SSA-186293

csafDEsiemens_psirt

SSA-186293: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER

Advisory ansehen veröffentlicht 2025-08-12

SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER are affected by an XXE injection vulnerability that could allow an attacker to access arbitrary application files. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2025-40584US——
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTI…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (22)

  • MitigationSIMOTION SCOUT TIA V5.4

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT TIA V5.5

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT TIA V5.6

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT TIA V5.7

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT V5.4

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT V5.5

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT V5.6

    Do not open untrusted XML files in affected applications

  • MitigationSIMOTION SCOUT V5.7

    Do not open untrusted XML files in affected applications

  • MitigationSINAMICS STARTER V5.5

    Do not open untrusted XML files in affected applications

  • MitigationSINAMICS STARTER V5.6

    Do not open untrusted XML files in affected applications

  • MitigationSINAMICS STARTER V5.7

    Do not open untrusted XML files in affected applications

  • Kein Fix geplantSIMOTION SCOUT TIA V5.4

    Currently no fix is planned

  • Kein Fix geplantSIMOTION SCOUT TIA V5.5

    Currently no fix is planned

  • Kein Fix geplantSIMOTION SCOUT V5.4

    Currently no fix is planned

  • Kein Fix geplantSIMOTION SCOUT V5.5

    Currently no fix is planned

  • Kein Fix geplantSINAMICS STARTER V5.5

    Currently no fix is planned

  • Kein Fix geplantSINAMICS STARTER V5.6

    Currently no fix is planned

  • BehobenSIMOTION SCOUT TIA V5.6

    Update to V5.6 SP1 HF7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989067/
  • BehobenSIMOTION SCOUT TIA V5.7

    Update to V5.7 SP1 HF1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989066/
  • BehobenSIMOTION SCOUT V5.6

    Update to V5.6 SP1 HF7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989067/
  • BehobenSIMOTION SCOUT V5.7

    Update to V5.7 SP1 HF1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109989066/
  • BehobenSINAMICS STARTER V5.7

    Update to V5.7 HF2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/26233208/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan