Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Industrial control advisorySeverity 7.8 high

Siemens Web Installer

ICSA-25-226-22 · CISA · August 12, 2025

Summary

The installers used to install several Siemens products are affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected installer component. This vulnerability poses a risk only during setup and installation phase of the affected applications downloaded e.g. via OSD (Online Software Delivery). Siemens has released new versions for several affected products and recommends using the latest versions during setup and installation. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

From CISA, quoted as published. Check the source before acting.

What to do

Harden the application host to prevent local access by untrusted personnel Install applications only from an empty directory, thereby minimizing the likelihood of malicious DLLs being present Currently no fix is planned Currently no fix is available Update to V1.5.5.0 or later version Update to V10.0 SP1 or later version Update to V10.0 SP1 UC01 or later version Update to V10.0 SP1 Upd2 or later version Update to V17 Update 9 or later version Update to V18 Update 6 or later version Update to V19 Update 4 or later version Update to V2.0 Upd3 or later version Update to V2.0 SP2 or later version Update to V2.1 or later version Update to V2.2 or later version Update to V2.3 or later version Update to V20 or later version Update to V20 Update 1 or later version Update to V20 Update 3 or later version Update to V20 Update 4 or later version Update to V20.0 Update 1 or later version Update to V2024 SP1 Upd2 or later version Update to V21 or later version Update to V3.0.6 or later version Update to V3.1.0.2 or later version Update to V3.1.2.2 or later version Update to V3.5 SP4 Update 1 or later version Update to V31.1.5 or later version Update to V4.0 or later version Update to V4.0.1 or later version Update to V4.1 or later version Update to V4.1.0.1 or later version Update to V5.0.0.1 or later version Update to V5.0 SP4 or later version Update to V6.0 SP1 or later version Update to V6.0 SP3 or later version Update to V6.2 Upd3 or later version Update to V6.9 or later version Update to V7.0 Update 1 or later version Update to V7.5 SP2 Update 20 or later version Update to V8.0 Update 8 or later version Update to V8.1 Update 3 or later version Update to V9.1 Upd8 or later version Update to V9.1 SP1 UC08 or later version Update to V9.1 SP1 Upd8 or later version Update to V9.1 SP2 Upd2 or later version Update to V9.1 SP2 Upd4 or later version Update to V9.1 SP2 Upd6 or later version Update to V9.1 SP2 Upd8 or later version Update to V9.3 SP1 Upd2 or later version

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2025-300337.8 highNo0.2%Uncontrolled Search Path Element (CWE-427)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
SiemensAutomation License Manager V6.0vers:all/*—
SiemensAutomation License Manager V6.2vers:intdot/<6.2.0.3—
SiemensCEMAT V10.0vers:all/*—
SiemensCP PtP Param configuring interfacevers:all/*—
SiemensCreate MyConfig (CMC)vers:intdot/<6.9—
SiemensEnergy Support Library (EnSL)vers:all/*—
SiemensFM Configuration Packagevers:all/*—
SiemensModular PID CTRL Toolvers:all/*—
SiemensMultiFieldbus Configuration Tool (MFCT)vers:intdot/<1.5.5.0—
SiemensOpenPCS 7 V10.0vers:all/*—
SiemensOpenPCS 7 V9.1vers:all/*—
SiemensSiemens Network Planner (SINETPLAN)vers:intdot/<2.0.2—
SiemensSIMATIC Automation Toolvers:intdot/<5.0.4—
SiemensSIMATIC Automation Tool SDK Windowsvers:intdot/<5.0.4—
SiemensSIMATIC BATCH V10.0vers:all/*—
SiemensSIMATIC BATCH V9.1vers:all/*—
SiemensSIMATIC Control Function Library (CFL) V1.xvers:all/*—
SiemensSIMATIC Control Function Library (CFL) V2.xvers:all/*—
SiemensSIMATIC Control Function Library (CFL) V3.xvers:intdot/<3.1.0.2—
SiemensSIMATIC Control Function Library (CFL) V4.xvers:intdot/<4.1—
SiemensSIMATIC D7-SYSvers:intdot/<10.0.1—
SiemensSIMATIC eaSie Core Package (6DL5424-0AX00-0AV8)vers:all/*—
SiemensSIMATIC eaSie Document Skillsvers:all/*—
SiemensSIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8)vers:all/*—
SiemensSIMATIC eaSie Workflow Skillsvers:all/*—
SiemensSIMATIC Energy Suite V17vers:all/*—
SiemensSIMATIC Energy Suite V18vers:all/*—
SiemensSIMATIC Energy Suite V19vers:intdot/<19.0.4—
SiemensSIMATIC Logon V1.6vers:all/*—
SiemensSIMATIC Logon V2.0vers:intdot/<2.0.0.3—
SiemensSIMATIC Management Agentvers:intdot/<9.1.1.8—
SiemensSIMATIC Management Consolevers:intdot/<9.1.1.8—
SiemensSIMATIC MTP CREATOR V2.xvers:intdot/<2.1—
SiemensSIMATIC MTP CREATOR V3.xvers:all/*—
SiemensSIMATIC MTP CREATOR V4.xvers:intdot/<4.1.0.1—
SiemensSIMATIC MTP CREATOR V5.xvers:intdot/<5.0.0.1—
SiemensSIMATIC MTP Integrator V1.xvers:all/*—
SiemensSIMATIC MTP Integrator V2.xvers:all/*—
SiemensSIMATIC NET PC Software V16vers:all/*—
SiemensSIMATIC NET PC Software V17vers:all/*—

99 more in the source.

Why it's on these mode pages

  • Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)

Change history

  1. August 12, 2025: Publication Date
  2. September 9, 2025: Added Sahil Shah to acknowledgment; Added fix for SIMATIC Energy Suite V19, SIMATIC Energy Suite V20, SIMATIC MTP CREATOR V4.x, SIMATIC Control Function Library (CFL) V3.x, TIA Portal Test Suite V19, TIA Portal Test Suite V20, SIMATIC WinCC Visualization Architect V19, SIMATIC WinCC Visualization Architect V20, SIMATIC S7-PCT; Updated No fix planned for SIMATIC ProSave V17,SIMATIC WinCC flexible ES, SIMATIC Control Function Library (CFL) V1.x, SIMATIC Control Function Library (CFL) V2.x
  3. October 14, 2025: Added fix for MTP Creator V2.x, CFL V4.x, Simatic WinCC Unified Line Coordination and Simatic WinCC Unified Sequence
  4. November 11, 2025: Added Fixes for PCS 7 Logic Matrix V9.1, PCS7 Advanced Process Faceplates V9.1, SIMATIC PCS 7 Basis Faceplates V9.1 PCS 7 Basis Library V9.1, SIMATIC Management Agent V9.1, SIMATIC Management Console V9.1, PCS 7 V9.1, PCS 7 V10.0
  5. December 9, 2025: Added fixes for TIA Project-Server, TIA Portal Cloud Connector, SIMATIC MTP CREATOR V5.x, SIMATIC S7-1500 Software Controller V3, Simatic Prosave, TIA Portal V20, V19, and V17 and updated Energy suite V17 and V18, SIMATIC S7-1500 Software Controller V2 with no fix planned
  6. January 13, 2026: Added fixes for WinCC Panel Image Setup, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC Visualization Architect (SiVArc) V17, SIMATIC Process Historian 2024, SIMATIC PCS 7 Basis Library V10.0, SIMATIC Logon V2.0, SIMATIC PDM V9.3, and MultiFieldbus Configuration Tool (MFCT); Clarified that no fix is planned for TIA Project-Server V17
  7. January 14, 2026: CISA Republication - Initial Republication of Siemens ProductCERT SSA-282044 advisory
  8. February 10, 2026: CISA Republication - Updated remediation for SIMATIC S7-PLCSIM V17, V18, V19 to 'No fix planned' and added fix version for Create MyConfig (CMC)
  9. February 10, 2026: Updated remediation for SIMATIC ODK 1500S and SIMATIC S7-PLCSIM V17, V18, V19 to 'No fix planned' and added fix version for Create MyConfig (CMC)
  10. February 12, 2026: CISA Republication update based on Siemens ProductCERT SSA-282044 advisory
  11. March 10, 2026: Added fixes for Simatic Target, Simatic Wincc V7.5 and V8.0
  12. March 12, 2026: CISA Republication update based on Siemens ProductCERT SSA-282044 advisory
  13. August 11, 2026: Added fix for D7-SYS, Automation Tool, Automation Tool SDK Windows and Updated PDM MS V5.0, Process Historian 2022,PCS 7 Advanced Process Functions,PCS 7 Advanced Process Graphics,PCS 7 Logic Matrix V10.0,PCS 7 Advanced Process Library incl. Faceplates V10.0,BATCH V10.0,PCS 7 Industry Library V9.1 and V10.0,PCS 7/OPEN OS V9.1,PCS 7 PowerControl ,PCS 7 Standard Chemical Library V10.0 and V9.1,PCS 7 TeleControl,PDM V9.2,S7 F Systems V6.4,Safety Matrix, OpenPCS 7 V9.1 and V10.0 to no fix planned
  14. September 8, 2026: Added fix version for SINETPLAN and TIA Portal V18; Updated affected version for Telecontrol and PowerControl to V9.1
  15. September 15, 2026: CISA Republication update based on Siemens ProductCERT SSA-282044 advisory
  16. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com