SSA-186293

csafDEsiemens_psirt

SSA-186293: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER

view advisory published 2025-08-12

SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER are affected by an XXE injection vulnerability that could allow an attacker to access arbitrary application files. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2025-40584US——
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTI…
02

references

External citations — patches, advisories, analysis.

03

remediations (22)

  • MitigationSIMOTION SCOUT TIA V5.4

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT TIA V5.5

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT TIA V5.6

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT TIA V5.7

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT V5.4

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT V5.5

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT V5.6

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT V5.7

    Do not open untrusted XML files in affected applications

  • MitigationSINAMICS STARTER V5.5

    Do not open untrusted XML files in affected applications

  • MitigationSINAMICS STARTER V5.6

    Do not open untrusted XML files in affected applications

  • MitigationSINAMICS STARTER V5.7

    Do not open untrusted XML files in affected applications

  • No fix plannedSIMOTION SCOUT TIA V5.4

    Currently no fix is planned

  • No fix plannedSIMOTION SCOUT TIA V5.5

    Currently no fix is planned

  • No fix plannedSIMOTION SCOUT V5.4

    Currently no fix is planned

  • No fix plannedSIMOTION SCOUT V5.5

    Currently no fix is planned

  • No fix plannedSINAMICS STARTER V5.5

    Currently no fix is planned

  • No fix plannedSINAMICS STARTER V5.6

    Currently no fix is planned

  • FixedSIMOTION SCOUT TIA V5.6

    Update to V5.6 SP1 HF7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989067/
  • FixedSIMOTION SCOUT TIA V5.7

    Update to V5.7 SP1 HF1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989066/
  • FixedSIMOTION SCOUT V5.6

    Update to V5.6 SP1 HF7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989067/
  • FixedSIMOTION SCOUT V5.7

    Update to V5.7 SP1 HF1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989066/
  • FixedSINAMICS STARTER V5.7

    Update to V5.7 HF2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/26233208/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan