CVE-2025-40584
Description
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions < V5.7 HF2). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.
How to fix
- Siemens SIMOTION SCOUT TIA V5.6V5.6 SP1 HF7 or later
- Siemens SIMOTION SCOUT TIA V5.7V5.7 SP1 HF1 or later
- Siemens SIMOTION SCOUT V5.6V5.6 SP1 HF7 or later
- Siemens SIMOTION SCOUT V5.7V5.7 SP1 HF1 or later
- Siemens SINAMICS STARTER V5.7V5.7 HF2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens SIMOTION SCOUT TIA V5.4 | 0 | — |
| Siemens SIMOTION SCOUT TIA V5.5 | 0 | — |
| Siemens SIMOTION SCOUT TIA V5.6 | v < V5.6 SP1 HF7 | V5.6 SP1 HF7 |
| Siemens SIMOTION SCOUT TIA V5.7 | v < V5.7 SP1 HF1 | V5.7 SP1 HF1 |
| Siemens SIMOTION SCOUT V5.4 | 0 | — |
| Siemens SIMOTION SCOUT V5.5 | 0 | — |
| Siemens SIMOTION SCOUT V5.6 | v < V5.6 SP1 HF7 | V5.6 SP1 HF7 |
| Siemens SIMOTION SCOUT V5.7 | v < V5.7 SP1 HF1 | V5.7 SP1 HF1 |
| Siemens SINAMICS STARTER V5.5 | 0 | — |
| Siemens SINAMICS STARTER V5.6 | 0 | — |
| Siemens SINAMICS STARTER V5.7 | v < V5.7 HF2 | V5.7 HF2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.