SSA-563922: Local Privilege Escalation Vulnerability in SIMOTION Tools
Several tools for the SIMOTION system are affected by a local privilege escalation vulnerability. This could allow an attacker to execute arbitrary code with SYSTEM privileges when a legitimate user installs an application that uses the affected setup component. This vulnerability poses a risk only during setup and installation phase of the affected tools. Siemens has released a new version for SIMATIC Technology Package TPCamGen and recommends to update to the latest version. Siemens recommends specific mitigations for products where fixes are not or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-43715US | — | — | ||
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory… | ||||
references
External citations — patches, advisories, analysis.
remediations (10)
- MitigationSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- MitigationSIMOTION OA MIIF (6AU1820-3DA20-0AB0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- MitigationSIMOTION OACAMGEN (6AU1820-3EA20-0AB0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- MitigationSIMOTION OALECO (6AU1820-3HA20-0AB0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- MitigationSIMOTION OAVIBX (6AU1820-3CA20-0AB0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- No fix plannedSIMOTION OA MIIF (6AU1820-3DA20-0AB0)
Currently no fix is planned
- No fix plannedSIMOTION OACAMGEN (6AU1820-3EA20-0AB0)
Currently no fix is planned
- No fix plannedSIMOTION OALECO (6AU1820-3HA20-0AB0)
Currently no fix is planned
- No fix plannedSIMOTION OAVIBX (6AU1820-3CA20-0AB0)
Currently no fix is planned
- FixedSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)
Update to V1.3.1 or later version To obtain the patch and update information, please contact your regular Siemens contact person.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan