CVE-2025-40584

Description

A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.

PUBLISHED Reserved 2025-04-16 | Published 2025-08-12 | Updated 2025-08-13 | Assigner siemens

Problem types

CWE-611: Improper Restriction of XML External Entity Reference

Product status

References

cert-portal.siemens.com/productcert/html/ssa-186293.html

cve.org (CVE-2025-40584)

nvd.nist.gov (CVE-2025-40584)

Download JSON