SSA-563922: Local Privilege Escalation Vulnerability in SIMOTION Tools
Several tools for the SIMOTION system are affected by a local privilege escalation vulnerability. This could allow an attacker to execute arbitrary code with SYSTEM privileges when a legitimate user installs an application that uses the affected setup component. This vulnerability poses a risk only during setup and installation phase of the affected tools. Siemens has released a new version for SIMATIC Technology Package TPCamGen and recommends to update to the latest version. Siemens recommends specific mitigations for products where fixes are not or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-43715US | — | — | ||
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (10)
- MitigationSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- MitigationSIMOTION OA MIIF (6AU1820-3DA20-0AB0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- MitigationSIMOTION OACAMGEN (6AU1820-3EA20-0AB0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- MitigationSIMOTION OALECO (6AU1820-3HA20-0AB0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- MitigationSIMOTION OAVIBX (6AU1820-3CA20-0AB0)
Ensure that no other users are logged in and that no unknown programs are running before starting the installation of the affected products
- Kein Fix geplantSIMOTION OA MIIF (6AU1820-3DA20-0AB0)
Currently no fix is planned
- Kein Fix geplantSIMOTION OACAMGEN (6AU1820-3EA20-0AB0)
Currently no fix is planned
- Kein Fix geplantSIMOTION OALECO (6AU1820-3HA20-0AB0)
Currently no fix is planned
- Kein Fix geplantSIMOTION OAVIBX (6AU1820-3CA20-0AB0)
Currently no fix is planned
- BehobenSIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)
Update to V1.3.1 or later version To obtain the patch and update information, please contact your regular Siemens contact person.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan