CVE-2025-40584 Information

Aug 13, 2025 cve

Description

A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions) SIMOTION SCOUT TIA V5.5 (All versions) SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7) SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1) SIMOTION SCOUT V5.4 (All versions) SIMOTION SCOUT V5.5 (All versions) SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7) SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1) SINAMICS STARTER V5.5 (All versions) SINAMICS STARTER V5.6 (All versions) SINAMICS STARTER V5.7 (All versions). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Reference

https://cert-portal.siemens.com/productcert/html/ssa-186293.html

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

5.5

CNNVD-202508-1030 (Published: 2025-08-12)

Share on: