Vulnerability details
CVE-2025-30175
Siemens SIMATIC PCS neoSiemens SINEC NMSSiemens SINEMA Remote ConnectSiemens Totally Integrated Automation Portal V17Siemens Totally Integrated Automation Portal V18Siemens Totally Integrated Automation Portal V19
CVSS 4.0
8.7High
Official description
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote Connect (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions), Totally Integrated Automation Portal (TIA Portal) V20 (All versions), User Management Component (UMC) (All versions < V2.15.1.1). Affected products contain a out of bound write buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (siemens) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (siemens) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Siemens | SIMATIC PCS neo V4.1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC PCS neo V5.0 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SINEC NMS | v < V4.0 | CVEProject cvelistV5 (CNA) |
| Siemens | SINEMA Remote Connect | All | CVEProject cvelistV5 (CNA) |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V17 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V18 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V19 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V20 | All | CVEProject cvelistV5 (CNA) |
| Siemens | User Management Component (UMC) | v < V2.15.1.1 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-05-13
- Last updated
- 2025-07-08
- State
- Published
- Assigner (CNA)
- siemens
Exploit prediction (EPSS)
0.65%
Probability of exploitation in 30 days
51.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-787Out-of-bounds Write