CVE-2025-40584

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-40584
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions < V5.7 HF2). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-186293.html
Configurations

No configuration.

History

14 Oct 2025, 10:15

Type Values Removed Values Added
Summary
  • (es) Se ha identificado una vulnerabilidad en SIMOTION SCOUT TIA V5.4 (todas las versiones), SIMOTION SCOUT TIA V5.5 (todas las versiones), SIMOTION SCOUT TIA V5.6 (todas las versiones &lt; V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (todas las versiones &lt; V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (todas las versiones), SIMOTION SCOUT V5.5 (todas las versiones), SIMOTION SCOUT V5.6 (todas las versiones &lt; V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (todas las versiones &lt; V5.7 SP1 HF1), SINAMICS STARTER V5.5 (todas las versiones), SINAMICS STARTER V5.6 (todas las versiones), SINAMICS STARTER V5.7 (todas las versiones). La aplicación afectada contiene una vulnerabilidad de inyección de entidad externa XML (XXE) al analizar archivos XML especialmente manipulados. Esto podría permitir que un atacante lea archivos arbitrarios en el sistema.
Summary (en) A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system. (en) A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions < V5.7 HF2). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.

12 Aug 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-12 12:15

Updated : 2025-10-14 10:15

NVD link : CVE-2025-40584

Mitre link : CVE-2025-40584

CVE.ORG link : CVE-2025-40584

JSON object : View

Products Affected

No product.

CWE
CWE-611

Improper Restriction of XML External Entity Reference