| C4 | Remote-access router | Teltonika Networks | RUT950 | RutOS 00.07.03 | cpe:2.3:h:teltonika-networks:rut950:-:*:*:*:*:*:*:* |
| C5 | Line supervisor industrial PC | Generic OEM IPC | Windows 10 IoT Enterprise LTSC 2021 | Build 10.0.19044.4000 | cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* |
| C6 | Vision camera (label inspection) | Cognex | In-Sight 7000 series | 6.5.1 | No product-level CPE confirmed; identified by series and version range in ICSA-25-261-06 |
Notes: “assumed” means the value was chosen for this sample. In a real report, firmware values come from the machine builder’s BOM export or from a read-only inventory. Items without a confirmed CPE are matched by vendor product name and version range, which is flagged as lower-confidence matching.
4. Findings by priority
Order: CISA KEV first, then CVSS, then remote reachability. CVSS values are quoted from the named source; where the vendor and NVD differ, both are shown.
P1 — Listed in CISA Known Exploited Vulnerabilities
F1. Windows SMB client improper access control — CVE-2025-33073 (C5)
| Item | Detail |
|---|---|
| Component | C5, Windows 10 IoT Enterprise LTSC 2021 (21H2), build 10.0.19044.4000 |
| Evidence | NVD record for CVE-2025-33073: https://nvd.nist.gov/vuln/detail/CVE-2025-33073 ; CISA KEV catalog entry (added 2025-10-20): https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33073 ; Microsoft: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073 |
| Summary | Improper access control in the Windows SMB client allows an authorized attacker to elevate privileges over a network |
| CVSS | 8.8 (CVSS 3.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, assigned by Microsoft) |
| KEV | Yes. Added 2025-10-20; KEV due date 2025-11-10. Known ransomware use: “Unknown” in the catalog |
| Affected | NVD lists Windows 10 21H2 builds below 10.0.19044.5965 |
| Fix | Install the Windows cumulative update that raises the build to 10.0.19044.5965 or later (the assumed build 19044.4000 is below this) |
| Mitigation if patching must wait | Restrict SMB to the segments that need it; block SMB (TCP 445) at the machine boundary; enforce SMB signing where the application allows. Follow vendor mitigation instructions on the Microsoft page |
F2. Agere modem driver untrusted pointer dereference — CVE-2025-24990 (C5)
| Item | Detail |
|---|---|
| Component | C5, same industrial PC |
| Evidence | NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24990 ; CISA KEV catalog (added 2025-10-14): https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24990 |
| Summary | Vulnerability in a third-party Agere modem driver that ships natively with supported Windows versions; Microsoft states it is aware of exploitation (per NVD description of the KEV entry). It is a local privilege issue: an attacker needs prior access to the PC |
| CVSS | Not quoted here; see the NVD record (score and vector are shown there) |
| KEV | Yes. Added 2025-10-14; KEV due date 2025-11-04. Known ransomware use: “Unknown” |
| Affected | NVD lists Windows 10 21H2 (x64) builds below 10.0.19044.6456 |
| Fix | Install the Windows cumulative update that raises the build to 10.0.19044.6456 or later |
| Note | The driver is not needed on a machine PC without a modem; the cumulative update removes the vulnerable component as part of the fix |
P2 — CVSS 8.0 or higher, no KEV listing
F3. S7-1200: weak protection of the built-in global private key — CVE-2022-38465 (C1)
| Item | Detail |
|---|---|
| Component | C1, SIMATIC S7-1200 CPU 1214C, V4.2.3 |
| Evidence | Siemens ProductCERT SSA-568427, published 2022-10-11: https://cert-portal.siemens.com/productcert/html/ssa-568427.html ; NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-38465 |
| Summary | The key used for legacy protection of configuration data and for legacy PG/PC and HMI communication can be recovered by an offline attack against a single CPU of the family; this can expose configuration data and weaken legacy engineering and HMI communication |
| CVSS | 9.3 (Siemens, CVSS 3.1, local attack vector AV:L); 7.8 (NVD) |
| Fix | S7-1200 CPU family: update to V4.5.0 or later, migrate the project in TIA Portal (V17 or later) and redeploy; configure the CPU to “Only allow secure PG/PC and HMI communication” |
| Mitigation | Use legacy (non-TLS) PG/PC and HMI communication only in trusted networks; protect access to the TIA Portal project and to the CPU and memory card |
| Reachability | Local-vector issue; relevant mainly where an attacker can obtain a CPU, a memory card or project data, or observe legacy engineering traffic |
F4. S7-1200: memory protection bypass — CVE-2020-15782 (C1)
| Item | Detail |
|---|---|
| Component | C1, same CPU |
| Evidence | Siemens ProductCERT SSA-434534, published 2021-05-28, last update 2021-09-14: https://cert-portal.siemens.com/productcert/html/ssa-434534.html ; NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-15782 |
| Summary | A memory protection bypass that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data (reached over the S7 communication service) |
| CVSS | 8.1 (Siemens SSA, version 1.1); 9.8 (NVD, AV:N/AC:L/PR:N/UI:N) |
| Fix | S7-1200 CPU family: update to V4.5.0 or later |
| Mitigation | Apply password protection for S7 communication; disallow client connections via the ENDIS_PW instruction; apply defense in depth per Siemens’ operational guidelines for Industrial Security |
| Reachability | Network-reachable if the CPU’s S7 port is accessible. Whether it is accessible in a real installation is not known from the BOM |
F5. Weintek cMT3000 HMI web CGI — CVE-2023-38584, CVE-2023-43492, CVE-2023-40145 (C2)
| Item | Detail |
|---|---|
| Component | C2, Weintek cMT3072, OS 20210115 |
| Evidence | CISA ICSA-23-285-12 (published 2023-10-12): https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12 ; Weintek bulletin referenced by NVD: https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf |
| Summary | Two stack-based buffer overflows (CVE-2023-38584 in command_wb.cgi, CVE-2023-43492 in codesys.cgi) that could let an unauthenticated attacker hijack control flow and bypass login; one OS command injection (CVE-2023-40145) |
| CVSS | 9.8, 9.8 and 8.8 (CVSS 3.1); advisory overall 9.8 |
| Affected | cMT3072: OS version 20210218 or prior |
| Fix | Update to OS version 20210219 (cMT3072); the advisory lists the corresponding versions for the other cMT3000 models |
| Mitigation | CISA general measures: no internet exposure, firewall and segment the control network, use VPN for remote access and keep it updated |
| Reachability | Network-reachable web interface; exposure depends on whether the HMI web service is enabled and on which network |
F6. SINAMICS S200 unlocked bootloader — CVE-2024-56336 (C3)
| Item | Detail |
|---|---|
| Component | C3, SINAMICS S200 servo drive, FS 02, serial prefix SZVS8 (illustrative) |
| Evidence | Siemens ProductCERT SSA-787280, published 2025-03-11: https://cert-portal.siemens.com/productcert/html/ssa-787280.html ; NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-56336 |
| Summary | A specific range of produced devices has an unlocked bootloader, which could allow an attacker to download untrusted firmware that damages or compromises the device |
| CVSS | 9.8 (CVSS 3.1) and 9.5 (CVSS 4.0), as published by Siemens |
| Affected | Devices with serial number beginning SZVS8, SZVS9, SZVS0 or SZVSN and FS number 02 |
| Fix | No firmware fix listed. Siemens’ remediation: follow the general security recommendations, apply defense in depth, and contact customer service for further support |
| Mitigation | Protect network access to the drive; keep its fieldbus and engineering interfaces inside a protected zone |
| Note | This finding depends on a serial-number range. A BOM that omits serial numbers cannot confirm it; the report flags it as “to be confirmed on the nameplate” |
F7. Teltonika RUT router and RMS — CVE-2023-32350, CVE-2023-32349 (C4)
| Item | Detail |
|---|---|
| Component | C4, Teltonika RUT950, RutOS 00.07.03 |
| Evidence | CISA ICSA-23-131-08 (Teltonika Remote Management System and RUT model routers): https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08 ; NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-32350 |
| Summary | OS command injection in a Lua service (CVE-2023-32350, firmware 00.07.00 through 00.07.03) and arbitrary code execution through an externally configurable packet dump utility (CVE-2023-32349, firmware 00.07.00 through 00.07.03.4). Both require an authenticated attacker on an adjacent network |
| CVSS | 8.0 each (AV:A/AC:L/PR:L/UI:N); advisory overall 9.0 because the same advisory covers Teltonika’s cloud Remote Management System (RMS) |
| Fix | Teltonika recommends updating to the latest firmware for the router model. CISA’s text does not name a specific fixed build; confirm the current version on Teltonika’s download page for the model |
| RMS | RMS cloud versions before 4.10.0 (and before 4.14.0 for CVE-2023-2586) were affected; per the advisory, Teltonika has already updated the RMS service. If the machine uses RMS for remote access, no action is needed on the cloud side |
| Mitigation | Do not expose the router management interface to the internet; use strong unique credentials; limit who can authenticate on the LAN side |
| Why it matters | The router is the machine’s path to remote service access, so it sits at the boundary of the machine network |
P3 — Remaining findings
F8. Cognex In-Sight cameras and In-Sight Explorer — CVE-2025-52873, CVE-2025-53969 and others (C6)
| Item | Detail |
|---|---|
| Component | C6, Cognex In-Sight 7000 series, 6.5.1 |
| Evidence | CISA ICSA-25-261-06 (published 2025-09-18): https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06 ; NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-53969 |
| Summary | Weaknesses in the camera’s telnet management service (port 23) and in the proprietary management protocol (TCP port 1069): hard-coded password, cleartext credentials during firmware upgrade, permissions that let a protected user change network settings, and a denial-of-service condition on repeated failed logins |
| CVSS | Highest CVSS 3.1 in the advisory: 8.8 (CVE-2025-53969); 8.1 (CVE-2025-52873); CVSS 4.0 8.6 for the advisory |
| Affected | In-Sight 2000, 7000, 8000 and 9000 series and In-Sight Explorer, versions 5.x up to and including 6.5.1 |
| Fix | None. Cognex states that In-Sight Explorer based systems are legacy products not intended for new applications and advises moving to In-Sight Vision Suite based systems (for example In-Sight 2800, 3800 or 8900 series) |
| Mitigation | Place the camera in an isolated vision/line VLAN; block access to ports 23 and 1069 from outside that VLAN; do not expose to the internet |
| Reachability | Mostly adjacent-network; exposure is limited when the camera is only reachable from the PLC and the vision workstation |
5. Compliance mapping (indicative)
Indicative only. This table suggests where each finding is relevant to a regulation or standard. It is a working aid for the builder’s own conformity assessment, not a legal opinion and not an assessment against the standards. A formal mapping requires the machine’s risk assessment and intended use.
Reference points used:
- Machinery Regulation (EU) 2023/1230, Annex III, essential health and safety requirements: protection against corruption of the control system (section 1.1.9) and safety and reliability of control systems (section 1.2.1). The regulation applies from 20 January 2027.
- Cyber Resilience Act (EU) 2024/2847, Annex I: Part I (properties of products with digital elements, including secure by default configuration, access control, confidentiality and integrity protection, minimizing attack surface) and Part II (vulnerability handling, including an SBOM and timely security updates).
- IEC 62443-4-2: technical security requirements for IACS components; component requirement (CR) names shown for orientation.
| Finding | Machinery Reg. 2023/1230 Annex III (indicative) | CRA Annex I (indicative) | IEC 62443-4-2 (indicative) |
|---|---|---|---|
| F1 Windows SMB client (C5) | 1.1.9 corruption protection: operating system of the supervising PC must not allow unauthorized privilege gain | Part II: vulnerability handling and security updates; Part I: limit attack surface | CR 2.1 authorization enforcement; CR 3.4 software and information integrity |
| F2 Agere modem driver (C5) | 1.1.9 | Part II security updates; Part I: remove unneeded interfaces | CR 2.1; CR 7.7 least functionality |
| F3 S7-1200 key protection (C1) | 1.1.9: protection of control logic and configuration; 1.2.1 | Part I: confidentiality of stored and transmitted data | CR 4.1 information confidentiality; CR 1.5 authenticator management |
| F4 S7-1200 memory protection (C1) | 1.1.9; 1.2.1 | Part I: integrity protection against unauthorized manipulation | CR 3.1 communication integrity; CR 3.4 software integrity |
| F5 Weintek web CGI (C2) | 1.1.9; 1.2.1 (operator interface influences control) | Part I: access control; limit attack surface | CR 1.1 human user identification and authentication; CR 2.1 |
| F6 SINAMICS S200 bootloader (C3) | 1.1.9; 1.2.1 | Part I: integrity of firmware; secure boot expectations | CR 3.14 integrity of the boot process |
| F7 Teltonika RUT (C4) | 1.1.9 (remote access path) | Part I: access control and attack surface; Part II: updates | CR 1.1; CR 2.1; CR 3.1 |
| F8 Cognex In-Sight (C6) | 1.1.9 | Part I: confidentiality and integrity of communication; Part II: end-of-life/support handling | CR 1.5; CR 4.1; CR 7.1 denial-of-service protection |
6. Recommended actions
Now (next 30 days)
- Windows IoT PC (F1, F2): apply the Windows cumulative update to build 10.0.19044.6456 or later; restrict SMB between the machine network and other networks. Record the date and build in the machine file.
- Confirm exposure: on the real machine, check which of ports 445 (SMB), 102 (S7), 80/443 (HMI and router web), 23 and 1069 (camera) are reachable from outside the machine network.
- Serial-number check (F6): read the SINAMICS S200 serial numbers from nameplates and compare with the range in SSA-787280.
- Router (F7): confirm the RUT firmware version and update to the current build from Teltonika for the model; check that the management interface is not reachable from the internet.
Before 2027 (before the Machinery Regulation applies on 20 January 2027)
- S7-1200 (F3, F4): plan the update to V4.5.0 or later with the TIA Portal project migration and “secure PG/PC and HMI communication”; schedule it into a maintenance window with test.
- Weintek HMI (F5): update the cMT3072 OS to 20210219 or later (current release preferred).
- Camera (F8): decide on migration from the legacy In-Sight line; until then, isolate it in a vision VLAN.
- Documentation: keep this SBOM with the technical file, together with a short procedure for how new advisories are checked and how updates reach customers.
Ongoing monitoring
- Re-run the SBOM against advisories at least monthly, and whenever the BOM changes, a new firmware is released or CISA adds an entry to the KEV catalog that matches a component.
- Keep a record of each decision (patched, mitigated, accepted) with date and owner. This record is the evidence a customer or an authority will ask for.
- Review end-of-support dates for each component once a year.
7. What Softwsp does next
- Machine Fleet Monitoring. Once the SBOM of each machine model is stored, Softwsp checks it continuously against public advisories and the KEV catalog and tells the builder which machines, at which customers, are affected by a new advisory. This turns the one-time report above into a maintained view.
- Compliance pack. Softwsp prepares the documents a builder needs for the technical file: the SBOM, the vulnerability-handling procedure, the update record and a mapping to Machinery Regulation 2023/1230, the CRA and IEC 62443-4-2 for the builder’s own conformity assessment.
- Next step for a real machine. Send the electrical BOM or a firmware export for one machine model. Softwsp returns a report like this one for that machine.
8. Scope and limitations
- Based on the BOM only. No device was tested, scanned or accessed. Reachability and exploitability on a real installation are not assessed.
- Hypothetical machine. Component selection and firmware versions are invented for this sample; vulnerability data is real and was read at the source on 2026-10-19.
- Public data only. Findings come from public advisories and databases. Unpublished or vendor-private vulnerabilities are not covered, and an absence of findings for a component would not mean it has none.
- Matching confidence. Where no product-level CPE exists (C3, C6), matching relies on vendor product names and version or serial ranges. Scores differ between sources (for example F3, F4); the report shows both.
- Not a certification. This is not a conformity assessment, a penetration test, a legal opinion or a certification against any standard. The compliance mapping is indicative.
- Point in time. Advisories are updated; the data is current to 2026-10-19 (KEV catalog version 2026.10.16).